DaystoPatch

OracleExploited incident

Oracle E-Business Suite zero-day exploited in Clop data-theft campaign (CVE-2025-61882)

CVE-2025-61882Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 6 Oct 2025

  • Exploited before a fix
  • Known ransomware use
FixedFixed for every supported version 2 days after the first public report.
Embed this live clock

Response

Silence
2d
First public report to first vendor statement
Exposure
2d
First public report to first fix
Follow-through
2d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    BleepingComputer: Clop extortion emails claim theft of Oracle E-Business Suite dataCuratedQuote verified

    October 1, 2025 11:13 PM

    Byline has no zone on the page; JSON-LD datePublished is 2025-10-01T23:13:58-04:00 (03:13 UTC on 2025-10-02). Lead: 'Mandiant and Google are tracking a new extortion campaign where executives at multiple companies received emails claiming that sensitive data was stolen from their Oracle E-Business Suite systems.' At this point the method was unknown; Clop told BleepingComputer a bug in Oracle's product was exploited.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:221021738a9f1cb6…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    CVE.org record CVE-2025-61882ClaimedQuote verified5 Oct 2025, 03:17 UTC

    Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c8f8ca1fb4e11647…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet5 Oct 2025, 04:17 UTC

    You can now share your thoughts on vulnerability CVE-2025-61882 in Vulnerability-Lookup:

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet5 Oct 2025, 04:34 UTC

    🚨 CRITICAL: CVE-2025-61882 allows unauthenticated HTTP takeover of Oracle Concurrent Processing (12.2.3–12.2.14). CVSS 9.8. Restrict access, monitor for patches, deploy WAF/IDS. Stay alert!

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-61882)ClaimedQuote verified6 Oct 2025

    Oracle E-Business Suite Unspecified Vulnerability

    Added to CISA's KEV catalog on 2025-10-06.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet30 Nov 2025, 10:12 UTC

    and colocation sites to rapidly scale without building new facilities. Also covered: Canon ransomware via Oracle zero-day (CVE-2025-61882), Meta negotiating to buy Google TPUs, and White House Genesis Mission combining AI + quantum computing.

    Earliest third-party post we hold.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date only+2d

    Oracle Security Alert Advisory - CVE-2025-61882, Rev 1 (Wayback capture 2025-10-05)CuratedQuote verified

    2025-October-04 Rev 1. Initial Release.

    Out-of-band Security Alert issued on a Saturday, with IOCs. Earlier, on 2025-10-01/02, Oracle CSO Rob Duhart posted that the extortion activity involved 'the potential use of previously identified vulnerabilities that are addressed in the July 2025 Critical Patch Update' (quoted by BleepingComputer); that post did not acknowledge this new bug and its page is JavaScript-rendered, so it is not recorded as vendor evidence.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:eb5eeea7bc75f227…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date only+2d

    Oracle Security Alert Advisory - CVE-2025-61882, Rev 1 (Wayback capture 2025-10-05)CuratedQuote verified

    Oracle strongly recommends that customers apply the updates provided by this Security Alert as soon as possible.

    Updates shipped with the alert (Rev 1, 2025-10-04). The October 2023 CPU is a prerequisite.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:eb5eeea7bc75f227…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date only+2d

    Oracle Security Alert Advisory - CVE-2025-61882, Rev 1 (Wayback capture 2025-10-05)CuratedQuote verified

    Oracle E-Business Suite, versions 12.2.3-12.2.14

    All supported affected versions in the one alert (Rev 1, 2025-10-04).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:eb5eeea7bc75f227…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

Oracle E-Business Suite flaw used by Clop to steal data; fixed Oct 4, 2025

The Clop extortion group used an unknown flaw in Oracle E-Business Suite 12.2.3-12.2.14 to steal data from internet-facing systems starting in August 2025; Oracle shipped an emergency fix on October 4, 2025.

In plain words

Oracle E-Business Suite, used for finance and supply-chain operations, had a serious flaw that let attackers in without a password. The Clop criminal group used it to steal data from companies starting in August 2025, then sent extortion emails. Oracle released an emergency fix on October 4, 2025. If we run E-Business Suite, we need to confirm the fix (and the related October 11, 2025 fix) is installed and check whether we were breached before it was applied.

What happened and who is affected

What happened

In late September 2025 executives at many companies received extortion emails from the Clop group claiming theft of data from Oracle E-Business Suite. Oracle released an out-of-band Security Alert with updates for CVE-2025-61882 (CVSS 9.8, no login needed, remote code execution) on October 4, 2025. Mandiant's CTO said Clop had exploited this flaw, together with bugs fixed in July 2025, to steal data in August 2025, before any fix existed.

Who is affected

Organizations running Oracle E-Business Suite 12.2.3 through 12.2.14, especially where the EBS web interface is reachable from the internet.

CVE-2025-61882. Reviewed 23 Oct 2026. https://daystopatch.com/incidents/oracle-cve-2025-61882/

Affected products

  • Oracle E-Business Suite (Oracle Concurrent Processing, BI Publisher Integration) 12.2.3-12.2.14
How we built this timeline

Zero-day: BleepingComputer (5 Oct 2025) quotes Mandiant CTO Charles Carmakal: 'Multiple vulnerabilities were exploited including vulnerabilities that were patched in Oracle's July 2025 update as well as one that was patched this weekend (CVE-2025-61882)', with data theft in August 2025. BleepingComputer (14 Oct 2025) and researchers found the 61882 updates broke the Clop SyncServlet chain, while the leaked 'Scattered Lapsus$ Hunters' exploit listed among the alert's IOCs is actually the UiServlet SSRF fixed separately as CVE-2025-61884 (see oracle-cve-2025-61884);

Oracle's IOC list therefore mixes the two. Rev 2 (6 Oct 2025) 'Clarified IOCs table'.

CVSS 9.8 from Oracle's risk matrix. ransomware=true follows KEV ('Known'). Wayback captures cited because oracle.com blocks non-browser user agents.

Related

Oracle report card