CISA warns of critical Oracle, Mitel flaws active exploitation

CISA has urgent warnings for organizations regarding three security flaws in Mitel and Oracle systems that are currently being exploited. These vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities catalog and pose major risks to federal agencies and businesses.

Two vulnerabilities impact Mitel MiCollab, a widely used unified communications platform for businesses.

• Alert

CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw

By infosecbulletin / Tuesday , October 27 2026

CISA has updated a new alert to reflect the addition of CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV)...

Read More

• Alert

Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw

By infosecbulletin / Monday , October 26 2026

Cloudflare has shared an urgent update to its Web Application Firewall (WAF) rules due to CVE-2026-111497, a Brotli issue. The release...

Read More

• Daily Security Update
• Data Breach

Daily Cyber security update for 26.10. 2026

By infosecbulletin / Monday , October 26 2026

Cyberattacks are rising around the world, including ransomware, malware, data leaks, and hacked websites. These events show how complex and...

Read More

• Hot Topic

The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours

By infosecbulletin / Monday , October 26 2026

AI startup Cathedral gained a limited access to internal systems at Anthropic in less than 12 hours, exposing employee information,...

Read More

• Daily Security Update
• Data Breach

Daily Cyber security update for 25. 10. 2026

By infosecbulletin / Sunday , October 25 2026

Cyberattacks are rising around the world, including ransomware, malware, data leaks, and hacked websites. These events show how complex and...

Read More

• Daily Security Update
• Data Breach

Daily Cyber security update for 24. 10. 2026

By infosecbulletin / Saturday , October 24 2026

Cyberattacks are rising around the world, including ransomware, malware, data leaks, and hacked websites. These events show how complex and...

Read More

• Alert

PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation

By infosecbulletin / Friday , October 23 2026

The PHP security team shared ways to protect against a new flaw that lets someone run unwanted code on certain...

Read More

• Hot Topic

US banks faced unauthorized access by AI agents in customer accounts: Axios reports

By infosecbulletin / Friday , October 23 2026

Major US banks have detected unauthorized access to customer accounts by third-party AI agents, with some systems taking actions beyond...

Read More

• Alert

Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager

By infosecbulletin / Thursday , October 22 2026

Fortinet has urged customers to prioritize security updates for FortiOS, FortiManager, and FortiAnalyzer scheduled for October 22, 2026. The coordinated...

Read More

• Cyber Attack
• Data Breach

Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed

By infosecbulletin / Wednesday , October 21 2026

Hacker offers to sell Rajasthan Government’s Department of Information Technology & Communication (DoIT&C) data in a underground forum. The threat...

Read More

CVE-2024-41713 (CVSS 9.1): This vulnerability in critical path traversal lets attackers access MiCollab servers without authentication, risking sensitive information and possible administrative control.

CVE-2024-55550 (CVSS 4.4): This vulnerability requires admin privileges but lets attackers read local files on the MiCollab server. When combined with CVE-2024-41713, it increases the risk, allowing access to arbitrary files and system compromise.

Mitel urges users to upgrade to MiCollab 9.8 SP2 (9.8.2.12) or later to address vulnerabilities with released updates and patches.

The third vulnerability, CVE-2020-2883 (CVSS 9.8), affects Oracle WebLogic Server. This critical flaw enables unauthenticated attackers to take control of the server remotely, risking data breaches, service disruptions, and malware infections.

CISA has required all Federal Civilian Executive Branch agencies to fix this vulnerability by January 28, 2025, highlighting its urgency.