Loading story…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, including critical flaws in Oracle E-Business Suite (EBS) and Microsoft Windows SMB Client. Among these, CVE-2025-61884 and CVE-2025-61882 in Oracle EBS have been actively exploited in the wild, with attackers leveraging these vulnerabilities to gain unauthorized access and execute arbitrary code on affected systems. The exploitation of these flaws has led to significant breaches, including confirmed incidents at Harvard University and Envoy Air, the latter being tied to the Clop ransomware gang. Security researchers have highlighted that the Oracle EBS vulnerabilities are remotely exploitable without authentication, making them particularly dangerous for organizations with exposed instances. The vulnerabilities have enabled attackers to obtain interactive access to critical business applications, exfiltrate sensitive data, and potentially deploy ransomware. The attacks have been facilitated by public proof-of-concept exploits that were available before Oracle released emergency patches, leaving a window of opportunity for threat actors. The widespread use of Oracle EBS across sectors such as finance, healthcare, education, and government has amplified the impact, with many organizations potentially unaware of compromises that occurred during the zero-day period. CISA’s inclusion of these vulnerabilities in the KEV Catalog mandates that Federal Civilian Executive Branch (FCEB) agencies remediate the flaws by a specified deadline, but the agency strongly urges all organizations to prioritize patching. The incidents have also exposed issues with vendor guidance, as conflicting deployment recommendations from Oracle left some enterprises unnecessarily exposed to attack. The Microsoft Windows SMB Client vulnerability (CVE-2025-33073), also added to the KEV Catalog, allows privilege escalation and is being actively exploited, affecting all supported Windows versions. The addition of these vulnerabilities to the KEV Catalog underscores the ongoing risk posed by unpatched systems and the need for robust vulnerability management practices. Security experts warn that the scalable nature of these attacks, particularly those targeting shared enterprise platforms, highlights the growing threat of supply chain compromises. The events have prompted calls for improved security hygiene, including restricting internet exposure of critical applications and ensuring timely application of security patches. The breaches and subsequent disclosures serve as a stark reminder of the evolving tactics of ransomware groups and the persistent threat posed by zero-day vulnerabilities in widely used enterprise software.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
By Oct. 24, security researchers had published deeper technical analysis of CVE-2025-61882, including exploit chains involving SyncServlet and UiServlet abuse, post-compromise web shell deployment, and extortion-driven data theft. Some activity was attributed to the financially motivated group GRACEFUL SPIDER, while other reporting linked the campaign to Clop-associated operations.
CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog on Oct. 20, including the Oracle E-Business Suite flaw and a high-severity Windows SMB vulnerability. The action reflected confirmed in-the-wild exploitation and triggered federal remediation requirements under BOD 22-01.
Envoy Air confirmed on Oct. 17 that it was compromised in the Oracle E-Business Suite zero-day attacks. Researchers linked the activity to the Clop ransomware ecosystem, making Envoy Air the second publicly disclosed victim in the campaign.
Harvard University publicly disclosed on Oct. 13 that it had been affected in the Oracle E-Business Suite zero-day incident. This was the first public victim disclosure tied to the broader campaign.
Oracle issued an emergency fix for the Oracle E-Business Suite vulnerability later tracked as CVE-2025-61882. Reporting indicates public proof-of-concept exploit code appeared shortly before Oracle's patch release.
Researchers reported suspicious activity and likely exploitation of Oracle E-Business Suite CVE-2025-61882 before Oracle publicly disclosed the issue. The flaw was described as a low-complexity, unauthenticated remote code execution bug that may have been exploitable for nearly three months before a patch became available.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
centripetal.ai
Open sourcethecyberthrone.in
Open sourcehackread.com
Open sourcethehackernews.com
Open sourcecisa.gov
Open sourcedarkreading.com
Open sourcebleepingcomputer.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog by adding seven high-impact vulnerabilities that are currently being exploited in the wild. This update includes critical flaws affecting Oracle E-Business Suite, Mozilla Firefox, Thunderbird, SeaMonkey, Microsoft Windows, Microsoft Internet Explorer, the Linux Kernel, and Microsoft Windows privilege escalation mechanisms. Among the most severe is CVE-2025-61882, a remotely exploitable vulnerability in Oracle E-Business Suite’s BI Publisher Integration, which allows unauthenticated attackers to compromise the Oracle Concurrent Processing component via HTTP. This flaw, rated CVSS 9.8, has been actively exploited in ransomware campaigns, notably by the Cl0p ransomware group, leading to data theft and potential remote code execution. Oracle responded by releasing an emergency patch for affected versions 12.2.3 through 12.2.14, and organizations are urged to apply this fix immediately and monitor for suspicious HTTP traffic targeting BI Publisher endpoints. Another addition, CVE-2010-3765, is a memory corruption vulnerability in Mozilla products, including Firefox, Thunderbird, and SeaMonkey, which can be exploited via JavaScript to execute arbitrary code. This flaw has been leveraged by the "Belmoo" malware in real-world attacks. Microsoft vulnerabilities added to the catalog include CVE-2011-3402, a TrueType font parsing flaw in the Windows kernel (win32k.sys) that enables remote code execution through malicious font files, and CVE-2010-3962, an uninitialized memory corruption issue in Internet Explorer. CVE-2013-3918, another Microsoft Windows vulnerability, was originally used in the 2009 Aurora attack and later repurposed by the EQUATION group to target government users in Afghanistan. The Linux Kernel vulnerability CVE-2021-22555, a heap out-of-bounds write, and CVE-2021-43226, a Windows privilege escalation flaw, are also included due to their active exploitation and potential for significant impact. CISA’s KEV catalog serves as a critical resource for organizations, highlighting vulnerabilities that require urgent attention due to their exploitation in real-world attacks. Federal agencies are mandated to address these vulnerabilities within a defined timeframe under Binding Operational Directive (BOD) 22-01. The inclusion of both recent and older vulnerabilities underscores the persistent risk posed by unpatched systems, as threat actors continue to exploit legacy flaws alongside newly discovered ones. Security experts emphasize the importance of immediate patching, robust monitoring, and comprehensive vulnerability management to mitigate the risks associated with these actively exploited vulnerabilities. The update reflects ongoing efforts by CISA to enhance the security posture of federal and enterprise environments by ensuring that known exploited vulnerabilities are promptly addressed. Organizations are advised to review the KEV catalog regularly, prioritize remediation of listed vulnerabilities, and implement additional security controls where patching is not immediately feasible. The addition of these vulnerabilities highlights the evolving threat landscape and the need for continuous vigilance against both new and longstanding security weaknesses. CISA’s proactive approach aims to reduce the attack surface and limit the opportunities for threat actors to compromise critical infrastructure. The agency’s guidance is particularly relevant for entities operating Oracle E-Business Suite, Microsoft products, and Linux systems, given the active exploitation of these platforms. The KEV catalog update serves as a call to action for all organizations to assess their exposure and take decisive steps to protect their assets from ongoing cyber threats.
