InfoSecBulletin Cybersecurity for mankind
National Cyber Emergency Response Team of Pakistan (National CERT) has warned government agencies, military organizations, and critical infrastructure about a significant security vulnerability in Oracle E-Business Suite (EBS).
Hackers can fully control affected systems without needing a password. They can steal sensitive data and disrupt operations, causing significant damage.
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
According to the advisory, hackers are already using this vulnerability to run high-level commands on unpatched Oracle EBS systems. Unauthorized access, data theft, and extortion have targeted government and enterprise networks. National CERT warned that breaches in EBS, which manages finance, HR, and supply chain tasks, could cause serious operational and reputational issues.
CVE-2025-61882 is a critical vulnerability with a severity score of 9.8. It can be exploited without user action or special permissions. Hackers can target exposed EBS systems via regular web traffic (HTTP or HTTPS). Organizations with internet-connected systems or poor segmentation are particularly at risk. Any system lacking Oracle’s latest security patches is highly vulnerable.
National CERT warns that unpatched Oracle EBS systems are vulnerable, especially if accessible from untrusted networks or without multi-factor authentication for admin access. Government and military systems on shared or hybrid infrastructure are particularly high-risk due to their exposure.
The advisory outlines steps to enhance security. Organizations should quickly apply Oracle’s latest patches, secure EBS systems with firewalls, and restrict public access to management interfaces. The National CERT recommends monitoring logs for unusual activity and signs of attempted breaches, as well as enabling multi-factor authentication and updating privileged passwords.
Organizations must maintain updated offline backups of EBS databases, activate incident response plans if a breach is suspected, and preserve forensic evidence for investigation. National CERT cautioned that delaying patches or enhancing security could result in service outages, ransom demands, legal issues, and long-term damage to vital government operations.
National CERT has requested all departments and organizations to share the advisory broadly and take prompt action. It encouraged all stakeholders to incorporate this vulnerability into their risk management and to monitor their systems for potential attacks.
