Harvard University confirmed a ransomware attack by the Clop group, exploiting a zero-day vulnerability (CVE-2025-61882) in Oracle’s E-Business Suite (EBS). The flaw allowed unauthenticated remote access, enabling attackers to breach a small administrative unit. While Harvard applied Oracle’s emergency patch and detected no further compromise, the incident is part of a wider Clop campaign targeting Oracle EBS customers globally. Authorities, including the FBI and UK cyber agencies, issued urgent warnings, emphasizing the severity of the flaw. Clop, known for high-profile exploits like the 2023 MOVEit Transfer breach, added Harvard to its leak site, though the university stated no sensitive data was stolen or exposed. The attack leveraged a critical vulnerability before patches were available, with a second flaw (CVE-2025-61884) later disclosed, raising concerns about imminent follow-up attacks. Organizations were urged to patch immediately to mitigate risks.