Week of October 6, 2025: CISA Flags Oracle EBS Flaw and Issues ICS Advisories

Security leaders tracked CISA's addition of the actively exploited Oracle E-Business Suite vulnerability CVE-2025-61882 to its Known Exploited Vulnerabilities catalog alongside a Grafana path traversal flaw and a Zimbra Collaboration Suite cross-site scripting bug, while six industrial control systems advisories covered Hitachi Energy, Rockwell Automation, Mitsubishi Electric, and Delta Electronics products. Executive moves also made headlines, with Exabeam promoting a new chief executive and new technology, revenue, and legal leadership appointments announced at Outpost24, Arkose Labs, and Sophos.

CISA Issues Four ICS Advisories Covering Hitachi Energy, Rockwell Automation, Mitsubishi Electric

CISA released four Industrial Control Systems advisories on October 9, 2025, covering Hitachi Energy Asset Suite, two Rockwell Automation products (Lifecycle Services with Cisco and Stratix), and an update to a Mitsubishi Electric multiple FA products advisory. The advisories detailed security issues and mitigations for the affected ICS products, giving critical infrastructure operators and their security teams fresh guidance on vulnerabilities spanning energy, manufacturing automation, and networking equipment used across industrial environments. CISA urged administrators to review the technical details and apply the recommended mitigations. (CISA)

CISA Adds Actively Exploited Grafana Path Traversal Flaw to KEV Catalog

CISA added CVE-2021-43798, a path traversal vulnerability in Grafana, to its Known Exploited Vulnerabilities Catalog on October 9, 2025, citing evidence of active exploitation. The addition triggers Binding Operational Directive 22-01 remediation timelines for federal civilian executive branch agencies, which must patch or mitigate the flaw by the specified due date. CISA also encouraged all organizations, not just federal agencies, to prioritize remediation of this vulnerability as part of routine vulnerability management practices to reduce exposure to known attack vectors. (CISA)

CISA Publishes Two ICS Advisories for Delta Electronics and Rockwell Automation

CISA released two Industrial Control Systems advisories on October 7, 2025, addressing the Delta Electronics DIAScreen software and an updated advisory for Rockwell Automation's 1756-EN4TR and 1756-EN4TRXT communication modules. The advisories outlined vulnerabilities affecting engineering and automation environments and provided mitigation guidance for asset owners operating these products. CISA encouraged users and administrators across critical infrastructure sectors to review the advisories for technical details and apply recommended protections promptly to reduce exposure in operational technology networks. (CISA)

Zimbra Collaboration Suite XSS Flaw Added to CISA's Exploited Vulnerabilities List

CISA added CVE-2025-27915, a cross-site scripting vulnerability in Synacor's Zimbra Collaboration Suite, to its Known Exploited Vulnerabilities Catalog on October 7, 2025, after confirming active exploitation. Under Binding Operational Directive 22-01, federal civilian executive branch agencies running the affected Zimbra software faced a mandated deadline to remediate the flaw. CISA again urged all organizations operating Zimbra deployments to treat the vulnerability as a priority in their patching cycles given its status as a frequent attack vector for malicious cyber actors. (CISA)

Security Leadership Shuffles: Exabeam Names New CEO, Sophos Adds Chief Legal Officer

SecurityWeek's October 6, 2025 Industry Moves roundup reported that Exabeam promoted Pete Harteveld from Chief Revenue Officer to Chief Executive Officer, succeeding Chris O'Malley after his retirement from the company. Elsewhere, Outpost24 named Martin Roth as Chief Technology Officer, Arkose Labs appointed Dave Woolwine as Chief Revenue Officer, and Sophos brought on Aparna Williams as Chief Legal Officer to oversee the company's legal, compliance, and regulatory operations. The moves spanned identity security, exposure management, and endpoint security vendors serving enterprise security teams. (SecurityWeek)