Oracle Rushes Patch for CVE-2025-61882 After Cl0p Exploited It in Data Theft Attacks

Oracle has issued an emergency update for its E-Business Suite to mitigate CVE-2025-61882, a vulnerability that Oracle says was exploited in the recent Cl0p data theft attacks. The flaw, tracked as CVE-2025-61882 with a CVSS score of 9.8, could allow an unauthenticated attacker with network access via HTTP to compromise the Oracle Concurrent Processing component, potentially enabling remote code execution.

Oracle stated in its advisory that the vulnerability is remotely exploitable without authentication and may be exploited over a network without a username or password. In a separate alert, Oracle’s Chief Security Officer Rob Duhart said fixes have been released to provide updates against additional potential exploitation found during the investigation.

The Hacker News notes IoCs including two IP addresses, a shell command, and a set of exploit files linked to the Scattered LAPSUS$ Hunters group, and cites comments from Mandiant’s Charles Carmakal describing August 2025 data theft activity involving multiple patched vulnerabilities, including CVE-2025-61882.