"The newly disclosed flaw, tracked as CVE-2025-61884 and slapped with a CVSS score of 7.5, affects the Runtime UI component in EBS, and Oracle's advisory warns that the flaw can be exploited remotely without authentication and "may allow access to sensitive resources." In other words, it's another wide-open door into one of Oracle's most business-critical systems, and the kind of bug that cybercrims love to chain with others for data theft, extortion, or to delve deeper into enterprise networks."
"The patch arrives a week after Oracle rushed out a fix for a nastier zero-day in the same suite, one that let attackers run code without logging in and has been tied to the ongoing Clop-linked hacking spree. Google's Threat Intelligence Group said at the time it was aware of "dozens" of confirmed victims but expected the real number to exceed a hundred."
CVE-2025-61884 affects the Runtime UI component of Oracle E-Business Suite, has a CVSS score of 7.5, and can be exploited remotely without authentication, potentially allowing access to sensitive resources. The unauthenticated entry point can be chained with other bugs to enable data theft, extortion, or lateral movement within enterprise networks. Oracle urges customers to apply updates or mitigations immediately but has not confirmed in-the-wild exploitation or a definitive link to the ongoing Clop-linked attacks. The patch follows an emergency fix for another zero-day tied to Clop; security researchers and Google Threat Intelligence reported dozens of victims and warned the campaign likely started months earlier.
Read at Theregister
Unable to calculate read time
Collection
[
|
...
]