CVE-2025-61882: Oracle E-Business Suite — Massive Data Exfiltration via Zero-Day (Aug 2025)

CVE-2025-61882 — Oracle E-Business Suite

CVE-2025-61882 is a high-severity zero-day vulnerability in Oracle E-Business Suite (EBS), actively exploited by the Cl0p cybercrime group in August 2025. The flaw enabled attackers to gain unauthorized access and exfiltrate sensitive data at scale. The breach, which affected Estée Lauder, was not publicly disclosed until July 2026 after internal investigation and notification procedures. Exploitation in the wild is confirmed; patching is urgent.

Attack Vector

Attackers leveraged the CVE-2025-61882 vulnerability to bypass authentication controls within Oracle EBS, gaining privileged access to backend systems. The exploit allowed lateral movement and direct access to databases containing personal, financial, and health information. No user interaction was required; exploitation was achieved remotely. Indicators of compromise include anomalous access to EBS administrative interfaces and large outbound data transfers.

Who Is at Risk

All organizations running unpatched Oracle E-Business Suite deployments are at risk, especially those with public-facing EBS instances. Estée Lauder is a confirmed victim, with 870GB of data—including names, addresses, Social Security numbers, passport numbers, bank account details, health data, and employment records—exfiltrated. North American enterprises with legacy or internet-exposed EBS deployments should prioritize assessment.

Patch & Mitigate

• Patch: Apply Oracle’s official security update for CVE-2025-61882 immediately. Check Oracle’s July 2026 Critical Patch Update for details.
• Workaround: Restrict external access to EBS interfaces and enforce network segmentation until patching is complete.
• Detect: Review logs for unauthorized access to EBS admin panels, unexpected privilege escalations, and large data exfiltration events between August 2025 and present.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploited a zero-day to gain initial foothold in the target environment.
• TA0005 — Defense Evasion: The threat actor bypassed authentication and evaded standard access controls.
• TA0010 — Exfiltration: Large-scale data transfer operations were used to exfiltrate sensitive information.

Source: https://www.securityweek.com/estee-lauder-discloses-impact-from-oracle-ebs-zero-day-hack/