Oracle forced to rush out patch for zero-day exploited in attacks

Oracle.

• Oracle patched a critical zero-day RCE flaw in E-Business Suite, actively exploited by ransomware actors
• Attackers used compromised email accounts to extort victims; FIN11 and Cl0p may be involved
• CVE-2025-61882 scored 9.8/10; exploitation requires no authentication and enables full system takeover

Oracle has released a patch to address a zero-day vulnerability in its E-Business Suite which was being actively exploited by ransomware actors.