With more exploits of this vulnerability on the horizon, organizations using affected enterprise software are urged to apply the October patch.

A critical vulnerability, CVE-2025-61882, with a CVSS score of 9.8, has been uncovered in Oracle E-Business Suite’s Concurrent Processing module, allowing unauthenticated attackers with HTTP access to seize full system control and execute remote code without credentials.

Attackers exploit this flaw by sending specially-crafted HTTP requests to vulnerable servers, manipulating the module’s processing to inject malicious code, which grants them unauthorized access to execute commands, steal data, or install ransomware.

The flaw, first exploited by the Cl0p ransomware gang in August 2025, had enabled a massive phishing campaign using hijacked email accounts to steal sensitive data from multiple organizations, as revealed by Mandiant, whose CTO, Charles Carmakal, noted on LinkedIn that Cl0p had chained this zero-day with other vulnerabilities patched in Oracle’s July 2025 Critical Patch Update, amplifying the attack’s impact.

In response, Oracle has issued an emergency security patch this month (Oct 2025) to address the flaw and prevent further exploitation, as detailed in their official advisory. The firm’s Chief Security Officer, Rob Duhart, has emphasized the urgency in a company blog, highlighting additional risks uncovered during the investigation. Various indicators suggest possible links to the Scattered Spider hacking group, though details have been withheld to avoid aiding copycats.

Security experts warn that the breach’s scale suggests undetected compromises may persist in some systems. Carmakal has urged organizations to check for prior intrusions, stating: “Given the broad mass zero-day exploitation that has already occurred (and the n-day exploitation that will likely continue by other actors), irrespective of when the patch is applied, organizations should examine whether they were already compromised.”

Immediate application of the patch, available through Oracle’s latest security alert, is strongly recommended.

This incident underscores the growing threats to enterprise software, with cybercriminals exploiting unpatched systems to devastating effect. Affected corporate users are advised to act swiftly to secure their systems and investigate potential breaches to mitigate further risks.