"This vulnerability is remotely exploitable without authentication, i.e., it may be exploited over a network without the need for a username and password,"
"If successfully exploited, this vulnerability may result in remote code execution."
"Cl0p exploited multiple vulnerabilities in Oracle EBS which enabled them to steal large amounts of data from several victims in August 2025,"
"multiple vulnerabilities were exploited including vulnerabilities that were patched in Oracle's July 2025 update as well as one that was patched this weekend (CVE-2025-61882)."
Oracle released an emergency update to address CVE-2025-61882, a critical E-Business Suite vulnerability with a CVSS score of 9.8. The flaw allows an unauthenticated attacker with HTTP network access to compromise the Oracle Concurrent Processing component and potentially achieve remote code execution. Oracle's Chief Security Officer said fixes include updates against additional potential exploitation discovered during the investigation. Indicators of compromise include IP addresses and artifacts suggesting involvement by Scattered LAPSUS$ Hunters. The Cl0p group ran a high-volume email campaign from hundreds of compromised accounts and exploited multiple EBS vulnerabilities, including July 2025 patches and CVE-2025-61882.
Read at The Hacker News
Unable to calculate read time
Collection
[
|
...
]