CVE-2025-61882AnalysisPublished 17 Nov 2025

17th November · Threat Intelligence Report

Source Check Point Research

Mentioned vulnerabilities

Authoritative record:CVE-2025-61882· Critical 9.8

Exploited in the wild · KEV due 27 Oct 2025 · public exploit available (Metasploit) : block it and hunt for it in your logs now.

Data as of 17 Dec 2025, 10:45 UTC

CVSS base score

9.8Critical

How severe the flaw is on the 0–10 CVSS scale.

KEV deadline: 27 Oct 2025 US federal agencies must patch by this date; a sensible deadline for everyone else.

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 5 Oct 2025
Detectable: evidence found.
nuclei template: Oracle E-Business Suite 12.2.3–12.2.14 – Remote Code Execution
Weaponised: evidence found.
1 Metasploit module
Exploited in the wildExploited: evidence found.
Listed in CISA KEV 1 day after disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

CVE ID reserved
by oracle
2025-10-0306:59Z, 44 hours before disclosure
CVE published
on cve.org
2025-10-0503:17Z, t = 0
In Threat Radar
record ingested
2025-10-0503:33Z, 16 minutes after disclosure
Added to CISA KEV (opens in a new tab)
exploitation confirmed · ransomware use known
2025-10-06, 1 day after disclosure
KEV remediation due
US federal deadline
2025-10-27, 22 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

Description

For the latest discoveries in cyber research for the week of 17th November, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Cl0p’s Oracle E-Business Suite (CVE-2025-61882) zero-day campaign continues to expand. There are new confirmed breaches at The Washington Post, Logitech, Allianz UK, and GlobalLogic, as well as a newly listed but unconfirmed […] The post 17th November – Threat Intelligence Report appeared first on Check Point Research .

Impact

European organizations face significant risks from the Oracle E-Business Suite zero-day exploitation, particularly those in finance, manufacturing, and public sectors that rely heavily on Oracle EBS. Successful exploitation can lead to unauthorized remote code execution, data exfiltration of sensitive corporate and personal information, operational disruption, and financial extortion. The confirmed breach of Allianz UK underscores the threat to European financial institutions. The unconfirmed NHS breach raises concerns about potential impacts on critical healthcare infrastructure. The prolonged undetected exploitation period increases the likelihood of widespread compromise and secondary attacks. Additional vulnerabilities in Microsoft, Cisco, Citrix, and Triofox products, which are widely used in European enterprises, further elevate risk levels by enabling privilege escalation and persistent access. The DDoS attacks on Danish government and defense-related websites demonstrate the threat of service disruption tied to geopolitical conflicts, potentially affecting public trust and government operations. Collectively, these threats can degrade confidentiality, integrity, and availability of critical systems, cause reputational damage, regulatory penalties under GDPR, and financial losses. The broad targeting of SMBs via phishing and malvertising campaigns also threatens European small and medium enterprises, which may lack robust defenses.

Defensive guidance

1. Immediate application of Oracle’s emergency patches for CVE-2025-61882 across all Oracle E-Business Suite deployments, prioritizing critical and internet-facing systems. 2. Conduct comprehensive network segmentation to isolate Oracle EBS environments and limit lateral movement in case of compromise. 3. Deploy and update intrusion prevention systems (IPS) such as Check Point IPS signatures that detect and block exploitation attempts for Oracle, Microsoft, Cisco, Citrix, and Triofox vulnerabilities. 4. Implement continuous monitoring and threat hunting focused on unusual access patterns, new admin account creations, and data exfiltration indicators within Oracle EBS and related systems. 5. Harden endpoint security by applying all relevant patches from Microsoft’s October Patch Tuesday and Cisco/Citrix updates, ensuring no legacy or unpatched systems remain exposed. 6. Enhance email security and user awareness training to mitigate phishing campaigns abusing Meta’s Facebook Business Suite and malvertising threats. 7. Review and securely decommission legacy cloud storage systems to prevent data leakage as seen in the Checkout.com breach. 8. For government and critical infrastructure entities, prepare DDoS mitigation strategies including traffic filtering and scrubbing services to counter pro-Russian attacks. 9. Conduct regular incident response drills incorporating scenarios involving ransomware extortion and zero-day exploitation. 10. Engage with threat intelligence providers to stay updated on emerging indicators of compromise and attacker TTPs related to these threats.

Summary

The primary threat detailed is the ongoing exploitation of a zero-day vulnerability in Oracle E-Business Suite (CVE-2025-61882) by the Cl0p ransomware group. This vulnerability enables remote code execution, allowing attackers to gain unauthorized access to enterprise systems. The exploitation campaign has resulted in confirmed breaches at high-profile organizations including Allianz UK, Logitech, The Washington Post, and GlobalLogic, with unconfirmed reports involving the British NHS. Attackers have exfiltrated data ranging from gigabytes to terabytes and are conducting extortion via ransom demands. Oracle issued emergency patches; however, investigations reveal exploitation began months before public disclosure, indicating a prolonged undetected threat presence. The report also highlights other critical vulnerabilities actively exploited: a Windows kernel privilege escalation (CVE-2025-62215), a critical GDI+ remote code execution flaw (CVE-2025-60724), Cisco Identity Services Engine and Citrix zero-days enabling remote code execution without authentication, and a Triofox authentication bypass allowing attacker persistence and remote access tool deployment. Additionally, pro-Russian threat actors have launched DDoS attacks against Danish government and defense-related websites, aligning with geopolitical conflict patterns. The threat landscape is compounded by ransomware activity, phishing campaigns abusing Meta’s Facebook Business Suite, and malvertising networks targeting payroll and financial systems. Check Point IPS protections are available for several of these vulnerabilities, emphasizing the importance of layered defense. The combination of zero-day exploits, data breaches, and geopolitical cyber operations illustrates a complex, multi-faceted threat environment impacting global and European organizations.

References

research.checkpoint.com/2025/17th-november-threat-intelligence-report/ (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

Timeline

Description

AI analysisMachine-generated, updated 16 Dec 2025, 08:23 UTC

Public exploits and detection1 Metasploit module, a Nuclei detection template

References

Community reviews

Related threats