CISA Confirms Exploitation of Latest Oracle EBS Vulnerability

CISA has added CVE-2025-61884 to its Known Exploited Vulnerabilities (KEV) catalog, confirming that the Oracle E-Business Suite vulnerability has been exploited in the wild. Dozens of Oracle customers were targeted in a campaign that involved data theft from their EBS instances, with the extortion emails linked to the Cl0p group. The attackers are described as exploiting EBS vulnerabilities to access data, although Oracle and the security community have not specified exactly which flaws were used.

The campaign followed Oracle’s earlier statements that flaws patched in July were involved, and that a zero-day tracked as CVE-2025-61882 was also apparently exploited, while Oracle later announced fixes for CVE-2025-61884. According to SecurityWeek, authorities note that the PoC for CVE-2025-61884 was tied to a leak by Scattered Lapsus$ Hunter, though it remains unclear which vulnerabilities were exploited in-day versus zero-day.

Four alleged victims are listed on the Cl0p ransomware leak site—Harvard University, American Airlines’ Envoy Air, the University of the Witwatersrand, and Emerson—though Emerson has not yet confirmed impact. Federal agencies are required to apply mitigations by 10 November.