InfoSecBulletin Cybersecurity for mankind
CISA has added five new CVEs to its Known Exploited Vulnerabilities catalog, including issues from Microsoft, Apple, and Oracle.
The vulnerabilities flagged by CISA include:
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
CVE-2022-48503 is a critical vulnerability (8.8 severity) in several Apple products that allows for arbitrary code execution via web content. Apple fixed it with better bounds checks.
CVE-2025-33073 is a Microsoft Windows SMB Client vulnerability rated 8.8 for improper access control, which Microsoft said is unlikely to be exploited in the June Patch Tuesday update.
CVE-2025-61884 is a 7.5-severity SSRF vulnerability in Oracle E-Business Suite that was patched by Oracle on October 11.
CVE-2025-2746 and CVE-2025-2747, which are both 9.8-rated password authentication bypass issues in Kentico Xperience Staging Sync Server.
Oracle Vulnerabilities Under Attack:
CISA doesn’t provide details on how vulnerabilities are being exploited, but the October 11 CVE-2025-61884 patch apparently addressed proof-of-concept (PoC) exploit code that the Scattered LAPSUS$ Hunters threat group posted to its Telegram channel on October 3.
The October 11 Oracle E-Business Suite CVE-2025-61884 vulnerability announcement followed an ongoing campaign by the CL0P ransomware group to exploit CVE-2025-61882, a 9.8-severity remote code execution (RCE) flaw in Oracle E-Business Suite that had reportedly been exploited at least since August 9, with “suspicious activity” occurring a month before that.
CVE-2025-61882 was patched by Oracle on October 4, and CISA added the vulnerability to its KEV database on October 6.
CVE-2025-61882 was weaponized by the CL0P ransomware group in an extensive extortion campaign. They sent many emails to executives, falsely claiming the theft of sensitive data from their Oracle E-Business Suite environments, as reported by Google Threat Intelligence.
CL0P has claimed at least four victims in the Oracle campaign on its Tor site: Harvard University, Envoy Air (American Airlines), and two unconfirmed victims.
Microsoft CVE-2025-33073 Vulnerability Discovered by 8 Researchers:
Microsoft credited eight researchers with discovering CVE-2025-33073: Keisuke Hirata from CrowdStrike, Wilfried Bécard from Synacktiv, Cameron Stish from GuidePoint Security, Ahamada M’Bamba from BNP Paribas, Stefan Walter and Daniel Isern from SySS GmbH, RedTeam Pentesting GmbH, and James Forshaw from Google Project Zero.
Stish’s GuidePoint blog post on CVE-2025-33073 provides some interesting background on the vulnerability.
According to Microsoft, an attacker who successfully exploited the vulnerability could gain SYSTEM privileges.
When multiple attack vectors can be used, Microsoft assigns a score based on the scenario with the highest risk. In one scenario for the vulnerability, Microsoft said an attacker could convince a victim to connect to an attacker-controlled malicious application server, such as an SMB server. “Upon connecting, the malicious server could compromise the protocol,” Microsoft said.
“To exploit this vulnerability, an attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate,” Microsoft said. “This could result in elevation of privilege.”
