Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Browse News Feed Stats Watchlists Beta About Contact

CISA adds five KEV flaws and sets FCEB remediation deadline

Public Sector Action
First reported
Last updated
Happening score
H score 53
2 unique sources, 2 articles

Summary

Hide ▲

CISA added CVE-2025-61884 in Oracle E-Business Suite to its Known Exploited Vulnerabilities (KEV) Catalog after confirming it is being actively exploited. The flaw is an unauthenticated SSRF in the Oracle Configurator runtime and is tied to July attacks and a leaked exploit associated with ShinyHunters and the Scattered Lapsus$ extortion group. Federal agencies must patch the issue by November 10, 2025. The same reporting distinguishes this activity from the separate CVE-2025-61882 campaign against /OA_HTML/SyncServlet, which is attributed to Clop.

Related Happenings

Microsoft SharePoint remote code execution (CVE-2026-45659)

Vulnerability
First: 26.05.2026 14:49 Last: 26.05.2026 14:49 Sources 1

About this happening: **Microsoft SharePoint** **CVE-2026-45659** is a **remote code execution** vulnerability that lets an **authenticated attacker** with **Site Member** permissions run code over the...

Open Happening

CISA orders FCEB patching for CVE-2026-9082

Public Sector Action
First: 26.05.2026 11:46 Last: 26.05.2026 11:46 Sources 1

About this happening: **CISA** added **CVE-2026-9082** to the **KEV Catalog** and ordered **FCEB agencies** to patch **Drupal** by **May 27**, turning an actively exploited flaw into a mandatory federa...

Open Happening

Langflow and Trend Micro Apex One exploited flaws (multiple vulnerabilities)

Vulnerability
First: 22.05.2026 08:47 Last: 22.05.2026 08:47 Sources 1

About this happening: **CISA** added **CVE-2025-34291** in **Langflow** and **CVE-2026-34926** in **Trend Micro Apex One** to the **KEV catalog** after evidence of **active exploitation**. The Langflow...

Open Happening

Windows BitLocker YellowKey security feature bypass (CVE-2026-45585)

Vulnerability
First: 20.05.2026 11:28 Last: 20.05.2026 11:28 Sources 1

About this happening: **CVE-2026-45585** is a **BitLocker security feature bypass** affecting **Windows 11 26H1/24H2/25H2** and **Windows Server 2025**, and Microsoft has already issued **mitigations**...

Open Happening

CISA KEV action for CVE-2026-31431 and FCEB remediation

Public Sector Action
First: 03.05.2026 09:26 Last: 03.05.2026 09:26 Sources 1

About this happening: CISA added **CVE-2026-31431** to its **KEV catalog**, putting **Federal Civilian Executive Branch (FCEB)** agencies on notice to remediate an actively exploited Linux privilege-es...

Open Happening

Timeline

  1. 20.10.2025 22:00 3 articles · 7mo ago

    CISA adds Oracle EBS flaw and four other bugs to KEV Catalog

    Legal Policy Action Update

    CISA added CVE-2025-61884 in Oracle E-Business Suite (EBS) and four other security flaws to the Known Exploited Vulnerabilities (KEV) Catalog, confirming that the Oracle Configurator SSRF bug was weaponized in real-world attacks and directing Federal Civilian Executive Branch (FCEB) agencies to remediate the listed vulnerabilities by November 10, 2025.

    Show sources
    Open in new tab