Tag: CVE-2025-61882

5 Attack Reports | 1 Vulnerabilities

Attack reports

Weekly Threat Bulletin – January 28th, 2026

This weekly threat bulletin highlights several critical vulnerabilities and emerging threats. A severe RCE vulnerability in React Server Components and Next.js (CVE-2025-55182) is being actively exploited. CISA added four critical flaws to its 'Must-Patch' list, including vulnerabilities in Versa C…
ransomware
xmrig
cobalt strike
macos
mirai
sliver
gafgyt
qilin
cisa
interlock
rce
lizkebab
bashlite
aisuru
clop
vshell
next.js
CVE-2025-31125
CVE-2025-34026
pulsepack
rondodox
CVE-2025-54313
beacon
morte
CVE-2025-61882
oracle e-business suite
nezha
agenda
CVE-2025-55182
react
peerblight
etherrat
CVE-2025-68645
rondo
monetastealer
gitlab
2026-01-28
agendacrypt
angryrebel
bash0day
bpfdoor
compood
kswapdoor
lzrd
masuta
miori
noodle rat
okiru
puremasuta
resgod
rondobot
satori
scavenger
splinter
torlus
wicked
Published: January 28, 2026
Linked vulnerabilities : CVE-2025-24893 (CVSS 9.8), CVE-2023-1389, CVE-2025-31125 (CVSS 5.3), CVE-2025-34026 (CVSS 9.2), CVE-2025-54313 (CVSS 7.5), CVE-2025-61882 (CVSS 9.8), CVE-2025-55182 (CVSS 10.0), CVE-2025-66478, CVE-2025-55184 (CVSS 7.5), CVE-2025-55183 (CVSS 5.3), CVE-2025-68645 (CVSS 8.8), CVE-2025-13335 (CVSS 6.5), CVE-2025-13927 (CVSS 7.5), CVE-2025-13928 (CVSS 7.5), CVE-2026-0723 (CVSS 7.4), CVE-2026-1102 (CVSS 5.3)
Downloadable IOCs: 37

CLOP RANSOMWARE: DISSECTING NETWORK - THE RAVEN FILE

The report analyzes the network infrastructure used by the Clop ransomware group, focusing on their exploitation of CVE-2025-61882 in Oracle EBS. It identifies 96 IP addresses associated with a specific fingerprint, with Germany, Brazil, and Panama being prominent locations. The analysis reveals si…
ransomware
CVE-2023-0669
cyclops blink
infrastructure
CVE-2023-34362
CVE-2025-61882
2025-11-05
cryptomix
oracle ebs
fingerprints
ip addresses
network analysis
Published: November 5, 2025
Downloadable IOCs: 203

Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign

A large-scale extortion campaign targeting Oracle E-Business Suite (EBS) customers began on September 29, 2025. The threat actor, claiming affiliation with the CL0P extortion brand, exploited a zero-day vulnerability (CVE-2025-61882) in EBS as early as August 9, 2025. The campaign involved sending …
CVE-2025-61882
oracle e-business suite
2025-10-09
goldvein.java
sagegift
sagewave
goldvein
Published: October 9, 2025
Downloadable IOCs: 0

Oracle E-Business Suite CVE-2025-61882 - Malware Analysis

A critical vulnerability in Oracle E-Business Suite (CVE-2025-61882) is being actively exploited. The attack involves dropping malicious template files through a Python script, which are then activated by previewing. Two types of templates are used: one contacting a hardcoded IP address to execute …
backdoor
template injection
weblogic
CVE-2025-61882
oracle e-business suite
2025-10-08
java exploitation
arbitrary code execution
Published: October 8, 2025
Linked vulnerabilities : CVE-2025-61882 (CVSS 9.8)
Downloadable IOCs: 9

Oracle Security Alert Advisory - CVE-2025-61882

A critical security vulnerability (CVE-2025-61882) has been identified in Oracle E-Business Suite versions 12.2.3-12.2.14. This flaw is remotely exploitable without authentication, potentially leading to remote code execution. The vulnerability affects the BI Publisher Integration component of Orac…
remote code execution
CVE-2025-61882
2025-10-06
security alert
oracle e-business suite
Published: October 6, 2025
Linked vulnerabilities : CVE-2025-61882 (CVSS 9.8)
Downloadable IOCs: 5
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-61882

9.8
    Oracle
  • Concurrent Processing
Published: October 5, 2025
Click here to see more Vulnerabilities