Cl0p’s Oracle EBS Zero-Day Campaign: What We Know So Far

The Cl0p ransomware group has renewed focus on Oracle EBS with a wide extortion campaign based on two high‑impact zero-days. CVE-2025-61882, with a CVSS of 9.8, affects the BI Publisher Integration inside the Concurrent Processing module and lets attackers run arbitrary code over HTTP without login, while CVE-2025-61884, CVSS 7.5, targets the Runtime UI of Oracle Configurator and can expose configuration data through the UiServlet endpoint without credentials.

CISA added CVE-2025-61884 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild and setting a patch deadline for federal agencies. The vulnerabilities affect Oracle EBS versions 12.2.3 through 12.2.14, exposing a large number of organisations during October, with Cl0p listing 103 affected organisations and 77 victim datasets appearing on torrent and magnet links.

Victims include Harvard University, Wits University, Envoy Air, Logitech, and Oracle itself, with 29 new victims added in the latest wave. Exploitation is being observed as pre‑auth RCE paths, and leaks of PoC files have helped widen access; a Dark Web post on 20 June cited a pre‑auth exploit for 12.2.14 priced at $70,000, indicating broader interest beyond Cl0p. According to SOCRadar, these findings point to an opportunistic mass‑exploitation pattern driven by data theft and extortion.