Oracle E-Business Suite CVE-2025-61882 exploitation, extortion, and breach fallout

**Oracle E-Business Suite (EBS)** exploitation tied to **Clop / FIN11** has been ongoing since at least **August 9, 2025**, with **CVE-2025-61882** used for **unauthenticated remote code execution** and **data theft**. **Google Threat Intelligence Group (GTIG)** and **Mandiant** said the campaign likely exfiltrated a **significant amount** of data, and that extortion emails sent since **September 29** referenced contact addresses **[email protected]** and **[email protected]**. **Oracle** released an emergency patch on **October 4** for affected **12.2.3-12.2.14** versions, and GTIG said patched servers are likely no longer vulnerable to known exploitation chains.

**Clop**'s **Oracle E-Business Suite** extortion campaign has expanded from ransom emails to named victims and leak-site pressure, with **LKQ** among the first victims listed and the activity linked to **CVE-2025-61882**. **Mandiant** and **Google Threat Intelligence Group** tracked the campaign after companies received emails claiming data theft from their EBS systems, and **Oracle** told customers to install the latest **Critical Patch Updates** after saying Clop was exploiting an EBS flaw patched in **July 2025**. In a separate but related development, **ShinyHunters** says its breach of Clop's **Tor leak site** was retaliation tied to the same campaign and claims it stole server data, **/var/log** files, and the onion service private keys, though only the defacement and uploaded file were independently confirmed. **Harvard University** was also listed on Clop's leak site and said its impact appears limited to a small administrative unit, while the broader campaign has targeted **more than 100 organizations** across multiple sectors.

**CVE-2025-61882** is a critical **Oracle E-Business Suite** vulnerability in **Oracle Concurrent Processing / BI Publisher Integration** that enabled **unauthenticated remote code execution** and was patched by Oracle on **October 4, 2025**. Oracle said the issue affects **versions 12.2.3–12.2.14**, published **indicators of compromise**, and tied the flaw to **Clop** data theft activity that began in **August 2025**. A later update linked **Harvard University** to the campaign after Clop added it to a leak site; Harvard said the activity appears limited to a **small administrative unit**, it applied Oracle’s patch, and it has **no evidence of compromise** to other university systems. **Estée Lauder** also disclosed that its **Oracle E-Business Suite** used for **HR management** was intruded on **or around August 9, 2025**, and that an unauthorized party obtained **personal information of certain individuals**.

Two **Oracle E-Business Suite** exploit campaigns hit separate endpoints in **July and August 2025**, expanding the risk to exposed enterprise instances. The activity matters because the attackers used **different attack paths**, showing sustained targeting rather than a one-off flaw. One phase mapped to **CVE-2025-61884** and the other to **CVE-2025-61882**, with the latter attributed to the **Clop ransomware gang**.

**Oracle E-Business Suite** **CVE-2025-61884** is an **unauthenticated SSRF** flaw in the **Oracle Configurator runtime** that **CISA** says is being **actively exploited**. Oracle disclosed the issue on **October 11**, rated it **CVSS 7.5**, and told federal agencies to patch by **November 10, 2025**. Reporting ties the abuse to **July attacks** and a leaked exploit associated with **ShinyHunters** and the **Scattered Lapsus$** extortion group, while separating it from the distinct **CVE-2025-61882** activity against **/OA_HTML/SyncServlet** attributed to **Clop**.

**Oracle** released an **emergency update** for **Oracle E-Business Suite** to fix **CVE-2025-61882**, a **critical** flaw with **active exploitation** risk tied to **Cl0p data theft attacks**. The bug can be reached over **HTTP without authentication** and may enable **remote code execution** in the **Oracle Concurrent Processing** component. Oracle also said it issued additional fixes after uncovering more potential exploitation during its investigation.