Jun 29, 2026
A significant cybersecurity incident has emerged involving the mass exploitation of a previously unknown zero-day vulnerability in Oracle E-Business Suite (EBS). CrowdStrike has identified an active campaign in which threat actors are leveraging this zero-day, now tracked as CVE-2025-61882, to compromise organizations using Oracle EBS. The attackers have targeted a range of organizations, including major enterprises and at least one prominent airline, Envoy Air, which suffered a breach as part of this wave of extortion attempts. The exploitation campaign has raised concerns due to the critical nature of Oracle EBS in managing sensitive business operations, including financials, supply chain, and human resources. Security researchers have highlighted that the attackers are using sophisticated techniques to gain initial access and then move laterally within affected networks. The campaign has prompted urgent advisories from security vendors and researchers, urging organizations to apply patches and review their Oracle EBS deployments for signs of compromise. The incident has also drawn attention to the broader risks posed by supply chain and third-party software vulnerabilities, as attackers increasingly target widely used enterprise platforms. In addition to direct exploitation, there are indications that the attackers may be using stolen credentials and exploiting weak configurations to escalate privileges. The breach at Envoy Air underscores the real-world impact of the campaign, with potential exposure of sensitive data and operational disruption. Security experts have warned that the campaign may not be limited to a single threat actor, as multiple groups could be leveraging the same vulnerability for different objectives, including extortion and data theft. The incident has also reignited debate over the speed and transparency of vulnerability disclosure and patching processes for critical enterprise software. Organizations are being advised to monitor for indicators of compromise, enhance logging and detection around Oracle EBS systems, and coordinate with vendors for timely updates. The campaign is ongoing, and further victims may emerge as investigations continue. This event highlights the persistent threat posed by zero-day vulnerabilities in widely deployed business applications and the need for robust patch management and incident response capabilities.
Jun 29, 2026
Oracle E-Business Suite (EBS) has been the target of a sophisticated cyberattack campaign exploiting multiple zero-day vulnerabilities, resulting in significant data breaches and prompting an urgent security response. According to reports, dozens of organizations have been impacted by the exploitation of a critical flaw in Oracle EBS, tracked as CVE-2025-61882, which has been actively used by threat actors since at least August 2025. The attackers leveraged a chain of vulnerabilities, including CVE-2025-61882 and a newly disclosed CVE-2025-61884, to gain unauthorized access to sensitive data and deploy various malware payloads such as GOLDVEIN.JAVA, SAGEGIFT, SAGELEAF, and SAGEWAVE. The Clop ransomware group has been linked to these attacks, using the vulnerabilities to breach networks, exfiltrate data, and extort victims. Oracle responded by releasing an emergency patch for CVE-2025-61884, which affects EBS versions 12.2.3 to 12.2.14, warning that the flaw could be exploited remotely by unauthenticated attackers to steal sensitive information. Security researchers from CrowdStrike observed that Clop had been exploiting CVE-2025-61882 as a zero-day since early August, and other threat groups may have joined the campaign. The vulnerabilities allow attackers to achieve remote code execution and information disclosure, posing a severe risk to organizations running affected EBS versions. Oracle strongly advised customers to apply the emergency updates or mitigations immediately to prevent further exploitation. The attacks have resulted in the exfiltration of large volumes of sensitive data, including financial documents, employee IDs, contracts, and internal reports, with some organizations facing significant operational disruptions and potential financial losses. The campaign demonstrates the increasing sophistication of ransomware and extortion groups, who are now chaining multiple vulnerabilities and targeting widely used enterprise platforms. Security experts have emphasized the importance of timely patching, robust monitoring, and incident response planning to mitigate the risks associated with zero-day exploitation. The incident also highlights the need for organizations to review their exposure to third-party software vulnerabilities and strengthen their supply chain security posture. Oracle's rapid release of emergency patches underscores the critical nature of the threat and the ongoing arms race between software vendors and cybercriminals. The exploitation of Oracle EBS zero-days is part of a broader trend of attackers targeting business-critical applications to maximize impact and leverage for extortion. Organizations are urged to remain vigilant, monitor for signs of compromise, and ensure that all security updates are applied without delay. The incident serves as a stark reminder of the persistent threat posed by advanced cybercriminal groups and the necessity of proactive cybersecurity measures in the face of evolving attack techniques.
Jun 29, 2026