InfoSecBulletin Cybersecurity for mankind
National Cyber Emergency Response Team of Pakistan (National CERT) has warned government agencies, military organizations, and critical infrastructure about a significant security vulnerability in Oracle E-Business Suite (EBS).
Hackers can fully control affected systems without needing a password. They can steal sensitive data and disrupt operations, causing significant damage.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
According to the advisory, hackers are already using this vulnerability to run high-level commands on unpatched Oracle EBS systems. Unauthorized access, data theft, and extortion have targeted government and enterprise networks. National CERT warned that breaches in EBS, which manages finance, HR, and supply chain tasks, could cause serious operational and reputational issues.
CVE-2025-61882 is a critical vulnerability with a severity score of 9.8. It can be exploited without user action or special permissions. Hackers can target exposed EBS systems via regular web traffic (HTTP or HTTPS). Organizations with internet-connected systems or poor segmentation are particularly at risk. Any system lacking Oracle’s latest security patches is highly vulnerable.
National CERT warns that unpatched Oracle EBS systems are vulnerable, especially if accessible from untrusted networks or without multi-factor authentication for admin access. Government and military systems on shared or hybrid infrastructure are particularly high-risk due to their exposure.
The advisory outlines steps to enhance security. Organizations should quickly apply Oracle’s latest patches, secure EBS systems with firewalls, and restrict public access to management interfaces. The National CERT recommends monitoring logs for unusual activity and signs of attempted breaches, as well as enabling multi-factor authentication and updating privileged passwords.
Organizations must maintain updated offline backups of EBS databases, activate incident response plans if a breach is suspected, and preserve forensic evidence for investigation. National CERT cautioned that delaying patches or enhancing security could result in service outages, ransom demands, legal issues, and long-term damage to vital government operations.
National CERT has requested all departments and organizations to share the advisory broadly and take prompt action. It encouraged all stakeholders to incorporate this vulnerability into their risk management and to monitor their systems for potential attacks.
