CISA Adds Five Actively Exploited Vulnerabilities To KEV Catalog

CISA added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog affecting Oracle E-Business Suite (SSRF), Microsoft Windows SMB Client (improper access control leading to privilege escalation), two Kentico Xperience CMS authentication-bypass flaws, and an Apple JavaScriptCore arbitrary code execution issue. The advisory notes active exploitation or elevated risk, directs federal agencies to remediate by Nov 10, 2025, and provides mitigation and hardening recommendations (patching, restricting SMB, retiring EoL Apple devices, monitoring).