Loading story…
Oracle released an emergency patch on October 11, 2025, to address a high-severity information disclosure vulnerability in Oracle E-Business Suite (EBS), identified as CVE-2025-61884. The vulnerability resides in the Runtime UI component of Oracle Configurator and allows remote, unauthenticated attackers to access sensitive resources within affected EBS installations. The flaw impacts Oracle EBS versions 12.2.3 through 12.2.14, and Oracle has provided a fixed version to mitigate the risk. Security researchers have noted that, as of the time of the patch release, there is no public proof-of-concept exploit available for CVE-2025-61884, and Oracle has not reported any evidence of exploitation in the wild. Despite this, the context of recent extortion emails sent to Oracle EBS customers by the Cl0p ransomware group has heightened concern about potential targeting of this vulnerability. Arctic Wolf recommends that all organizations using affected versions of Oracle EBS apply the emergency patch as soon as possible and follow their internal patching and testing protocols to minimize operational disruption. The vulnerability’s nature as an information disclosure issue means that sensitive business data could be exposed if left unpatched, increasing the risk of data theft or further compromise. Oracle has not confirmed any direct link between CVE-2025-61884 and the Cl0p ransomware activity, but the timing of the patch and the extortion attempts has led to increased vigilance among security teams. The advisory stresses the importance of prompt remediation, given the historical interest of threat actors in Oracle EBS vulnerabilities. Organizations are urged to consult Oracle’s official advisory for detailed patching instructions and to review their exposure to the affected EBS versions. The emergency nature of the patch underscores the seriousness with which Oracle and the security community are treating this vulnerability. Security bulletins from multiple sources reiterate the need for immediate action to prevent potential exploitation. The lack of a public exploit does not preclude the possibility of targeted attacks, especially given the sophistication of groups like Cl0p. The incident highlights the ongoing risks associated with complex enterprise software suites and the need for rapid response to critical vulnerabilities. Security teams should monitor for any signs of attempted exploitation and ensure that all relevant systems are updated. The release of this patch is part of Oracle’s broader efforts to address emerging threats and protect its customers from evolving cyber risks. Organizations that delay patching may face increased scrutiny from regulators and partners, especially if a breach occurs as a result of this vulnerability. The situation remains dynamic, and further updates may be issued if exploitation is detected or additional technical details emerge.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Oracle issued an emergency security update to address CVE-2025-61884, an information disclosure vulnerability affecting Oracle E-Business Suite. Multiple references describe the update as urgent or emergency guidance for customers to remediate the flaw.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcesocradar.io
Open sourcearcticwolf.com
Open sourcearcticwolf.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Oracle E-Business Suite (EBS) has been the target of a sophisticated cyberattack campaign exploiting multiple zero-day vulnerabilities, resulting in significant data breaches and prompting an urgent security response. According to reports, dozens of organizations have been impacted by the exploitation of a critical flaw in Oracle EBS, tracked as CVE-2025-61882, which has been actively used by threat actors since at least August 2025. The attackers leveraged a chain of vulnerabilities, including CVE-2025-61882 and a newly disclosed CVE-2025-61884, to gain unauthorized access to sensitive data and deploy various malware payloads such as GOLDVEIN.JAVA, SAGEGIFT, SAGELEAF, and SAGEWAVE. The Clop ransomware group has been linked to these attacks, using the vulnerabilities to breach networks, exfiltrate data, and extort victims. Oracle responded by releasing an emergency patch for CVE-2025-61884, which affects EBS versions 12.2.3 to 12.2.14, warning that the flaw could be exploited remotely by unauthenticated attackers to steal sensitive information. Security researchers from CrowdStrike observed that Clop had been exploiting CVE-2025-61882 as a zero-day since early August, and other threat groups may have joined the campaign. The vulnerabilities allow attackers to achieve remote code execution and information disclosure, posing a severe risk to organizations running affected EBS versions. Oracle strongly advised customers to apply the emergency updates or mitigations immediately to prevent further exploitation. The attacks have resulted in the exfiltration of large volumes of sensitive data, including financial documents, employee IDs, contracts, and internal reports, with some organizations facing significant operational disruptions and potential financial losses. The campaign demonstrates the increasing sophistication of ransomware and extortion groups, who are now chaining multiple vulnerabilities and targeting widely used enterprise platforms. Security experts have emphasized the importance of timely patching, robust monitoring, and incident response planning to mitigate the risks associated with zero-day exploitation. The incident also highlights the need for organizations to review their exposure to third-party software vulnerabilities and strengthen their supply chain security posture. Oracle's rapid release of emergency patches underscores the critical nature of the threat and the ongoing arms race between software vendors and cybercriminals. The exploitation of Oracle EBS zero-days is part of a broader trend of attackers targeting business-critical applications to maximize impact and leverage for extortion. Organizations are urged to remain vigilant, monitor for signs of compromise, and ensure that all security updates are applied without delay. The incident serves as a stark reminder of the persistent threat posed by advanced cybercriminal groups and the necessity of proactive cybersecurity measures in the face of evolving attack techniques.
