400/68 Tuesday, October 14, 2025
Oracle has issued a security advisory regarding a newly discovered vulnerability affecting Oracle E-Business Suite (EBS) that could allow attackers to access sensitive information without authentication. Tracked as CVE-2025-61884, the flaw carries a CVSS score of 7.5 (High Severity) and impacts versions 12.2.3 through 12.2.14.
According to the National Vulnerability Database (NVD), this is classified as an easily exploitable vulnerability, enabling attackers to gain network access via HTTP without authentication, exploit the Oracle Configurator, and retrieve all associated data. Oracle confirmed the flaw can be exploited remotely without login credentials and strongly urges users to apply the latest patches immediately to mitigate the risk.
This alert follows recent findings by the Google Threat Intelligence Group (GTIG) and Mandiant, which revealed that another flaw-CVE-2025-61882 in Oracle EBS-was actively exploited as a zero-day against multiple organizations. That campaign was linked to the deployment of malware families such as GOLDVEIN.JAVA, SAGEGIFT, SAGELEAF, and SAGEWAVE. While attribution remains unconfirmed, researchers noted potential ties to the Cl0p ransomware group, previously responsible for large-scale supply chain attacks.
Source https://thehackernews.com/2025/10/new-oracle-e-business-suite-bug-could.html
