Mass Exploitation of Oracle E-Business Suite Zero-Day Vulnerability

A significant cybersecurity incident has emerged involving the mass exploitation of a previously unknown zero-day vulnerability in Oracle E-Business Suite (EBS). CrowdStrike has identified an active campaign in which threat actors are leveraging this zero-day, now tracked as CVE-2025-61882, to compromise organizations using Oracle EBS. The attackers have targeted a range of organizations, including major enterprises and at least one prominent airline, Envoy Air, which suffered a breach as part of this wave of extortion attempts. The exploitation campaign has raised concerns due to the critical nature of Oracle EBS in managing sensitive business operations, including financials, supply chain, and human resources. Security researchers have highlighted that the attackers are using sophisticated techniques to gain initial access and then move laterally within affected networks. The campaign has prompted urgent advisories from security vendors and researchers, urging organizations to apply patches and review their Oracle EBS deployments for signs of compromise. The incident has also drawn attention to the broader risks posed by supply chain and third-party software vulnerabilities, as attackers increasingly target widely used enterprise platforms. In addition to direct exploitation, there are indications that the attackers may be using stolen credentials and exploiting weak configurations to escalate privileges. The breach at Envoy Air underscores the real-world impact of the campaign, with potential exposure of sensitive data and operational disruption. Security experts have warned that the campaign may not be limited to a single threat actor, as multiple groups could be leveraging the same vulnerability for different objectives, including extortion and data theft. The incident has also reignited debate over the speed and transparency of vulnerability disclosure and patching processes for critical enterprise software. Organizations are being advised to monitor for indicators of compromise, enhance logging and detection around Oracle EBS systems, and coordinate with vendors for timely updates. The campaign is ongoing, and further victims may emerge as investigations continue. This event highlights the persistent threat posed by zero-day vulnerabilities in widely deployed business applications and the need for robust patch management and incident response capabilities.