Clop crew hits Oracle E-Business Suite users with fresh zero-day

Oracle rushed out an emergency fix over the weekend for a zero-day vulnerability in its E-Business Suite (EBS) that criminal crew Clop has already abused for data theft and extortion. The flaw, tracked as CVE-2025-61882, allows unauthenticated remote code execution and carries a CVSS severity score of 9.8 – the kind of score that tells security teams this one can't wait. The bug marks the latest twist in a saga that began when Oracle warned last week that Clop had been exploiting older, unpatched EBS flaws in a wave of extortion attacks. At the time, the company said the activity was tied to vulnerabilities addressed in its July Critical Patch Update. However, the crooks had a fresh ace up their sleeve: a previously unknown zero-day that Oracle now admits was being used in the same campaign. Mandiant confirmed to The Register that Clop has exploited multiple vulnerabilities in Oracle's EBS, including this new zero-day. In a post on LinkedIn, Mandiant CTO Charles Carmakal elaborated, warning of "mass exploitation" by Clop. "Clop exploited multiple vulnerabilities in Oracle EBS which enabled them to steal large amounts of data from several victims in August 2025," he wrote. "CVE-2025-61882 is a critical (9.8 CVSS) vulnerability that enables unauthenticated remote code execution. Given the broad mass 0-day exploitation that has already occurred... organizations should examine whether they were already compromised." Oracle is also sounding the alarm bells, warning in its advisory...