VULNpocalypse
Breaches and incidentsBriefReported by a reputable outlet, citing the company

Estee Lauder: employee data stolen through the 2025 Oracle E-Business Suite campaign

Notice: “We became aware of a cybersecurity issue involving a vulnerability in the Oracle E-Business Suite system”; compromise on or around 9 Aug 2025.

Disclosed

What happened

  • Notice: “We became aware of a cybersecurity issue involving a vulnerability in the Oracle E-Business Suite system”; compromise on or around 9 Aug 2025. Data includes names, addresses, dates of birth, SSNs, passport numbers, bank and financial information, health information and payroll and performance data. Count not disclosed.
  • Root cause: an Oracle EBS vulnerability; BleepingComputer links it by timing to CVE-2025-61882 (see the catalogue’s Oracle EBS entry). Not confirmed by the company.
  • Timing matches the Cl0p campaign (inference, not confirmed attribution).
  • 24 months of Kroll monitoring offered.

Live scores

Live scores

CVE-2025-61882
EPSS
0.997
very likely to be attacked soon
VEDAS
0.986
strong exploit evidence
On CISA KEV
Yes, since 2025-10-06
Detection rule
Nuclei · Suricata
EPSS (chance of attack)
10No cve-scores data 2026-02-22 to 2026-08-08no data0.1CVE-2025-61882 EPSS over time2025-102026-11-01
VEDAS (exploit evidence)
10No cve-scores data 2026-02-22 to 2026-08-08no data0.9CVE-2025-61882 VEDAS over time2025-102026-11-01

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.

Sources

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.