# Estée Lauder Data Breach via Oracle E-Business Suite Zero-Day (CVE-2025-61882) — Clop Exploitation

> Estée Lauder confirmed on June 19, 2026 that the Cl0p ransomware group breached its HR management system around August 9, 2025 by exploiting a zero-day authentication bypass and remote code execution flaw (CVE-2025-61882) in the Oracle E-Business Suite BI Publisher / XML Publisher Template Manager component. Exposed data includes employee PII, SSNs, passport numbers, bank details, health records, and payroll data. The same campaign compromised nearly 30 organizations globally including Harvard, UPenn, Dartmouth, University of Phoenix, Washington Post, Logitech, GlobalLogic, Cox Enterprises, Envoy Air, Schneider Electric, Emerson, Pan American Silver, LKQ Corporation, and Copeland.

- **Published:** 2026-07-21T00:00:00Z
- **Last reviewed:** 2026-07-27T06:58:03.858Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1590
- **ID:** TL-2026-1590
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Actor:** Cl0p
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-61882, CVE-2026-46817

## Description

Beginning as early as August 9, 2025, the Cl0p ransomware/extortion collective (tracked by CrowdStrike as GRACEFUL SPIDER) conducted mass exploitation of an unauthenticated remote code execution zero-day in Oracle E-Business Suite (EBS), CVE-2025-61882, affecting versions 12.2.3 through 12.2.14 in the Oracle Concurrent Processing / BI Publisher (XML Publisher) Template Manager component.

The exploit chain begins with an HTTP POST to the /OA_HTML/SyncServlet endpoint that abuses the EBS configurator/UiServlet flow to bypass authentication, in some cases leveraging default or administrative session context (icx_sessions rows observed with UserID 0 'sysadmin' and UserID 6 'guest'). The attacker then issues GET/POST requests to /OA_HTML/RF.jsp and /OA_HTML/OA.jsp to upload a malicious XSL Template Manager template (an XSLT file such as ieshostedsurvey.xsl) into the xdo_templates_vl database table via the XML Publisher Template Manager. When the template is subsequently previewed/rendered by EBS, the XSLT engine instantiates a Java ScriptEngine, evaluates Base64-decoded JavaScript embedded in the stylesheet, and invokes Java Runtime.exec() to achieve unauthenticated OS command execution on the underlying application server. Post-exploitation, actors deployed web shells (via a two-step process involving FileUtils.java and Log4jConfigQpgsubFilter.java helper classes) invoked through crafted help-content paths such as /OA_HTML/help/state/content/destination./navId.1/navvSetId.iHelp/, and established outbound C2/exfiltration connections over TCP/443 to non-RFC1918 attacker infrastructure.

Exploitation predates public disclosure by nearly two months: extortion emails from addresses support@pubstorm.com and support@pubstorm.net (associated with the Cl0p leak site moniker since at least May 2025) began landing in victim executives' inboxes on September 29, 2025, months after data had already been exfiltrated (files provided to victims showed timestamps dating back to mid-August 2025). A leaked exploit bundle (exp.py, server.py, readme.md) was posted to a Telegram channel on October 3, 2025 by an entity self-identifying as SCATTERED LAPSUS$/'CL0P team', overlapping with monikers used by ShinyHunters and Scattered Spider-affiliated actors, complicating attribution — CrowdStrike assesses GRACEFUL SPIDER (Cl0p) as the primary actor with moderate confidence and cannot rule out a second actor cluster independently weaponizing the same bug. Oracle published its out-of-band security advisory and patch on October 4, 2025 (CVSS 3.1 base score 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); CISA added CVE-2025-61882 to the Known Exploited Vulnerabilities (KEV) catalog on October 6, 2025 with a mandated remediation deadline for federal civilian agencies.

Cl0p subsequently listed 29 alleged victim organizations on its dark-web extortion site, spanning higher education, media, industrials, aviation, retail/consumer, and technology sectors — consistent with the group's prior mass-exploitation extortion campaigns (2023 MOVEit Transfer, 2023 GoAnywhere MFT, 2020-2021 Accellion FTA), all of which followed the same playbook: silent zero-day mass exploitation and exfiltration, followed months later by a coordinated extortion email wave and public shaming site rather than on-host ransomware deployment. Estée Lauder, itself a repeat Cl0p victim from the 2023 MOVEit campaign, confirmed the breach of its HR management system on June 19, 2026 and disclosed exposure of employee names, addresses, emails, dates of birth, Social Security numbers, passport numbers, bank account information, health records, and payroll/performance data, offering 24 months of complimentary Kroll identity-monitoring services to affected employees.

## MITRE ATT&CK

- T1595 Active Scanning
- T1587 Develop Capabilities
- T1583 Acquire Infrastructure
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft
- T1486 Data Encrypted for Impact

## Sources

- [Estée Lauder Data Breach: Oracle EBS Flaw Exploited by Clop](https://thecyberexpress.com/estee-lauder-data-breach-oracle-ebs/)
- [Critical 0day in Oracle E-Business Suite exploited in-the-wild](https://www.rapid7.com/blog/post/etr-cve-2025-61882-critical-0day-in-oracle-e-business-suite-exploited-in-the-wild/)
- [CrowdStrike Identifies Campaign Targeting Oracle E-Business Suite via Zero-Day Vulnerability Tracked as CVE-2025-61882](https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/)
- [CVE-2025-61882: Oracle E-Business Suite Zero-Day Exploited in Clop Extortion Campaigns](https://www.oligo.security/blog/cve-2025-61882-oracle-e-business-suite-zero-day-exploited-in-clop-extortion-campaigns)
- [Lessons from Oracle E-Business Suite Hack That Allegedly Compromises Nearly 30 Organizations Worldwide](https://cybersecuritynews.com/oracle-e-business-suite-hack/)
- [Nearly 30 Alleged Victims of Oracle EBS Hack Named on Cl0p Ransomware Site](https://www.securityweek.com/nearly-30-alleged-victims-of-oracle-ebs-hack-named-on-cl0p-ransomware-site/)
- [Google: Clop Accessed "Significant Amount" of Data in Oracle EBS Exploitation](https://www.infosecurity-magazine.com/news/google-clop-data-oracle-exploit/)
- [Here is the email Clop attackers sent to Oracle customers](https://cyberscoop.com/extortion-email-clop-oracle-customers/)
- [Oracle customers targeted with emails claiming E-Business Suite breach, data theft](https://www.helpnetsecurity.com/2025/10/02/oracle-ebs-data-theft-extortion/)
- [Cl0p ransomware gang names 29 Oracle EBS breach victims](https://www.paubox.com/blog/cl0p-ransomware-gang-names-29-oracle-ebs-breach-victims)
- [Clop's New Extortion Wave Hits Oracle E-Business Suite](https://www.blackfog.com/clops-new-extortion-wave-hits-oracle/)
- [Inside Cl0p Ransomware: How Oracle EBS Clients Can Stay Ahead of Threats](https://www.riministreet.com/blog/inside-the-ciop-ransomware-campaign-how-oracle-ebs-clients-can-stay-ahead-of-evolving-threats/)
- [Dartmouth College Data Breach: Clop Ransomware Exploits Oracle E-Business Suite Zero-Day (CVE-2025-61882)](https://www.rescana.com/post/dartmouth-college-data-breach-clop-ransomware-exploits-oracle-e-business-suite-zero-day-cve-2025-6)
- [Cl0p Abuses Oracle E-Business Suite for Account Takeover](https://www.halcyon.ai/ransomware-research-reports/security-alert-cl0p-abuses-oracle-e-business-suite-for-account-takeover)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1590