InfoSecBulletin Cybersecurity for mankind
CISA has added five new CVEs to its Known Exploited Vulnerabilities catalog, including issues from Microsoft, Apple, and Oracle.
The vulnerabilities flagged by CISA include:
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
CVE-2022-48503 is a critical vulnerability (8.8 severity) in several Apple products that allows for arbitrary code execution via web content. Apple fixed it with better bounds checks.
CVE-2025-33073 is a Microsoft Windows SMB Client vulnerability rated 8.8 for improper access control, which Microsoft said is unlikely to be exploited in the June Patch Tuesday update.
CVE-2025-61884 is a 7.5-severity SSRF vulnerability in Oracle E-Business Suite that was patched by Oracle on October 11.
CVE-2025-2746 and CVE-2025-2747, which are both 9.8-rated password authentication bypass issues in Kentico Xperience Staging Sync Server.
Oracle Vulnerabilities Under Attack:
CISA doesn’t provide details on how vulnerabilities are being exploited, but the October 11 CVE-2025-61884 patch apparently addressed proof-of-concept (PoC) exploit code that the Scattered LAPSUS$ Hunters threat group posted to its Telegram channel on October 3.
The October 11 Oracle E-Business Suite CVE-2025-61884 vulnerability announcement followed an ongoing campaign by the CL0P ransomware group to exploit CVE-2025-61882, a 9.8-severity remote code execution (RCE) flaw in Oracle E-Business Suite that had reportedly been exploited at least since August 9, with “suspicious activity” occurring a month before that.
CVE-2025-61882 was patched by Oracle on October 4, and CISA added the vulnerability to its KEV database on October 6.
CVE-2025-61882 was weaponized by the CL0P ransomware group in an extensive extortion campaign. They sent many emails to executives, falsely claiming the theft of sensitive data from their Oracle E-Business Suite environments, as reported by Google Threat Intelligence.
CL0P has claimed at least four victims in the Oracle campaign on its Tor site: Harvard University, Envoy Air (American Airlines), and two unconfirmed victims.
Microsoft CVE-2025-33073 Vulnerability Discovered by 8 Researchers:
Microsoft credited eight researchers with discovering CVE-2025-33073: Keisuke Hirata from CrowdStrike, Wilfried Bécard from Synacktiv, Cameron Stish from GuidePoint Security, Ahamada M’Bamba from BNP Paribas, Stefan Walter and Daniel Isern from SySS GmbH, RedTeam Pentesting GmbH, and James Forshaw from Google Project Zero.
Stish’s GuidePoint blog post on CVE-2025-33073 provides some interesting background on the vulnerability.
According to Microsoft, an attacker who successfully exploited the vulnerability could gain SYSTEM privileges.
When multiple attack vectors can be used, Microsoft assigns a score based on the scenario with the highest risk. In one scenario for the vulnerability, Microsoft said an attacker could convince a victim to connect to an attacker-controlled malicious application server, such as an SMB server. “Upon connecting, the malicious server could compromise the protocol,” Microsoft said.
“To exploit this vulnerability, an attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate,” Microsoft said. “This could result in elevation of privilege.”
