H-ISAC TLP White Vulnerability Bulletin: Oracle E-Business Suite Vulnerability (CVE-2025-61882) Exploited in Extortion Attacks

On October 4, 2025, Oracle released an advisory to address a critical vulnerability, CVE-2025-61882, affecting E-Business Suite (EBS) systems, versions 12.2.3 through 12.2.14.

This flaw allows unauthenticated remote code execution (RCE) and has been confirmed to be actively exploited in the wild by the Cl0p ransomware group to steal sensitive data and conduct subsequent extortion campaigns against multiple corporations. Immediate patching is recommended to prevent compromise of critical business and sensitive data.

Health-ISAC provides this information to increase situational awareness and encourage organizations to assess their level of risk to this vulnerability.

View the detailed bulletin below.