Sales

Serial number:AV25-640
Date:October 6, 2025
Updated:October 20, 2025

On October 4, 2025, Oracle published an out-of-band security advisory to address a critical vulnerability in the following product:

• Oracle E-Business Suite – versions 12.2.3 to 12.2.14

The Oracle advisory includes indicators of compromise (IOCs) to aid in the detection of malicious activity.

Update 1

On October 11, 2025, Oracle published an out-of-band security advisory to address a critical vulnerability CVE-2025-61884.

As well, on October 20, 2025, CISA released a statement indicating that CVE-2025-61884 is being actively exploited in the wild and added it to their Known Exploited Vulnerabilities (KEV) Catalog.

The Cyber Centre encourages users and administrators to review the provided web links and perform the suggested mitigations.

• Oracle Security Alert Advisory - CVE-2025-61882
• Oracle Security Alert Advisory - CVE-2025-61884
• CVE-2025-61882
• CVE-2025-61884
• CISA Adds One Known Exploited Vulnerability to Catalog

Serial number:AV25-685
Date:October 20, 2025

On October 16, 2025, ConnectWise published a security advisory to address vulnerabilities in the following product:

• ConnectWise Automate – versions prior to 2025.9

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• ConnectWise Automate 2025.9 Security Fix
• ConnectWise - Latest Advisories

Serial number:AV25-684
Date:October 20, 2025

Between October 13 and 19, 2025, Red Hat published security advisories to address vulnerabilities in multiple products. Included were updates to address vulnerabilities in the Linux kernel for the following products:

• Red Hat CodeReady Linux Builder – multiple versions and platforms
• Red Hat Enterprise Linux – multiple versions and platforms
• Red Hat Enterprise Linux Server – multiple versions and platforms
• Red Hat Enterprise Linux for Real Time – multiple versions and platforms

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary updates.

• Red Hat Security Advisories

Serial number:AV25-485
Date:August 6, 2025
Updated:October 20, 2025

On August 5, 2025, Adobe published a security advisory to address critical vulnerabilities in the following product:

• Adobe Experience Manager (AEM) Forms on JEE – version 6.5.23.0 and prior

Adobe is aware that an exploit for CVE-2025-54253 and CVE-2025-54254 exists in the wild.

Update 1

On October 15, 2025, CISA released a statement indicating that CVE-2025-54253 is being actively exploited in the wild and added it to their Known Exploited Vulnerabilities (KEV) Catalog.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• CISA Adds One Known Exploited Vulnerability to Catalog
• Security updates available for Adobe Experience Manager Forms | APSB25-82
• Adobe Security Advisories

Serial number:AV25-683
Date:October 20, 2025

On October 17, 2025, Microsoft published a security update to address vulnerabilities in the following product:

• Microsoft Edge Stable Channel – versions prior to 141.0.3537.85

The Cyber Centre encourages users and administrators to review the provided web link and apply the necessary update.

• Microsoft Edge Stable Channel Release Notes

Serial number:AV25–682
Date:October 20, 2025

Between October 13 and 19, 2025, CISA published ICS advisories to address vulnerabilities in the following products:

• Delta Electronics CNCSoft-G2 – multiple versions
• Hitachi Energy MACH GWS – versions 3.0.0.0 to 3.4.0.0
• Rockwell Automation 1715 EtherNet/IP – version 3.003 and prior
• Rockwell Automation ArmorStart AOP – version V2.05.07 and prior
• Rockwell Automation FactoryTalk Linx – version 6.40 and prior
• Rockwell Automation FactoryTalk View Machine Edition – versions prior to V15.00 (CVE-2025-9064)
• Rockwell Automation PanelView Plus 7 Terminal – version 14 and prior
• Rockwell Automation PanelView Plus 7 – versions V14.100 (CVE-2025-9063)
• Schneider Electric Advanced Reporting and Dashboards Module optional component of EcoStruxure Power Operation (EPO) installed with EcoStruxure Power Monitoring Expert (PME) – multiple versions and platforms
• Schneider Electric EcoStruxure Power Monitoring Expert (PME): version 2022, 2023, 2024 and 2024 R2
• Siemens HyperLynx – all versions
• Siemens Industrial Edge App Publisher – versions prior to 1.23.5
• Siemens SIMATIC ET 200SP Communication Processors – multiple versions and models
• Siemens SINEC NMS – versions prior to V4.0 SP1
• Siemens SiPass Integrated – versions prior to V3.0
• Siemens Solid Edge SE2024 – versions prior to V224.0 Update 14
• Siemens Solid Edge SE2025 – versions prior to V225.0 Update 6
• Siemens TeleControl Server Basic V3.1 – version V3.1.2.2 and up to but not including V3.1.2.3

The Cyber Centre encourages users and administrators to review the provided web link, perform the suggested mitigations and apply the necessary updates if available.

• CISA ICS Advisories