Breaches and incidentsBriefPublic record
Oracle Cloud login service breach
rose87168 claimed 6M records from 140k+ tenants through an unpatched Oracle Fusion Middleware flaw (CVE-2021-35587) on `login.*.oraclecloud.com`.
- Disclosed
What happened
- rose87168 claimed 6M records from 140k+ tenants through an unpatched Oracle Fusion Middleware flaw (CVE-2021-35587) on `login.*.oraclecloud.com`. Oracle denied it publicly while notifying some customers. CISA issued guidance.
Live scores
Live scores
CVE-2021-35587- EPSS
- 0.963
very likely to be attacked soon - VEDAS
- 0.981
strong exploit evidence - On CISA KEV
- Yes, since 2022-11-28
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Sources
- https://www.cisa.gov/news-events/alerts/2025/04/16/cisa-releases-guidance-credential-risks-associated-potential-legacy-oracle-cloud-compromise
- https://www.cloudsek.com/blog/the-biggest-supply-chain-hack-of-2025-6m-records-for-sale-exfiltrated-from-oracle-cloud-affecting-over-140k-tenants
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.