Loading story…
A critical vulnerability in Oracle E-Business Suite, identified as CVE-2025-61882, has been recently exploited, underscoring the significant risks posed to organizations relying on enterprise resource planning (ERP) systems. These platforms, such as Oracle and SAP, are deeply integrated into core business operations, including financials, human resources, and supply chain management, making them high-value targets for attackers. The incident has brought renewed attention to the need for cybersecurity professionals with expertise in enterprise architecture, secure configuration, and vulnerability management, as a single flaw in these complex, multi-tiered systems can have far-reaching consequences.
The exposure of CVE-2025-61882 demonstrates that ERP systems are not only critical to business continuity but also represent a substantial attack surface due to their distributed nature and the sensitive data they process. Industry experts emphasize the urgency for organizations to prioritize the security of ERP environments, implement robust configuration controls, and ensure that vulnerability remediation processes are closely aligned with operational realities. The event serves as a reminder that the security of foundational business systems must be a top priority for CISOs and IT leaders.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
A critical zero-day vulnerability in Oracle E-Business Suite's BI Publisher Integration was exploited, allowing unauthenticated remote code execution through a crafted HTTP request. The flaw enabled high-privilege access and could allow attackers to pivot into the database tier and exfiltrate or modify business-critical data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Oracle has disclosed a critical security vulnerability, CVE-2025-61884, affecting the Oracle Configurator component within Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.14. This vulnerability resides in the Runtime user interface of Oracle Configurator and allows unauthenticated attackers with network access via HTTP to remotely exploit the system. Successful exploitation can result in unauthorized access to sensitive configuration data or potentially complete access to all data accessible through Oracle Configurator. The flaw is classified as easily exploitable, requiring no user interaction or authentication, which significantly increases the risk profile for organizations relying on Oracle EBS for critical business operations. The National Vulnerability Database has assigned a CVSS 3.1 base score of 7.5 to CVE-2025-61884, indicating its high severity and the potential for significant impact on enterprise confidentiality and integrity. Oracle Security’s CIS Rob Duhart has emphasized that the vulnerability may allow access to sensitive resources and could affect a wide range of EBS deployments. While Oracle has not confirmed whether this vulnerability is currently being exploited in the wild, there is heightened concern due to recent incidents involving similar vulnerabilities, such as CVE-2025-61882, which was exploited to steal data from Oracle EBS customers. Security researchers warn that the public availability of exploit scripts for related vulnerabilities increases the likelihood of imminent attacks targeting CVE-2025-61884. Oracle has issued patches and strongly recommends that all affected customers apply the updates or mitigations immediately to protect their systems. There are also reports that earlier versions, such as 12.1.3, may be vulnerable, and Oracle may update its patch documentation as more information becomes available. The vulnerability’s ability to bypass authentication controls and grant attackers access to critical business configuration data poses a direct threat to organizations’ operational security. Oracle EBS is integral to business workflows in sectors such as manufacturing, finance, and supply chain management, making the potential impact of this vulnerability especially severe. Organizations are advised to review Oracle’s security advisories, apply the recommended patches without delay, and monitor for further updates as the situation evolves. The exposure of sensitive configuration data could lead to broader compromises, including data theft, business disruption, and regulatory consequences. Security teams should also assess their current EBS deployments for signs of compromise and ensure that all network access to Oracle Configurator is tightly controlled. The urgency of this vulnerability is underscored by the potential for attackers to exploit it with minimal effort, making rapid remediation essential for all Oracle EBS customers.
