F500 Tech & Semiconductors · Computer Software · Structural / no discrete incident
Oracle
Headline
CVE-2025-61882 in Oracle's E-Business Suite is the row's substance, and the reason it matters to consumers who have never heard of EBS is that it is back-office software running payroll, HR and financial records for a…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
CVE-2025-61882 in Oracle's E-Business Suite is the row's substance, and the reason it matters to consumers who have never heard of EBS is that it is back-office software running payroll, HR and financial records for a very large number of employers. A vulnerability there exposes employees, not customers - people with no relationship to Oracle, no ability to evaluate its security, and no notice that their employer's HR system is an Oracle product. Oracle is separately one of the largest data brokers in the world through its advertising and data cloud businesses, a fact that receives far less attention than its database business and that no consumer has ever consented to.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — Oracle primarily serves enterprise/business customers rather than individual consumers directly through EBS specifically.
Data sharing
MAJOR VULNERABILITY (CVE-2025-61882) affecting Oracle's E-Business Suite (EBS) — exploited as a zero-day in a CL0P-branded extortion campaign from as early as Aug. 9, 2025 (Google Threat Intelligence notes overlaps with CL0P/FIN11 but has not formally attributed the activity), this is the SAME vulnerability documented in extensive detail via the Estée Lauder row (F500 Consumer Brands tab), which reportedly affected roughly 100 organizations including Harvard, Penn, Dartmouth, The Washington Post, Logitech, and Cox Enterprises — all running Oracle EBS for internal HR/business operations. Google's own Threat Intelligence team confirmed the Oracle EBS compromise independently. Oracle released a patch Oct 4, 2025, after Google Threat Intelligence/Mandiant reported zero-day exploitation as early as Aug. 9, 2025 (Oracle's advisory credits CrowdStrike and Mandiant) — a roughly 2-month window during which the vulnerability was actively exploited before a fix was available.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy oracle.com/legal/privacy/ | Not fetched yet | NO (HTML only) |
| Terms of service oracle.com/legal/terms.html | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.