https://blog.dansec.red/cves/cve-2025-27915/Recent content in CVE-2025-27915 on DanSec DailyHugoen-gbMon, 06 Oct 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-10-06-cybersecurity-news/Mon, 06 Oct 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-10-06-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Oracle E-Business Suite (EBS) has been compromised via a critical zero-day vulnerability (CVE-2025-61882), enabling unauthenticated remote code execution. The Cl0p ransomware group actively exploited this flaw in recent data theft attacks, prompting Oracle to issue an emergency patch.</li> <li>ParkMobile concluded a class action lawsuit related to its 2021 data breach affecting 22 million users. Victims are receiving a $1 compensation each as part of the settlement.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>CVE-2025-61882: A critical remote code execution vulnerability in Oracle E-Business Suite, actively exploited in the wild by threat actors including Cl0p. Oracle has released an emergency patch to address this issue.</li> <li>CVE-2025-27915: A Zimbra Collaboration Suite vulnerability (CVSS 5.4) was exploited as a zero-day earlier in the year, targeting the Brazilian military. The attack leveraged malicious .ICS (iCalendar) files to deliver the exploit. The vulnerability has since been patched.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>Cl0p ransomware group exploited the Oracle EBS zero-day (CVE-2025-61882) in a recent campaign focused on data theft.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Use of malicious .ICS calendar attachments to exploit Zimbra Collaboration Suite (CVE-2025-27915) demonstrates ongoing interest in abusing productivity and collaboration tools for initial access.</li> <li>The publication of an exploit script and rapid weaponisation of the Oracle EBS vulnerability (CVE-2025-61882) highlight threat actors’ ability to quickly operationalise newly discovered flaws for attacks.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>ParkMobile’s class action settlement following a major data breach sets a precedent for low-value compensation in large-scale breaches, with each affected user receiving $1.</li> </ul>