Clop Ransomware Hits Oracle Customers Via Zero-Day Flaw

Clop ransomware is targeting Oracle E-Business Suite customers via a newly disclosed zero-day, CVE-2025-61882, described as a critical flaw that enables an attacker with no authentication to remotely take control of Oracle Concurrent Processing. According to the National Vulnerability Database, CVE-2025-61882 affects the BI Publisher Integration component of Oracle E-Business Suite and has a CVSS score of 9.8, with Oracle advising affected users to apply security updates.

The wave of attacks was linked to extortion emails claiming to be from Clop and follows Oracle’s Oct. 4 disclosure naming the new vulnerability. The report notes that the vulnerable versions include Oracle E-Business Suite 12.2.3–12.2.14, and Tenable’s Satnam Narang observed that while Oracle removed references to earlier July vulnerabilities, external reports suggest Cl0p exploited multiple flaws, though this has not been officially confirmed by Oracle.

Clop has previously conducting high-profile campaigns, including the MOVEit Transfer attacks in 2023, and researchers say it remains to be seen how the latest Oracle campaign compares with past breaches. Oracle did not respond to Dark Reading’s request for comment by press time.