Oracle releases emergency patch for new E-Business Suite flaw

Oracle has issued an emergency security update over the weekend to patch another E-Business Suite (EBS) vulnerability that can be exploited remotely by unauthenticated attackers. Tracked as CVE-2025-61884, this information disclosure flaw in the Runtime UI component affects EBS versions 12.2.3 to 12.2.14 and could allow unauthenticated threat actors to steal sensitive data remotely following successful exploitation. "This vulnerability is remotely exploitable without authentication, i.e., it may be exploited over a network without the need for a username and password. Oracle strongly recommends that customers apply the updates or mitigations provided by this Security Alert as soon as possible," Oracle said. "This vulnerability has received a CVSS Base Score of 7.5. If successfully exploited, this vulnerability may allow access to sensitive resources, added Rob Duhart, Oracle's Chief Security Officer. Oracle released the CVE-2025-61884 patch almost two weeks after a Clop extortion campaign targeting executives at multiple companies, which the company later linked to EBS vulnerabilities patched in July 2025 and then to another Oracle EBS vulnerability now tracked as CVE-2025-61882. Since then, cybersecurity firm CrowdStrike said they first spotted Clop exploiting CVE-2025-61882 as a zero-day since early August in data theft attacks and warned that other threat groups may have also joined the attacks. watchTowr Labs security researchers have also found that CVE-2025-61882 is a ...