InfoSecBulletin Cybersecurity for mankind
Oracle released an emergency security update over the weekend to fix a new vulnerability in E-Business Suite (EBS) that could allow remote access by unauthorized attackers.
CVE-2025-61884 is an information disclosure vulnerability in the Runtime UI component, impacting EBS versions 12.2.3 to 12.2.14. It could enable unauthorized attackers to remotely steal sensitive data if exploited.
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
“This vulnerability is remotely exploitable without authentication, i.e., it may be exploited over a network without the need for a username and password. Oracle strongly recommends that customers apply the updates or mitigations provided by this Security Alert as soon as possible,” Oracle said.
“This vulnerability has received a CVSS Base Score of 7.5. If successfully exploited, this vulnerability may allow access to sensitive resources, added Rob Duhart, Oracle’s Chief Security Officer.
Oracle issued a patch for CVE-2025-61884 shortly after a Clop extortion campaign that targeted executives at various companies, which was later associated with vulnerabilities in EBS patched in July 2025 and another Oracle EBS vulnerability known as CVE-2025-61882.
CrowdStrike reported that they first detected Clop exploiting CVE-2025-61882 in early August during data theft attacks.
WatchTowr Labs security researchers discovered that CVE-2025-61882 is a vulnerability that lets unverified attackers execute code remotely. This was shown by a leaked proof-of-concept exploit from May 2025 by the Scattered Lapsus$ Hunters cybercrime group.
The Clop extortion group was responsible for major data thefts involving zero-days in Accellion FTA, GoAnywhere MFT, Cleo, and MOVEit Transfer, which affected more than 2,770 organizations.
Oracle has not tagged the CVE-2025-61884 vulnerability patched over the weekend as exploited in the wild, and has yet to link it to CVE-2025-61882 attacks.
Defenders should urgently apply the out-of-band CVE-2025-61884 patch due to active targeting of internet-facing Oracle EBS instances.
