InfoSecBulletin Cybersecurity for mankind
National Cyber Emergency Response Team of Pakistan (National CERT) has warned government agencies, military organizations, and critical infrastructure about a significant security vulnerability in Oracle E-Business Suite (EBS).
Hackers can fully control affected systems without needing a password. They can steal sensitive data and disrupt operations, causing significant damage.
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
According to the advisory, hackers are already using this vulnerability to run high-level commands on unpatched Oracle EBS systems. Unauthorized access, data theft, and extortion have targeted government and enterprise networks. National CERT warned that breaches in EBS, which manages finance, HR, and supply chain tasks, could cause serious operational and reputational issues.
CVE-2025-61882 is a critical vulnerability with a severity score of 9.8. It can be exploited without user action or special permissions. Hackers can target exposed EBS systems via regular web traffic (HTTP or HTTPS). Organizations with internet-connected systems or poor segmentation are particularly at risk. Any system lacking Oracle’s latest security patches is highly vulnerable.
National CERT warns that unpatched Oracle EBS systems are vulnerable, especially if accessible from untrusted networks or without multi-factor authentication for admin access. Government and military systems on shared or hybrid infrastructure are particularly high-risk due to their exposure.
The advisory outlines steps to enhance security. Organizations should quickly apply Oracle’s latest patches, secure EBS systems with firewalls, and restrict public access to management interfaces. The National CERT recommends monitoring logs for unusual activity and signs of attempted breaches, as well as enabling multi-factor authentication and updating privileged passwords.
Organizations must maintain updated offline backups of EBS databases, activate incident response plans if a breach is suspected, and preserve forensic evidence for investigation. National CERT cautioned that delaying patches or enhancing security could result in service outages, ransom demands, legal issues, and long-term damage to vital government operations.
National CERT has requested all departments and organizations to share the advisory broadly and take prompt action. It encouraged all stakeholders to incorporate this vulnerability into their risk management and to monitor their systems for potential attacks.
