U.S. CISA adds Oracle, Mozilla, Microsoft Windows, Linux Kernel, and Microsoft IE flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Oracle, Mozilla, Linux Kernel, Microsoft Windows, and Microsoft IE flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Oracle, Linux Kernel, Mozilla, Microsoft Windows, and Microsoft IE flaws to its Known Exploited Vulnerabilities (KEV) catalog.

Below are the descriptions for these flaws:

• CVE-2010-3765 Mozilla Multiple Products Remote Code Execution Vulnerability
• CVE-2010-3962 Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability
• CVE-2011-3402 Microsoft Windows Remote Code Execution Vulnerability
• CVE-2013-3918 Microsoft Windows Out-of-Bounds Write Vulnerability
• CVE-2021-22555 Linux Kernel Heap Out-of-Bounds Write Vulnerability
• CVE-2021-43226 Microsoft Windows Privilege Escalation Vulnerability
• CVE-2025-61882 Oracle E-Business Suite Unspecified Vulnerability 

This week, Oracle released an emergency patch to address the critical vulnerability CVE-2025-61882 (CVSS 9.8) in its E-Business Suite. The flaw was exploited by the Cl0p ransomware group in data theft attacks. Unauthenticated remote attackers can exploit the flaw to take control of the Oracle Concurrent Processing component. CVE-2025-61882 affects Oracle E-Business Suite 12.2.3–12.2.14 (BI Publisher Integration), experts warn it is easily exploitable via HTTP.

Some of the flaws added to the CISA’s KeV catalog are very only, such as the flaw CVE-2013-3918.

The vulnerability CVE-2013-3918 was originally used by the APT group behind the 2009 Aurora attack, but. in 2015 Kaspersky revealed that the nation-state actor EQUATION group captured their exploit and repurposed it to target government users in Afghanistan.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerabilities by October 27, 2025.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)