Oracle E-Business Suite Vulnerability Actively Exploited in Ransomware Campaigns

Federal Cybersecurity Agency Confirms Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially confirmed that a vulnerability affecting Oracle E-Business Suite customers is being actively exploited in ransomware attacks, according to reports released Monday. The agency has added the vulnerability, tracked as CVE-2025-61884, to its catalog of known exploited vulnerabilities, indicating confirmed malicious use by threat actors.

Federal Cybersecurity Agency Confirms Active Exploitation
High-Severity Vulnerability Details
Federal Response and Patching Requirements
Available Patches and Affected Systems
Separate from Recent Extortion Campaign
Implications for Enterprise Security

High-Severity Vulnerability Details

Sources indicate the vulnerability carries a severity score of 7.5 out of 10.0, classifying it as a high-severity security issue. Oracle’s initial advisory from October 11 described the flaw as “remotely exploitable without authentication,” meaning attackers can exploit it over networks without requiring usernames or passwords. Analysts suggest successful exploitation could allow unauthorized access to sensitive organizational resources.

Federal Response and Patching Requirements

CISA has mandated that all Federal Civilian Executive Branch agencies implement fixes for the vulnerability by November 10, according to the agency’s advisory. While the requirement specifically applies to federal agencies, CISA “strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation” of such vulnerabilities as part of standard vulnerability management practices.

The advisory emphasized that “these types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise,” underscoring the seriousness of the threat., according to industry reports

Available Patches and Affected Systems

Oracle has made patches available for impacted E-Business Suite versions ranging from 12.2.3 through 12.2.14, according to security alerts. Organizations running these versions are strongly encouraged to apply the patches immediately given the confirmed exploitation in wild.

Separate from Recent Extortion Campaign

Analysts note this vulnerability is separate from another flaw, tracked as CVE-2025-61882, which was recently linked to a widespread data extortion campaign targeting Oracle E-Business Suite customers. Reports from BleepingComputer suggest the current vulnerability may have been exploited as early as July, while the separate extortion campaign occurred in August.

That earlier campaign, which involved data theft followed by extortion emails sent to numerous organizations, has been attributed to the cybercriminal group Clop by researchers at Google Cloud-owned Mandiant and the Google Threat Intelligence Group.

Implications for Enterprise Security

The confirmation of ransomware exploitation highlights the ongoing targeting of business software vulnerabilities by cybercriminals. Security professionals recommend that all organizations using Oracle E-Business Suite immediately review their patch status and implement available security updates. The server-side request forgery nature of the vulnerability makes it particularly dangerous as it can be exploited without any user interaction or authentication credentials.

Organizations are advised to monitor CISA’s Known Exploited Vulnerabilities Catalog for the latest guidance and to implement security patches without delay given the active threat environment.

References & Further Reading

This article draws from multiple authoritative sources. For more information, please consult:

This article aggregates information from publicly available sources. All trademarks and copyrights belong to their respective owners.

Note: Featured image is for illustrative purposes only and does not represent any specific product, service, or entity mentioned in this article.

Russian intelligence-linked hackers have shifted to a new malware family called NoRobot after their previous LostKeys malware was exposed. The sophisticated attack chain uses fake CAPTCHA pages to trick targets into downloading malicious files. Security analysts report this represents a significant escalation in the group’s operational tempo.

Russian Hackers Deploy New Malware Suite

The Russian-affiliated hacking collective Coldriver has been observed deploying a sophisticated new malware set, according to researchers at the Google Threat Intelligence Group. The report states this new malware family, tracked as NoRobot, appears to have replaced the group’s previous primary malware LostKeys since it was publicly disclosed in May 2025.