Clop Ransomware Exploits Oracle EBS Zero-Day for Massive Data Theft in 2025

In October 2025, Oracle urgently patched a critical zero-day vulnerability (CVE-2025-61882) affecting Oracle E-Business Suite (EBS) after widespread exploitation by the Clop ransomware gang. The flaw enabled unauthenticated remote code execution via the Concurrent Processing component’s BI Publisher integration, letting attackers gain unauthorized access and exfiltrate data. Threat actors, including Clop and possibly affiliated groups, used public proof-of-concept exploits—some leaked by other cybercriminals—to breach multiple organizations’ Oracle EBS servers. Victims were extorted via email, with stolen data leveraged for ransom, highlighting material operational and reputational risks.

This incident underscores the persistent targeting of enterprise software zero-days by organized ransomware groups. The increased speed of exploit weaponization and the public sharing of exploit code amplify the urgency for organizations to apply patches swiftly, harden business-critical systems, and enhance detection capabilities for lateral movement and data exfiltration.

Immediate patching is critical as Oracle EBS zero-day exploits are circulating publicly with active attacks by Clop and others. The incident exemplifies how rapidly zero-days can be weaponized by ransomware actors, putting sensitive business data and service continuity at high risk. Organizations must expedite vulnerability management and bolster defense-in-depth across enterprise applications.