U.S. CISA adds Oracle, Mozilla, Microsoft Windows, Linux Kernel, and Microsoft IE flaws to its Known Exploited Vulnerabilities catalog

Mozilla Firefox, SeaMonkey, and Thunderbird contain a memory-corruption vulnerability in the layout engine's CSS frame construction code (nsCSSFrameConstructor::ContentAppended) that is reachable whenever JavaScript is enabled. A remote attacker triggers the flaw by getting a user to load content — typically a malicious web page, or remote HTML content in Thunderbird — that calls the DOM appendChild method in a way that causes incorrect index tracking and the creation of multiple frames, corrupting memory. Successful exploitation allows the attacker to execute arbitrary code in the context of the affected application and the logged-in user. Anyone running the affected 2010-era Mozilla products with JavaScript enabled is exposed, which historically included the very large install base of these desktop applications. CISA added CVE-2010-3765 to its Known Exploited Vulnerabilities catalog on 2025-10-06, confirming exploitation in the wild (ransomware use not yet reported), and EPSS assigns an 83.3% probability of exploitation within the next 30 days.

Do: Upgrade Firefox, SeaMonkey, and Thunderbird to the fixed releases specified in Mozilla's security advisory for CVE-2010-3765; as an interim measure, disable JavaScript in Firefox/SeaMonkey and block remote content in Thunderbird, since the flaw requires JavaScript to be enabled. Per the CISA KEV required action, apply vendor mitigations, follow applicable BOD 22-01 guidance, or discontinue use of the product if mitigations are unavailable — inventory for legacy Mozilla installations and prioritize remediation given the 83.3% EPSS score and confirmed in-the-wild exploitation.

Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that can allow a remote attacker to execute arbitrary code. As with other browser memory-corruption flaws, it is triggered when Internet Explorer processes attacker-controlled content such as a malicious or compromised web page, causing the browser to access memory that has not been properly initialized. A successful attacker gains code execution under the privileges of the logged-on user, which can enable installation of programs, theft of data, or ransomware staging (ransomware association for this CVE is currently unknown). Anyone still running Internet Explorer is affected; no specific version ranges were provided in the source data, and because IE is a largely retired product, exposure is concentrated in legacy Windows deployments. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-10-06, indicating exploitation in the wild, and EPSS assigns it a 96.9% probability of exploitation within 30 days (100th percentile); no public proof-of-concept is known.

Do: Inventory your environment for any remaining Internet Explorer use, including legacy Windows systems and MSHTML/IE-mode dependencies, and apply Microsoft security updates addressing this vulnerability on any still-supported systems (the December 2010 cumulative security update MS10-090 resolves it). Where patching is not possible, follow the CISA KEV required action and BOD 22-01 guidance: apply vendor mitigations or discontinue use of Internet Explorer, given the 96.9% EPSS probability of exploitation within 30 days.

CVE-2011-3402 is a flaw in the TrueType font parsing engine of win32k.sys, part of the kernel-mode drivers in Microsoft Windows. A remote attacker can trigger it by presenting crafted font data to a user — for example, embedded in a Word document or on a web page — and gains the ability to execute arbitrary code on the target system. All Microsoft Windows versions covered by the vendor advisory are affected; the provided data does not enumerate specific version ranges. The vulnerability was famously exploited in the wild in 2011 by the Duqu malware campaign (the subject of Microsoft Security Advisory 2639658), and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-10-06. EPSS assigns a 78.3% probability of exploitation within the next 30 days; no current public proof-of-concept is known.

Do: Verify that every Windows host — prioritizing legacy, embedded, and internet-exposed machines — has the TrueType font-parsing fix released via Microsoft Security Advisory 2639658 (November 2011), and inventory missing patches rather than assuming modern builds are covered. Per CISA KEV/BOD 22-01 guidance, apply vendor mitigations or discontinue use of the product where patching is not possible. Given the 2025-10-06 KEV listing and 78.3% EPSS, treat any host without the win32k.sys font-parsing update as exposed and remediate within required timelines.

CVE-2013-3918 is an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control (icardie.dll) that ships with Internet Explorer on Microsoft Windows. An attacker triggers it by luring a user to a specially crafted web page; when the page invokes the affected ActiveX control, memory is written outside its allocated bounds and remote code execution can result. A successful attacker gains the same privileges as the currently logged-on user, so code executed under an administrator account would run with full administrative rights. Any Windows system with the vulnerable control present is affected — CISA lists 'Microsoft Windows' broadly without specific version ranges, and notes impacted releases may be end-of-life or end-of-service. The flaw has been exploited in the wild since its November 2013 disclosure, was fixed in an out-of-band update at the time, and CISA added it to the KEV catalog on 2025-10-06 with a very high EPSS of 73.9% (probability of exploitation within 30 days).

