Five New Exploited Bugs Land in CISA's Catalog — Oracle and Microsoft Among Targets

CVE-2022-48503 is a bounds-checking flaw (CWE-129, improper validation of array index) in the web content processing engine used by Safari and by web views across Apple platforms, rated 8.8 (High) with a network attack vector and user interaction required. An attacker triggers it by getting a victim to process maliciously crafted web content, typically by visiting a hostile webpage, and gains arbitrary code execution in the context of the application rendering that content. Anyone running Safari or iOS, iPadOS, macOS Monterey, tvOS, or watchOS versions prior to the fixed releases (iOS/iPadOS 15.6, macOS Monterey 12.5, Safari 15.6, tvOS 15.6, watchOS 8.7) is affected, with older devices that cannot upgrade at greatest risk. CISA added the bug to its Known Exploited Vulnerabilities catalog on 2025-10-20, confirming exploitation in the wild, and October 2025 reporting on the Coruna iOS exploit kit describes exploit chains being used against older iOS versions. EPSS currently assigns a 3.2% probability of exploitation in the next 30 days (87th percentile); ransomware use is unknown.

Do: Update affected devices to iOS/iPadOS 15.6 or later, macOS Monterey 12.5 or later, Safari 15.6 or later, tvOS 15.6 or later, and watchOS 8.7 or later; for older devices that cannot run these versions, apply Apple's emergency fixes for older iOS releases as reported in recent advisories. Federal agencies must apply vendor mitigations per BOD 22-01 guidance or discontinue use of affected products if mitigations are unavailable. Inventory managed Apple fleets for OS/Safari versions below the fixed releases and treat unpatched devices' web browsing as an unauthenticated code-execution risk until patched.

CVE-2025-2747 is a critical (CVSS 9.8) authentication bypass (CWE-288) in Kentico Xperience CMS, caused by flawed password handling in the Staging Sync Server component for servers configured with the "None" authentication type, affecting versions through 13.0.178. An unauthenticated remote attacker who can reach the Staging Sync Server endpoint can bypass authentication and take control of administrative objects; public research (WatchTowr Labs) shows the flaw can be chained into a pre-authentication remote code execution chain. No privileges or user interaction are required, so any internet-reachable instance of the sync service is directly exposed. All Kentico Xperience deployments running version 13.0.178 or earlier that have the Staging Sync Server enabled are affected. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2025-10-20, indicating active in-the-wild exploitation, and EPSS assigns a 92.5% probability of exploitation within 30 days (100th percentile).

Do: Upgrade Kentico Xperience to a release newer than 13.0.178 (apply the latest vendor-patched 13.0 refresh) and verify in the staging configuration that no server entries are defined with the "None" authentication type, which triggers the bypass. If patching is delayed, restrict network access to the Staging Sync Server endpoint (e.g., firewall it to trusted staging peers only) and review access logs for unauthenticated requests to the sync service. Federal agencies must apply vendor mitigations or follow BOD 22-01 guidance per the KEV listing by the required due date.

CVE-2025-33073 is an improper access control flaw (CWE-284) in the Windows SMB client that allows an authorized, low-privileged attacker to elevate privileges over the network (CVSS 3.1: 8.8). The attack is network-based with low attack complexity and no user interaction: the attacker must get a vulnerable Windows machine's SMB client to connect to their crafted SMB server, and crafted server responses during the client's authentication flow cause the client to grant the attacker elevated (reportedly SYSTEM-level) access. An attacker gains local privilege elevation on the connecting Windows client, which can be used for full host compromise and lateral movement. Affected systems include essentially all currently supported Windows desktop and server branches in the data: Windows 10 (1507, 1607, 1809, 21H2, 22H2), Windows 11 (22H2, 23H2, 24H2), and Windows Server 2008, 2012, 2016 and 2019. The flaw is actively exploited in the wild — CISA added it to the KEV catalog on 2025-10-20 (ransomware linkage unknown), and EPSS places it at an 80.5% probability of exploitation within 30 days (100th percentile).

Do: Apply Microsoft's June 2025 (or later) cumulative security updates that address CVE-2025-33073 on all listed Windows 10, Windows 11, and Windows Server systems, prioritizing domain-critical, internet-reachable, and server assets given active exploitation. If immediate patching is not possible, restrict SMB client access to trusted servers and follow Microsoft guidance on hardening NTLM authentication; note that federal agencies must meet CISA KEV/BOD 22-01 remediation timelines following the 2025-10-20 KEV listing. Verify the update actually landed on each host (checking that CVE-2025-33073 is listed as addressed) and hunt for connections to untrusted SMB servers from Windows clients.

CVE-2025-61882 is a critical (CVSS 9.8) authentication flaw (CWE-287) in the BI Publisher Integration component of the Oracle Concurrent Processing product within Oracle E-Business Suite. An unauthenticated attacker with network access over HTTP can exploit it remotely with no credentials and no user interaction, achieving a takeover of Oracle Concurrent Processing with high confidentiality, integrity, and availability impact. Any organization running Oracle E-Business Suite 12.2.3 through 12.2.14 is affected, especially instances reachable from the internet. The flaw is being actively exploited in the wild: the Cl0p data-theft group has used it to breach dozens of organizations (including Harvard University, with 1.3 TB of data leaked), CISA added it to the Known Exploited Vulnerabilities catalog on 2025-10-06 with known ransomware use, and EPSS puts its 30-day exploitation probability at 99.7%.

Do: Apply Oracle's released patch or mitigations for CVE-2025-61882 to affected E-Business Suite 12.2.3-12.2.14 deployments as instructed by the vendor; per CISA KEV requirements, federal agencies must follow BOD 22-01 guidance or discontinue use if mitigations are unavailable. Until patched, limit internet exposure of EBS and its BI Publisher/Concurrent Processing HTTP endpoints, and review web and application logs for unauthenticated access and signs of Cl0p-style data theft or follow-on ransomware.

Oracle Configurator, a component of Oracle E-Business Suite, is affected by a server-side request forgery (SSRF) flaw in its Runtime UI component (CVE-2025-61884). The flaw is easily exploitable: an unauthenticated attacker with network access over HTTP can trigger the server to make attacker-controlled requests, compromising Oracle Configurator and gaining unauthorized access to critical data or complete access to all data accessible to Oracle Configurator. The CVSS 3.1 score is 7.5 (high) with confidentiality-only impact, meaning the flaw primarily exposes sensitive data rather than altering or destroying it. All supported Oracle E-Business Suite 12.2.x releases from 12.2.3 through 12.2.14 are affected, and Oracle has issued an emergency security update in response. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-10-20 with known ransomware use, and EPSS assigns a 97.8% probability of exploitation in the next 30 days (100th percentile).

Do: Apply the fixes from Oracle's emergency security update for CVE-2025-61884 across all E-Business Suite 12.2.3-12.2.14 environments, prioritizing internet-exposed instances; U.S. federal agencies must remediate per BOD 22-01 or follow applicable cloud-service guidance by the KEV due date. Until patched, restrict untrusted network access to the Configurator Runtime UI (HTTP) and monitor EBS logs and outbound server-side requests for signs of exploitation. Given the confirmed ransomware association, hunt for follow-on activity such as unusual data access or lateral movement originating from EBS servers.