The notorious Clop ransomware gang has listed Oracle on its dark web leak site, alleging a successful breach of the tech giant’s internal systems.
This development is part of a massive extortion campaign exploiting a critical zero-day vulnerability in Oracle E-Business Suite (EBS), designated as CVE-2025-61882.
The group, tracked as Graceful Spider, claims to have exfiltrated sensitive data from Oracle and dozens of its high-profile customers, marking a significant escalation in supply chain attacks reminiscent of the MOVEit incident.
The Zero-Day Exploit: CVE-2025-61882
The attack vector centers on a critical, unauthenticated remote code execution (RCE) vulnerability in Oracle E-Business Suite.
Security researchers indicate that Clop affiliates began exploiting this flaw as early as August 2025, months before Oracle released a patch in October 2025.
The exploit chain specifically targets the OA_HTML/SyncServlet endpoint to bypass authentication, followed by malicious XSLT template injection via OA_HTML/RF.jsp to execute arbitrary commands.
This “pre-auth” nature allowed attackers to compromise servers without valid credentials, granting them full control over sensitive ERP data.
| Vulnerability Detail | Technical Specification |
|---|---|
| CVE ID | CVE-2025-61882 |
| Affected Product | Oracle E-Business Suite (Versions 12.2.3 – 12.2.14) |
| Vulnerability Type | Unauthenticated Remote Code Execution (RCE) |
| CVSS Score | 9.8 (Critical) |
| Exploit Vector | Authentication Bypass via SyncServlet & XSLT Injection |
| Patch Status | Patched (October 2025 Security Alert) |
Extortion Campaign and High-Profile Victims
Evidence from Clop’s leak site displays a “PAGE CREATED” status for ORACLE.COM, appearing alongside major entities such as MAZDA.COM, HUMANA.COM, and the Washington Post.
The listing of Oracle Corporation itself suggests the vendor may have fallen victim to its own software flaw, potentially exposing internal corporate data.
Victims report receiving extortion emails from addresses like support@pubstorm[.]com, threatening the release of financial and personal records if ransom demands are not met.
Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.