Do: Apply Microsoft's vendor fix for CVE-2013-3918 — the November 2013 out-of-band Internet Explorer cumulative security update (MS13-090) — or any later cumulative IE update on systems still in service; on systems that cannot be patched, set the killbit/disable the InformationCardSigninHelper ActiveX control or discontinue use of the EoL/EoS Windows releases per CISA guidance. Federal agencies must complete the required action within the BOD 22-01 deadline following the 2025-10-06 KEV addition. Verify that icardie.dll is no longer loadable in Internet Explorer (or IE mode in Edge) and that legacy IE usage is minimized across the estate.

CVE-2021-22555 is a heap out-of-bounds write (CWE-787) in the netfilter x_tables code (net/netfilter/x_tables.c) of the Linux kernel, a flaw present since version v2.6.19-rc1. A local attacker can trigger the heap memory corruption through user namespaces, meaning even unprivileged users, such as workloads running inside containers, can reach the vulnerable code path. Successful exploitation lets the attacker gain elevated kernel-level privileges, typically fully escaping a container, or crash the system in a denial of service. Affected users are essentially any Linux deployment on kernels in the affected range (distributions, cloud servers, container hosts), and CISA's product mapping additionally covers NetApp firmware for its c400/c250, H300S/H410S/H410C/H500S/H700S, FAS 8300/8700 and AFF A400 systems plus Brocade Fabric OS. The flaw has public proof-of-concept exploits (including Google security research), a high 78.7% EPSS exploitation probability over 30 days, and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-10-06, confirming exploitation in the wild.

Do: Upgrade Linux kernels to patched versions from your distribution and apply vendor live patches where offered (Ubuntu Kernel Live Patch notices LSN-0080/0081/0083 are referenced in public advisories), and install the corresponding NetApp and Brocade firmware updates for the listed systems. Where patching must wait, restrict creation of unprivileged user namespaces and limit unprivileged users' ability to configure netfilter rules. As a CISA KEV entry, federal agencies must remediate per BOD 22-01 by the catalog due date.

CVE-2021-43226 is an elevation-of-privilege vulnerability in the Windows Common Log File System (CLFS) driver, a kernel-mode component that manages common log files. A local attacker who already has limited privileges on a machine (the CVSS vector requires only low privileges, no user interaction, and a local attack vector) can trigger the flaw through crafted interactions with the CLFS driver and escalate to full SYSTEM-level control of the host. CISA notes known use in ransomware campaigns, where this class of local privilege escalation is typically chained after initial access. Affected deployments span essentially all supported Windows client releases of the era: Windows 7, Windows 8.1 and Windows RT 8.1, Windows 10 versions 1507 through 21H2, and Windows 11 21H2. The bug was patched in Microsoft's December 2021 Patch Tuesday as an actively exploited zero-day, and CISA added it to the Known Exploited Vulnerabilities catalog on 2025-10-06 with ransomware use noted, indicating demonstrated in-the-wild exploitation.

Do: Install the December 2021 Patch Tuesday (or any later) cumulative update for each affected release on all Windows 7, 8.1, Windows 10, and Windows 11 21H2 systems, and verify patch coverage through WSUS/Intune or equivalent inventory, per CISA KEV and BOD 22-01 guidance. Because this is a post-compromise privilege escalation used in ransomware chains, prioritize endpoints where low-privileged users can log in and hosts in ransomware-prone network segments.

CVE-2025-61882 is a critical (CVSS 9.8) authentication flaw (CWE-287) in the BI Publisher Integration component of the Oracle Concurrent Processing product within Oracle E-Business Suite. An unauthenticated attacker with network access over HTTP can exploit it remotely with no credentials and no user interaction, achieving a takeover of Oracle Concurrent Processing with high confidentiality, integrity, and availability impact. Any organization running Oracle E-Business Suite 12.2.3 through 12.2.14 is affected, especially instances reachable from the internet. The flaw is being actively exploited in the wild: the Cl0p data-theft group has used it to breach dozens of organizations (including Harvard University, with 1.3 TB of data leaked), CISA added it to the Known Exploited Vulnerabilities catalog on 2025-10-06 with known ransomware use, and EPSS puts its 30-day exploitation probability at 99.7%.

Do: Apply Oracle's released patch or mitigations for CVE-2025-61882 to affected E-Business Suite 12.2.3-12.2.14 deployments as instructed by the vendor; per CISA KEV requirements, federal agencies must follow BOD 22-01 guidance or discontinue use if mitigations are unavailable. Until patched, limit internet exposure of EBS and its BI Publisher/Concurrent Processing HTTP endpoints, and review web and application logs for unauthenticated access and signs of Cl0p-style data theft or follow-on ransomware.