Jun 29, 2026
Oracle E-Business Suite (EBS) has been the target of a sophisticated cyberattack campaign exploiting multiple zero-day vulnerabilities, resulting in significant data breaches and prompting an urgent security response. According to reports, dozens of organizations have been impacted by the exploitation of a critical flaw in Oracle EBS, tracked as CVE-2025-61882, which has been actively used by threat actors since at least August 2025. The attackers leveraged a chain of vulnerabilities, including CVE-2025-61882 and a newly disclosed CVE-2025-61884, to gain unauthorized access to sensitive data and deploy various malware payloads such as GOLDVEIN.JAVA, SAGEGIFT, SAGELEAF, and SAGEWAVE. The Clop ransomware group has been linked to these attacks, using the vulnerabilities to breach networks, exfiltrate data, and extort victims. Oracle responded by releasing an emergency patch for CVE-2025-61884, which affects EBS versions 12.2.3 to 12.2.14, warning that the flaw could be exploited remotely by unauthenticated attackers to steal sensitive information. Security researchers from CrowdStrike observed that Clop had been exploiting CVE-2025-61882 as a zero-day since early August, and other threat groups may have joined the campaign. The vulnerabilities allow attackers to achieve remote code execution and information disclosure, posing a severe risk to organizations running affected EBS versions. Oracle strongly advised customers to apply the emergency updates or mitigations immediately to prevent further exploitation. The attacks have resulted in the exfiltration of large volumes of sensitive data, including financial documents, employee IDs, contracts, and internal reports, with some organizations facing significant operational disruptions and potential financial losses. The campaign demonstrates the increasing sophistication of ransomware and extortion groups, who are now chaining multiple vulnerabilities and targeting widely used enterprise platforms. Security experts have emphasized the importance of timely patching, robust monitoring, and incident response planning to mitigate the risks associated with zero-day exploitation. The incident also highlights the need for organizations to review their exposure to third-party software vulnerabilities and strengthen their supply chain security posture. Oracle's rapid release of emergency patches underscores the critical nature of the threat and the ongoing arms race between software vendors and cybercriminals. The exploitation of Oracle EBS zero-days is part of a broader trend of attackers targeting business-critical applications to maximize impact and leverage for extortion. Organizations are urged to remain vigilant, monitor for signs of compromise, and ensure that all security updates are applied without delay. The incident serves as a stark reminder of the persistent threat posed by advanced cybercriminal groups and the necessity of proactive cybersecurity measures in the face of evolving attack techniques.
Jun 29, 2026
Oracle released an emergency patch on October 11, 2025, to address a high-severity information disclosure vulnerability in Oracle E-Business Suite (EBS), identified as CVE-2025-61884. The vulnerability resides in the Runtime UI component of Oracle Configurator and allows remote, unauthenticated attackers to access sensitive resources within affected EBS installations. The flaw impacts Oracle EBS versions 12.2.3 through 12.2.14, and Oracle has provided a fixed version to mitigate the risk. Security researchers have noted that, as of the time of the patch release, there is no public proof-of-concept exploit available for CVE-2025-61884, and Oracle has not reported any evidence of exploitation in the wild. Despite this, the context of recent extortion emails sent to Oracle EBS customers by the Cl0p ransomware group has heightened concern about potential targeting of this vulnerability. Arctic Wolf recommends that all organizations using affected versions of Oracle EBS apply the emergency patch as soon as possible and follow their internal patching and testing protocols to minimize operational disruption. The vulnerability’s nature as an information disclosure issue means that sensitive business data could be exposed if left unpatched, increasing the risk of data theft or further compromise. Oracle has not confirmed any direct link between CVE-2025-61884 and the Cl0p ransomware activity, but the timing of the patch and the extortion attempts has led to increased vigilance among security teams. The advisory stresses the importance of prompt remediation, given the historical interest of threat actors in Oracle EBS vulnerabilities. Organizations are urged to consult Oracle’s official advisory for detailed patching instructions and to review their exposure to the affected EBS versions. The emergency nature of the patch underscores the seriousness with which Oracle and the security community are treating this vulnerability. Security bulletins from multiple sources reiterate the need for immediate action to prevent potential exploitation. The lack of a public exploit does not preclude the possibility of targeted attacks, especially given the sophistication of groups like Cl0p. The incident highlights the ongoing risks associated with complex enterprise software suites and the need for rapid response to critical vulnerabilities. Security teams should monitor for any signs of attempted exploitation and ensure that all relevant systems are updated. The release of this patch is part of Oracle’s broader efforts to address emerging threats and protect its customers from evolving cyber risks. Organizations that delay patching may face increased scrutiny from regulators and partners, especially if a breach occurs as a result of this vulnerability. The situation remains dynamic, and further updates may be issued if exploitation is detected or additional technical details emerge.
Jun 29, 2026