On-Premises Oracle EBS Systems At Risk Due To CL0P Exploit

Many Ransom Emails Sent Already, Coordinate With Your Security and IT Teams To Determine Business Risk

A recent campaign by the CL0P ransomware group has targeted on-premises, customer-managed Oracle E-Business Suite (EBS) systems, resulting in the potential for widespread data exfiltration and extortion attempts. The campaign, observed from late July through early October 2025, leveraged several small and medium vulnerabilities in Oracle EBS, prompting urgent advisories and investigative efforts from security vendors and Oracle Corp.

Oracle issued an emergency patch for a newly discovered vulnerability in Oracle EBS, identified as CVE-2025-61884. This vulnerability allows unauthenticated attackers to remotely execute code on affected systems, posing a significant security risk. As discussed in a recent FBI Cyber Division post, "if your EBS environment is reachable on the network, and especially if it's internet facing, it's at risk for full compromise."