Jun 29, 2026
Oracle E-Business Suite (EBS) was found to contain a critical remote code execution (RCE) vulnerability, tracked as CVE-2025-61882, which has been actively exploited in the wild. The flaw resides in the Oracle Concurrent Processing component, specifically within the BI Publisher Integration, and carries a CVSS base score of 9.8 due to its unauthenticated and easily exploitable nature. Attackers can leverage this vulnerability to execute arbitrary code remotely without requiring valid credentials, posing a severe risk to organizations running affected EBS versions. Oracle confirmed that versions 12.2.3 through 12.2.14 are impacted by this vulnerability. The company released an emergency security update to address the issue, but customers must first apply the October 2023 Critical Patch Update before deploying the new fix. The vulnerability was exploited by the Clop ransomware group in a series of data theft attacks in August 2025, resulting in significant data exfiltration from multiple victims. Mandiant's CTO, Charles Carmakal, confirmed that Clop leveraged both this zero-day and other previously patched vulnerabilities in their campaign. Oracle's advisory included indicators of compromise that matched exploit details shared by threat actors on Telegram, highlighting the public availability of exploit information. The exploitation of this flaw underscores the importance of timely patch management, especially for business-critical applications like Oracle EBS. Oracle has urged all customers to prioritize the application of the latest patches to mitigate the risk of further exploitation. The incident demonstrates the increasing trend of ransomware groups targeting enterprise software vulnerabilities for large-scale data theft. Security researchers have emphasized the need for organizations to monitor for signs of compromise and to review their EBS deployments for unauthorized activity. The rapid release of a security alert and patch by Oracle reflects the urgency and severity of the threat posed by CVE-2025-61882. Organizations are advised to follow Oracle's remediation guidance closely and to remain vigilant for related threat activity. The incident has raised concerns about the security posture of widely used ERP platforms and the potential for future exploitation of similar vulnerabilities. The Clop attacks serve as a reminder that threat actors are adept at chaining multiple vulnerabilities to maximize impact. This event highlights the criticality of maintaining up-to-date security controls and monitoring for exploitation attempts targeting high-value enterprise systems.
Jun 29, 2026
Oracle has issued a security alert regarding a newly discovered high-severity vulnerability in its E-Business Suite (EBS), tracked as CVE-2025-61884, which allows remote, unauthenticated attackers to gain access to sensitive resources. The flaw affects Oracle Configurator, a component used for automating product and service configuration, and impacts versions 12.2.3 through 12.2.14 of EBS. According to Oracle’s chief security officer, the vulnerability is easily exploitable via HTTP and could result in unauthorized access to critical or all data accessible through Oracle Configurator. The National Institute of Standards and Technology (NIST) has classified this as a high-risk issue, emphasizing the potential for attackers to compromise entire EBS environments without credentials. This vulnerability follows closely on the heels of another zero-day (CVE-2025-61882) disclosed by Oracle the previous week, indicating a concerning trend of critical flaws in the EBS platform. Security researchers have noted that the Cl0p ransomware group previously exploited EBS vulnerabilities to gain unauthorized access to corporate accounts, raising the risk that this new flaw could be weaponized by similar threat actors. Concurrently, dark web monitoring teams have observed the sale of an alleged 0-day exploit for Oracle E-Business Suite on underground forums, suggesting that cybercriminals are actively seeking to monetize this vulnerability. The dark web activity includes discussions and advertisements for the Oracle EBS 0-day, alongside other high-profile data leaks and exploit sales, highlighting the immediate interest from the cybercriminal community. Organizations using affected versions of Oracle EBS are urged to apply patches or mitigations as soon as they become available and to monitor for signs of exploitation. The exposure of such a critical business application to unauthenticated remote attacks significantly increases the risk of data breaches, ransomware, and business disruption. Security teams should prioritize reviewing access logs, implementing network segmentation, and restricting external access to Oracle EBS interfaces. The rapid appearance of exploit sales on the dark web underscores the urgency of the threat and the likelihood of imminent exploitation in the wild. Oracle customers are advised to stay informed through official security advisories and to coordinate with their IT and security vendors for timely remediation. The incident demonstrates the ongoing targeting of enterprise software by both sophisticated ransomware groups and opportunistic cybercriminals. Proactive defense and rapid response are essential to mitigate the risks posed by this and similar vulnerabilities in widely deployed business platforms.
Jun 29, 2026