The Cybersecurity and Infrastructure Security Agency (CISA) is warning that SaaS companies are under fire from criminals on the prowl for cloud apps with weak security.

Apps with default configurations and elevated permissions are the aim of these attacks, although the US agency did not attribute the activity to a specific group in a message issued last week.

However, the warning follows an advisory published by data security biz Commvault earlier this month, which revealed unauthorised activity was detected in its Azure environments.

Danielle Sheer, chief trust officer at Commvault, said in a blog post that Microsoft contacted the company in February, reporting signs that nation-state baddies had broken into Commvault’s systems.

A separate advisory at the time confirmed that “a handful of customers” were affected after the suspected nation-state attackers exploited a Commvault zero-day (CVE-2025-3928 – 8.7). That vulnerability remains unspecified, but it requires authenticated credentials in order to make use of it.

It was added to CISA’s Known Exploited Vulnerability (KEV) catalogue on April 28 with the added detail that successful exploitation can lead to remote attackers creating and executing web shells.

Each KEV entry also lists whether the vulnerability is known to be used in ransomware attacks. In this case, the value for CVE-2025-3928 is “unknown.”

Sheer confirmed there was no access to the data Commvault protects for its customers and the event had no impact on Commvault’s business operations.

However, after months of investigation, Commvault confirmed the objective of the criminal was to acquire app credentials that could be used to breach companies’ M365 environments.

CISA said last week that the zero-day gave attackers a way into Commvault’s Azure-hosted M365 backup SaaS solution, which then provided access to customers’ M365 environments that had application secrets stored in Commvault.

Without indicating the scale of this broader campaign against the SaaS sector, CISA said it “believes the threat activity may be part of a larger campaign targeting various SaaS companies’ cloud applications with default configurations and elevated permissions.”

Those reading this and thinking “it sounds like it could be us next” are advised to follow CISA’s guidance to mitigate the threat of successful attacks on organisations and their customers.

Microsoft Entra logs will play an important role, both for identifying any unauthorised modifications to credentials, or any rogue added credentials, originating from Commvault apps or service principals.

The agency adds that any deviations from the norm should be treated as suspicious, and incident response protocols enacted accordingly.

CISA advises that Microsoft logs, including Entra audit and sign-in, should also be used to conduct internal threat hunting in alignment with the organisation’s incident response plan.

For single-tenant apps, CISA suggests setting up a conditional access policy so authentication of an app service principal can only be carried out by IP addresses within Commvault’s allowlisted range.

Organizations that have control over their Commvault application secrets, which is only a limited number of them, should rotate those secrets and credentials on Commvault Metallic applications and service principals that were available between February and May this year.

Lastly, check Entra for any accounts that have admin rights but perhaps don’t necessarily need them. Reduce privileges where possible.

On-prem Commvault customers should restrict access to management interfaces to trusted networks and admin systems, where technically feasible.

Ensure all relevant Commvault patches are applied (cloud-based customers have them applied automatically), and use a WAF to detect and block path traversal attempts and dodgy-looking file uploads. Remove external access to Commvault apps too.

Federal cybersecurity officials on Wednesday warned of the potential fallout of a data breach impacting Oracle.

For weeks, Oracle privately warned customers of a January incident where hackers stole information and accessed client credentials held on legacy Oracle systems.

BleepingComputer and Bloomberg reported throughout March and April that Oracle customers were told privately of multiple security incidents, even though the company avoided publicly addressing the issue. The company claimed in one email to customers that Oracle Cloud Infrastructure (OCI) was not breached but a hacker “did access and publish user names from two obsolete servers that were never a part of OCI.” The FBI and CrowdStrike are investigating the incident, according to the letter Oracle sent to customers.

The incident came into public view when the alleged hacker behind the incident took to social media to boast of the theft and offer the stolen documents for sale on cybercriminal forums.

CloudSEK, CybelAngel and several other cybersecurity firms confirmed the threat actor, known as “rose87168,” was selling 6 million records extracted from Oracle Cloud’s Single Sign-On (SSO) and Lightweight Directory Access Protocol (LDAP) systems, impacting over 140,000 tenants across multiple regions and industries.

CloudSEK and others examined the data breach and found encrypted passwords, key files and other sensitive information. The hacker, according to CloudSEK, was seen soliciting help from other hackers to decrypt the stolen credentials and threatening Oracle customers — pledging to remove their data for a fee.

On Wednesday, the Cybersecurity and Infrastructure Security Agency (CISA) said that while the scope of the incident remains unconfirmed, the “nature of the reported activity presents potential risk to organisations and individuals, particularly where credential material may be exposed, reused across separate, unaffiliated systems, or embedded.”

“When credential material is embedded, it is difficult to discover and can enable long-term unauthorised access if exposed,” CISA said.

“The compromise of credential material, including usernames, emails, passwords, authentication tokens, and encryption keys, can pose significant risk to enterprise environments.”

The agency added that threat actors often weaponise these kinds of credentials to escalate their privileges and move around networks; access cloud and identity management systems; conduct phishing and business email compromise campaigns; resell access to stolen credentials; and enrich previously stolen data for targeted intrusions.

CISA urged organisations to reset all passwords for any affected services, review source code for any potential issues, monitor authentication logs for anomalous activity, and report any incidents to authorities.

At least three Oracle Cloud customers confirmed to news outlets that their information was in the leaked data set.

Oracle has finally acknowledged to some customers that attackers have stolen old client credentials after breaching a “legacy environment” last used in 2017, Bloomberg reported.

However, while Oracle told clients this is old legacy data that is not sensitive, the threat actor behind the attack has shared data from the end of 2024 and posted newer records from 2025 on a hacking forum.

According to Bloomberg, the company also informed clients that cybersecurity firm CrowdStrike and the FBI are investigating the incident.

Cybersecurity firm CybelAngel first revealed that Oracle told clients that an attacker who gained access to the company’s Gen 1 (also known as Oracle Cloud Classic) servers as early as January 2025 used a 2020 Java exploit to deploy a web shell and additional malware.

During the breach, detected in late February, the attacker allegedly exfiltrated data from the Oracle Identity Manager (IDM) database, including user emails, hashed passwords, and usernames.

This comes after a threat actor (known as rose87168) put up for sale 6 million data records on BreachForums on March 20 and released multiple text files containing a sample database, LDAP information, and a list of the companies as proof that the data was legitimate, all of them allegedly stolen from Oracle Cloud’s federated SSO login servers.

​When asked to confirm the authenticity of the leaked data, Oracle said that “There has been no breach of Oracle Cloud. The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data.”

Oracle denied this even after an archived URL showed that the threat actor uploaded a file containing their email address to one of Oracle’s servers. This URL was subsequently removed from Archive.org, but an archive of the archive still exists.

However, days later, it was confirmed with multiple companies that additional samples of the leaked data (including associated LDAP display names, email addresses, given names, and other identifying information) received from the threat actor were valid.

Oracle has consistently denied reports of a breach in Oracle Cloud in statements shared with the press since the incident surfaced. This is admittedly true since it aligns with the reports that Oracle is telling customers that the breach impacted an older platform known as Oracle Cloud Classic.

“Oracle rebadged old Oracle Cloud services to be Oracle Classic. Oracle Classic has the security incident,” cybersecurity expert Kevin Beaumont confirmed on Monday. “Oracle are denying it on ‘Oracle Cloud’ by using this scope — but it’s still Oracle cloud services that Oracle manage. That’s part of the wordplay.”