Five New Exploited Bugs Land in CISA's Catalog — Oracle and Microsoft Among Targets

Summary: CISA added five security flaws to its Known Exploited Vulnerabilities Catalog on Monday, including CVE-2025-61884 (CVSS 7.5), a server-side request forgery bug in Oracle Configurator's Runtime component that CISA says is remotely exploitable without authentication. It is the second actively exploited Oracle E-Business Suite flaw alongside CVE-2025-61882 (CVSS 9.8), which permits unauthenticated arbitrary code execution and which Google Threat Intelligence Group and Mandiant said may have affected dozens of organizations.
What you should know: Google's Zander Work said some of the observed exploitation was likely conducted by actors now running Cl0p-branded extortion operations, and federal civilian agencies have until November 10, 2025 to remediate - a deadline private-sector operators of the same Oracle EBS software do not get.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-2746 CVE-2025-2747 CVE-2025-33073 CVE-2025-61882 CVE-2025-61884
Related: ⚡ Weekly Recap: WhatsApp Worm, Critical CVEs, Oracle 0-Day, Ransomware Cartel & More Cyber Risks ·
New Oracle E-Business Suite Bug Could Let Hackers Access Data Without Login Cyber Risks ·
CVE-2025-61884: Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability Known Exploited Vulnerabilities · Oct 20, 2025