Oracle Says Known Vulnerabilities Possibly Exploited in Recent Extortion Attacks

Oracle has confirmed that some customers have received extortion emails and that its investigation suggests attackers may have exploited vulnerabilities that were addressed in the July 2025 Critical Patch Update.

The company fixed about 200 vulnerabilities with that CPU, with nine patches applied to E-Business Suite, including three flaws that can be exploited remotely without authentication, tracked as CVE-2025-30746, CVE-2025-30745 and CVE-2025-50107, though Oracle’s advisory notes that user interaction is required for their exploitation.

A further three July fixes in E-Business Suite were rated high severity (CVE-2025-30743, CVE-2025-30744, and CVE-2025-50105) and do not allow remote exploitation without authentication, but exploitation does not require user interaction. According to Google Threat Intelligence Group (GTIG) and Mandiant, extortion emails claim to come from the Cl0p cybercrime group, sent from compromised accounts previously linked to FIN11, with researchers yet to confirm the hackers’ claims. Earlier this year, Oracle also acknowledged that hackers stole data from a legacy cloud environment.