Exploited vulnerabilitiesBriefPublic record
Oracle E-Business Suite, Cl0p (CVE-2025-61882; also CVE-2025-61884)
Oracle alert 4 Oct 2025. CVSS 9.8, unauthenticated RCE in BI Publisher integration.
- Disclosed
What happened
- Affected: EBS 12.2.3 to 12.2.14.
- Exploited as a zero-day from about Aug 2025. Extortion emails from 29 Sep.
- KEV: 6 Oct 2025 (-61882) and 20 Oct 2025 (-61884). Dozens of named victims, including Harvard and Envoy Air.
Live scores
Live scores
CVE-2025-61882- EPSS
- 0.997
very likely to be attacked soon - VEDAS
- 0.986
strong exploit evidence - On CISA KEV
- Yes, since 2025-10-06
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Live scores
CVE-2025-61884- EPSS
- 0.959
very likely to be attacked soon - VEDAS
- 0.988
strong exploit evidence - On CISA KEV
- Yes, since 2025-10-20
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Sources
- https://www.oracle.com/security-alerts/alert-cve-2025-61882.html
- https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.