Oracle patches critical E-Business Suite flaw exploited by Cl0p hackers

Oracle has released an emergency patch for a critical flaw in its E-Business Suite, tracked as CVE-2025-61882 with a CVSS score of 9.8, affecting Oracle E-Business Suite 12.2.3–12.2.14 (BI Publisher Integration). According to Oracle Security Alert Advisory – CVE-2025-61882, the vulnerability is remotely exploitable over HTTP and can allow unauthenticated remote attackers to take control of the Oracle Concurrent Processing component.

The flaw was exploited by the Cl0p ransomware group in data theft attacks, with advisory guidance urging customers to apply the updates as soon as possible. The advisory also provides indicators of compromise, including specific IP addresses, observed commands, and file hashes to help detection and containment.

Google Mandiant and GTIG researchers had previously reported Cl0p activity around Oracle E-Business Suite extortion campaigns, and the report notes that attackers may use hacked accounts and a default password reset workflow to obtain valid credentials. The investigation emphasises rapid deployment of the patch and thorough investigation for related indicators of compromise.