FlagThis — Daily Cybersecurity Intelligence Briefing

CVE-2025-61882 is a critical unauthenticated remote code execution (RCE) vulnerability in Oracle E-Business Suite (EBS) carrying a CVSS v3.1 score of 9.8. The flaw allows network-based attackers to bypass authentication and execute arbitrary commands with high privileges on on-premises EBS installations. Active exploitation by the CL0P ransomware group utilizes this zero-day for initial access, facilitating large-scale exfiltration of sensitive financial and HR data. This activity precedes the deployment of ransomware for double-extortion. Immediate remediation requires the application of the Oracle July 2025 Critical Patch Update (CPU) to prevent full infrastructure compromise and subsequent regulatory breaches.

CVE-2026-46817 is a critical authentication bypass vulnerability residing within the Oracle Payments component of the Oracle E-Business Suite (EBS). Rated with a CVSS v3.1 score of 9.8, this flaw permits unauthenticated remote attackers to circumvent security protocols and achieve full administrative or root-level control over the EBS instance. Research from Defused Cyber confirms that the vulnerability is currently being exploited in the wild. By targeting specific vulnerable API endpoints, adversaries can compromise the integrity of corporate financial records, payment processing workflows, and sensitive enterprise PII, posing a systemic risk of ransomware deployment and long-term persistence within ERP environments.

UNC6240 (ShinyHunters) conducted a zero-day exploitation campaign targeting Oracle PeopleSoft (PeopleTools 8.61 and 8.62) between May 27 and June 9, 2026. The actors exploited CVE-2026-35273, a critical Server-Side Request Forgery (SSRF) vulnerability (CWE-918) in the Updates Environment Management component, to achieve unauthenticated Remote Code Execution (RCE). Following initial access, the group deployed MeshCentral remote management agents disguised as Microsoft Azure services to maintain persistence and perform reconnaissance. Data was compressed using 'zstd' and exfiltrated for extortion on the ShinyHunters Data Leak Site. CISA added the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog on June 12, 2026, following widespread targeting of the higher education sector.