InfoSecBulletin Cybersecurity for mankind
Oracle released an emergency security update over the weekend to fix a new vulnerability in E-Business Suite (EBS) that could allow remote access by unauthorized attackers.
CVE-2025-61884 is an information disclosure vulnerability in the Runtime UI component, impacting EBS versions 12.2.3 to 12.2.14. It could enable unauthorized attackers to remotely steal sensitive data if exploited.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“This vulnerability is remotely exploitable without authentication, i.e., it may be exploited over a network without the need for a username and password. Oracle strongly recommends that customers apply the updates or mitigations provided by this Security Alert as soon as possible,” Oracle said.
“This vulnerability has received a CVSS Base Score of 7.5. If successfully exploited, this vulnerability may allow access to sensitive resources, added Rob Duhart, Oracle’s Chief Security Officer.
Oracle issued a patch for CVE-2025-61884 shortly after a Clop extortion campaign that targeted executives at various companies, which was later associated with vulnerabilities in EBS patched in July 2025 and another Oracle EBS vulnerability known as CVE-2025-61882.
CrowdStrike reported that they first detected Clop exploiting CVE-2025-61882 in early August during data theft attacks.
WatchTowr Labs security researchers discovered that CVE-2025-61882 is a vulnerability that lets unverified attackers execute code remotely. This was shown by a leaked proof-of-concept exploit from May 2025 by the Scattered Lapsus$ Hunters cybercrime group.
The Clop extortion group was responsible for major data thefts involving zero-days in Accellion FTA, GoAnywhere MFT, Cleo, and MOVEit Transfer, which affected more than 2,770 organizations.
Oracle has not tagged the CVE-2025-61884 vulnerability patched over the weekend as exploited in the wild, and has yet to link it to CVE-2025-61882 attacks.
Defenders should urgently apply the out-of-band CVE-2025-61884 patch due to active targeting of internet-facing Oracle EBS instances.
