Oracle has launched an emergency replace to deal with a essential safety flaw in its E-Enterprise Suite that it mentioned has been exploited within the latest wave of Cl0p knowledge theft assaults.
The vulnerability, tracked as CVE-2025-61882 (CVSS rating: 9.8), considerations an unspecified bug that would permit an unauthenticated attacker with community entry by way of HTTP to compromise and take management of the Oracle Concurrent Processing element.
“This vulnerability is remotely exploitable with out authentication, i.e., it could be exploited over a community with out the necessity for a username and password,” Oracle mentioned in an advisory. “If efficiently exploited, this vulnerability might end in distant code execution.”
In a separate alert, Oracle’s Chief Safety Officer Rob Duhart mentioned the corporate has launched fixes for CVE-2025-61882 to “present updates in opposition to extra potential exploitation that had been found throughout our investigation.”
As indicators of compromise (IoCs), the expertise shared the next IP addresses and artifacts, indicating the doubtless involvement of the Scattered LAPSUS$ Hunters group as nicely within the exploit –
Information of the Oracle zero-day comes days after studies emerged of a brand new marketing campaign doubtless undertaken by the Cl0p ransomware group concentrating on Oracle E-Enterprise Suite. Google-owned Mandiant described the continued exercise as a “high-volume electronic mail marketing campaign” launched from tons of of compromised accounts.
In a submit shared on LinkedIn, Charles Carmakal, CTO of Mandiant at Google Cloud, mentioned “Cl0p exploited a number of vulnerabilities in Oracle EBS which enabled them to steal massive quantities of knowledge from a number of victims in August 2025,” including “a number of vulnerabilities had been exploited together with vulnerabilities that had been patched in Oracle’s July 2025 replace in addition to one which was patched this weekend (CVE-2025-61882).”
“Given the broad mass zero-day exploitation that has already occurred (and the n-day exploitation that can doubtless proceed by different actors), regardless of when the patch is utilized, organizations ought to study whether or not they had been already compromised,” Carmakal famous.
(It is a creating story. Please verify again for extra particulars.)
