VulnOps

CISA issued urgent directives today on two critical vulnerabilities requiring immediate patching: a critical Oracle flaw with a three-day remediation mandate and an active exploitation warning for Trimble Cityworks deserialization vulnerability (CVE-2025-0994) targeting critical infrastructure. Vulnops practitioners must treat both as priority incidents given CISA's enforcement authority and confirmed active exploitation.

• →CISA Three-Day Patch Mandate for Critical Oracle Flaw: Federal agencies face binding compliance deadlines under CISA directives, and vulnops teams must align patch schedules with government-mandated timelines or face regulatory consequences.
• →Active Exploitation of Trimble Cityworks Deserialization Vulnerability (CVE-2025-0994): Confirmed active exploitation in critical infrastructure software elevates this from theoretical risk to immediate threat, requiring vulnops teams to prioritize assessment and patching for any Cityworks deployments in their environment.
• →Dual-Vector Vulnerability Pressure on Compliance Calendars: Simultaneous critical advisories force vulnops practitioners to triage competing patching demands and may require escalation of change management timelines to meet regulatory expectations.

Immediately inventory Oracle and Trimble Cityworks instances, confirm patch availability, and initiate emergency change requests to meet CISA's three-day deadline and address active exploitation risks.