Oracle E-Business Suite Zero-Day Exploited in Cl0p Attacks

Oracle has patched a critical remote code execution vulnerability in Oracle E-Business Suite tracked as CVE-2025-61882, which the company says was exploited in a Cl0p-driven extortion campaign affecting EBS customers. The zero-day vulnerability, with a CVSS score of 9.8, impacts the BI Publishing Integration component in Oracle Concurrent Processing and affects versions 12.2.3–12.2.14.

Oracle and security researchers revealed that data was stolen from EBS customers in August, with extortion emails sent in late September; according to Mandiant, the attackers also used CVE-2025-61882 alongside patched vulnerabilities from July. Cl0p is confirmed as responsible for the campaign, having previously targeted other products such as MOVEit and Fortra file transfer tools.

Other threat actors, including Scattered Spider and ShinyHunters, are now being considered as possible participants in the Oracle attack. Oracle has issued patches and indicators of compromise to help customers detect and respond to the activity.