Cl0p Ransomware Actively Exploiting Oracle E-Business Suite 0-Day

Cl0p Ransomware is actively exploiting Oracle E-Business Suite 0-Day CVE-2025-61882, a severe remote code execution flaw in the BI Publisher Integration component of Oracle EBS. The vulnerability carries a maximum CVSS score of 9.8, marking it as critical and capable of complete system compromise, with versions 12.2.3 through 12.2.14 affected and thousands of organisations worldwide at risk.

Oracle customers began receiving threatening extortion emails on 2 October 2025, while security researchers note that Cl0p has shifted from traditional file encryption to data exfiltration and extortion. Public proof‑of‑concept exploits for CVE-2025-61882 are now available, increasing risk for unpatched systems, and Oracle has released patches for all identified vulnerabilities, although deployment requires the October 2023 CPU prerequisites.

The group is linked to TA505 and FIN11 and has, since February 2019, been associated with other zero‑day campaigns, exploiting multiple CVEs in July 2025’s Critical Patch Update beyond CVE-2025-61882. According to Oracle, nine additional CVEs were patched in that update, affecting components such as Lease and Finance Management, Mobile Field Service, and Universal Work Queue, underscoring the breadth of the threat landscape facing EBS users.