Skip to content

Incident · Resolved

Oracle E-Business Suite Clop Attacks

Oracle E-Business Suite · 3 stories since OCT 6

3
stories
2
CVEs
OCT 12
latest
Vendor
Oracle
Product
E-Business Suite
First reported
Oct 6, 2025
Latest
Oct 12, 2025
CVE-2025-61882CVE-2025-61884On CISA KEV

How it unfolded

Decipher story Event

  1. CVE-2025-61882 published
  2. CVE-2025-61882 added to CISA KEV
  3. Oracle Patches E-Business Suite Zero-Day Amid Clop Extortion Attacks
  4. Oracle Clop Data Theft Campaign Started Months Ago
  5. CVE-2025-61884 published
  6. Oracle Warns of E-Business Suite Bug
  7. CVE-2025-61884 added to CISA KEV
  8. Federal patch deadline
  9. Federal patch deadline

The story so far

The Clop gang exploited a zero day in Oracle E-Business Suite, CVE-2025-61882, to steal data, then emailed executives with extortion demands in early October 2025. Oracle issued an emergency patch on Oct. 4, Google traced the intrusions back to July, and a week later Oracle warned of a second flaw, CVE-2025-61884.

Written by the editors

Timeline · 3 stories

Oldest first ↓
  1. Oracle Patches E-Business Suite Zero-Day Amid Clop Extortion AttacksOracle has patched a critical zero-day remote code execution flaw in its E-Business Suite, which was being exploited by the Clop gang in a rash of data theft and extortion attacks.LINDSEY O'DONNELL-WELCH · 2 MIN
  2. IntrusionsOracle Clop Data Theft Campaign Started Months AgoThe Clop extortion campaign on Oracle customers last week stemmed from months of intrusion activity tracking back to July 10.LINDSEY O'DONNELL-WELCH · 2 MIN
  3. VulnerabilitiesOracle Warns of E-Business Suite BugA Saturday advisory from Oracle’s CISO warned of a vulnerability impacting some deployments of E-Business Suite (CVE-2025-61884).LINDSEY O'DONNELL-WELCH · 1 MIN

Newsletter

The Decipher Brief

Every week: the stories, the episode, the clips.

Newsletter sign-up is coming soon.