Recordedfuture

Oracle EBS Zero-Day CVE-2025-61882 Targets Multiple Organizations

First seen 12 Nov 2025, 19:02 UTC • Darkreading

•78% similarity •10.3

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

In October 2025, the Oracle E-Business Suite (EBS) zero-day vulnerability CVE-2025-61882 was exploited by the Clop ransomware gang, affecting numerous organizations including Schneider Electric, Pan American Steel, and Cox Enterprises. This vulnerability allows unauthorized access, leading to significant security breaches for the impacted enterprises.

ThreatCluster AI

Attack Flow

19 entities, 18 inferred relationships (STIX 2.1).

Technique (2)

Ransomware
Zero-day Exploit

Organization (6)

Cox Enterprises
Envoy Air
Harvard University
Pan American Steel
Schneider Electric SE
MOVEit Transfer

Vulnerability (7)

CVE-2025-11371
CVE-2025-20333
CVE-2025-30406
CVE-2025-54253
CVE-2025-59230
CVE-2025-59287
CVE-2025-61882

Indicator (2)

apps.example.com
updatelicense1.do

Affected Platform (1)

Oracle E-business Suite

Threat Actor (1)

Clop

Relationships

Clop uses Ransomware
Clop uses Zero-day Exploit
Clop exploits CVE-2025-11371
Clop exploits CVE-2025-20333
Clop exploits CVE-2025-30406
Clop exploits CVE-2025-54253
Clop exploits CVE-2025-59230
CVE-2025-11371 targets Oracle E-business Suite
CVE-2025-20333 targets Oracle E-business Suite
CVE-2025-30406 targets Oracle E-business Suite
CVE-2025-54253 targets Oracle E-business Suite
CVE-2025-59230 targets Oracle E-business Suite
CVE-2025-59287 targets Oracle E-business Suite
CVE-2025-61882 targets Oracle E-business Suite
Clop targets Cox Enterprises
Clop targets Envoy Air
Clop targets Harvard University
Clop targets Pan American Steel

Community

Browse all →

Oracle EBS Zero-Day CVE-2025-61882 Targets Multiple Organizations

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading