Critical Oracle EBS Flaw Actively Weaponized in Ransomware Campaigns, CISA Warns

Federal Alert: Oracle EBS Vulnerability Confirmed in Active Ransomware Operations

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially confirmed that threat actors are actively exploiting a server-side request forgery vulnerability in Oracle E-Business Suite (EBS) to deploy ransomware. The vulnerability, tracked as CVE-2025-61884, represents a significant threat to organizations using the popular enterprise resource planning platform, with federal agencies required to patch the flaw by November 10., according to technological advances

Federal Alert: Oracle EBS Vulnerability Confirmed in Active Ransomware Operations
Vulnerability Details and Exploitation Scope
Distinct from Earlier EBS Extortion Campaign
CISA’s Urgent Remediation Mandate
Affected Versions and Available Patches

Vulnerability Details and Exploitation Scope

Oracle initially disclosed the vulnerability on October 11 without providing specific details about ongoing exploitation. The flaw carries a CVSS severity score of 7.5 out of 10.0, classifying it as high-severity. According to Oracle’s advisory, “This vulnerability is remotely exploitable without authentication” and could allow attackers to access sensitive resources when successfully exploited.

What makes this vulnerability particularly dangerous is its server-side request forgery (SSRF) nature, which enables attackers to make requests from the vulnerable server to other internal or external systems. This capability provides threat actors with a powerful foothold within corporate networks, potentially leading to data exfiltration and ransomware deployment.

Distinct from Earlier EBS Extortion Campaign

Security researchers emphasize that this ransomware campaign is separate from the widespread data extortion operation targeting Oracle EBS customers that emerged in August. The earlier campaign exploited CVE-2025-61882, a critical-severity vulnerability that the Clop cybercriminal group leveraged to steal data and send extortion emails to numerous organizations.

According to reports from BleepingComputer, the current vulnerability is believed to have been exploited as early as July, suggesting threat actors may have had several months to weaponize the flaw before its public disclosure.

CISA’s Urgent Remediation Mandate

CISA has added CVE-2025-61884 to its Known Exploited Vulnerabilities Catalog, highlighting the immediate threat it poses to federal enterprises and private organizations alike. In their advisory, the agency stated that “these types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.”

While the November 10 remediation deadline specifically applies to Federal Civilian Executive Branch agencies, CISA strongly urges all organizations to prioritize patching this vulnerability. The agency recommends that all enterprises incorporate timely remediation of such vulnerabilities into their standard vulnerability management practices., as earlier coverage

Affected Versions and Available Patches

Oracle has confirmed that patches are available for impacted E-Business Suite versions 12.2.3 through 12.2.14. Organizations running these versions should immediately:

Apply the latest security patches from Oracle
Monitor for unusual network activity originating from EBS systems
Implement additional network segmentation where possible
Review access controls and authentication mechanisms

The confirmation of active ransomware exploitation underscores the critical importance of maintaining rigorous patch management programs, particularly for enterprise applications handling sensitive business data. As threat actors increasingly target business-critical systems like Oracle EBS, organizations must balance operational continuity with security imperatives to prevent potentially devastating ransomware incidents.

For additional information about CISA’s vulnerability catalog and mitigation guidance, organizations can reference the official CISA Known Exploited Vulnerabilities Catalog.