Harvard University Breached in Oracle Zero-Day Attack

Harvard University has confirmed it was hit by an attack that exploited a recently disclosed zero-day vulnerability in Oracle’s E-Business Suite (EBS) system, tracked as CVE-2025-61882, which allows an attacker to remotely access EBS instances without authentication. The Cl0P extortion campaign claimed responsibility for stealing Harvard’s data as part of a broader attack against Oracle customers, according to Google’s Threat Intelligence Group and Mandiant.

Harvard said the issue affected many Oracle EBS customers and is not unique to the university, adding that it has applied Oracle’s patch and is continuing to monitor for further signs of compromise. The campaign reportedly began on 29 September 2025, and Cl0P was observed on Harvard’s data as it appeared on its Dark Web leak site weeks after the initial intrusions.

Oracle subsequently issued an advisory and a new security update for a related flaw, CVE-2025-61884, which also affects EBS versions 12.2.3–12.2.14 and is remotely exploitable without authentication.