erroneo.us
Search all guides⌘K

Security Digest · Oct 4, 2025 · Vulnerability · Other

Oracle EBS CVE-2025-61882: Cl0p Zero-Day Data Theft

Unauthenticated RCE in Oracle E-Business Suite 12.2.3-12.2.14 used by Cl0p for mass data theft. Patch, then hunt for templates and implants. Act now if not.

Published By erroneo.us Security Desk · Updated 3 min read5 sources

Our verdict

Act now

Any internet-reachable Oracle EBS 12.2.x server that missed the October 2025 alerts should be treated as compromised until a hunt proves otherwise.

Who must act: Organizations running Oracle E-Business Suite 12.2.3 through 12.2.14, especially with the web tier reachable from the internet.

Who can relax: Organizations that do not run Oracle E-Business Suite, including users of Oracle Fusion Cloud applications, which are a different product.

Affected
Oracle E-Business Suite 12.2.3 through 12.2.14 (Oracle Concurrent Processing, BI Publisher Integration)
Fixed in
Oracle Security Alert for CVE-2025-61882 (October 4, 2025; requires the October 2023 Critical Patch Update)
Oracle Security Alert for CVE-2025-61884 (October 11, 2025)
CVSS
9.8 (v3.1, vendor)
EPSS
99.7% (percentile 100.0)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Apply the CVE-2025-61882 Security Alert patch, after confirming the October 2023 CPU prerequisite is installed
  2. Apply the CVE-2025-61884 Security Alert patch and the latest quarterly CPU
  3. Remove direct internet exposure of the EBS web tier or put it behind a WAF and VPN while you investigate
  4. Block non-essential outbound internet traffic from EBS application servers
  5. Run a compromise assessment even if you are already patched: database, web logs, processes and Java memory

How to check if you are affected or compromised

  • Query XDO_TEMPLATES_B and XDO_LOBS for templates whose TEMPLATE_CODE starts with TMP or DEF
  • Search web logs for POSTs to /OA_HTML/SyncServlet and TemplatePreviewPG requests with TMP/DEF template codes
  • Alert on Java processes (applmgr) spawning bash -i or recon commands, and Java-originated outbound 443 connections
  • Check for Oracle's published IOCs, including 200.107.207.26 and 185.181.60.11

What happened#

On September 29, 2025, executives at numerous companies began receiving extortion emails claiming that the Cl0p gang had stolen data from their Oracle E-Business Suite (EBS) systems. According to Google Threat Intelligence Group (GTIG), the emails came from "hundreds, if not thousands" of compromised third-party accounts, and the data theft behind them began weeks earlier. GTIG puts the earliest confirmed exploitation of the underlying bug at August 9, 2025, with suspicious traffic as early as July 10.

On October 4, Oracle published an out-of-band Security Alert for CVE-2025-61882. Oracle says the flaw "is remotely exploitable without authentication" and "may result in remote code execution." The CVE record scores it CVSS 3.1 9.8 and places it in the BI Publisher Integration component of Oracle Concurrent Processing. Oracle also took the unusual step of publishing indicators of compromise, including file hashes for an exploit that had leaked on Telegram on October 3. A week later, Oracle shipped a second alert for a related SSRF flaw, CVE-2025-61884.

CISA added CVE-2025-61882 to its Known Exploited Vulnerabilities catalog on October 6, 2025, and marked it as known to be used in ransomware campaigns. CVE-2025-61884 followed on October 20.

Who is affected#

Affected: Oracle E-Business Suite 12.2.3 through 12.2.14. Oracle notes that the October 2023 Critical Patch Update is a prerequisite for the fix, so badly lagging systems need two rounds of patching. Oracle Fusion Cloud applications are a separate product and are not covered by this advisory.

Do you really need to act?#

If you run EBS 12.2.x, yes. This is a pre-authentication bug in a system that holds finance, HR and supply-chain data. A financially motivated group exploited it at scale before a patch existed, and working exploit code has been public since October 2025. GTIG assesses that servers patched through the October 11 update are likely no longer vulnerable to the known chains.

Patching does not undo a compromise. The chain CrowdStrike describes starts with a POST to /OA_HTML/SyncServlet to bypass authentication. The attacker then uploads a malicious XSLT template through XML Publisher Template Manager, and code runs when that template is previewed. GTIG found multi-stage Java implants (GOLDVEIN.JAVA and the SAGEGIFT/SAGELEAF/SAGEWAVE chain) that mostly live in memory. Both firms report that the patch was available before many intrusions were discovered. GTIG has not formally attributed the campaign to one group. It notes overlaps with FIN11 and the Cl0p brand, and CrowdStrike attributes it to GRACEFUL SPIDER with moderate confidence. The total victim count was not consolidated in the sources reviewed here.

What to do now#

  1. Confirm the October 2023 CPU is applied, then apply the CVE-2025-61882 Security Alert patch and the CVE-2025-61884 patch, or simply move to the latest quarterly CPU.
  2. Take the EBS web tier off the open internet, or restrict it to VPN or allow-listed sources, while you investigate.
  3. Block outbound internet access from EBS application servers except where it is required. GTIG recommends this to disrupt C2 and exfiltration.
  4. Work with your DBA to review recently created XML Publisher templates (see below).
  5. If you find indicators, treat it as a data breach: preserve memory images of the Java processes, rotate EBS application and database credentials, and plan for notification.

How to tell if you were hit#

  • Run SELECT * FROM XDO_TEMPLATES_B ORDER BY CREATION_DATE DESC; and the same query on XDO_LOBS. Templates whose TEMPLATE_CODE begins with TMP or DEF are high-fidelity indicators, per GTIG.
  • Search web logs for POSTs to /OA_HTML/SyncServlet, for TemplatePreviewPG requests carrying TMP/DEF codes, and for unusual hits on /OA_HTML/configurator/UiServlet.
  • Look for Java (account applmgr) spawning bash -i or recon commands such as netstat -an, ps -aux or cat /proc/net/arp. Also look for Java-originated outbound 443 connections to non-private IPs, which CrowdStrike flags. Check icx_sessions for odd UserID 0 or 6 sessions.
  • Match against Oracle's IOCs (for example 200.107.207.26 and 185.181.60.11) and GTIG's C2 addresses.

Timeline#

  • — Earliest suspicious traffic GTIG observed against EBS.
  • — Earliest confirmed zero-day exploitation (GTIG, CrowdStrike).
  • — Cl0p-branded extortion emails begin.
  • — Exploit leaked on Telegram.
  • — Oracle Security Alert for CVE-2025-61882.
  • — Added to CISA KEV.
  • — Oracle patches the related CVE-2025-61884.

Vulnerability records

  • CVE-2025-61882 · KEV 2025-10-06 · Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).
  • CVE-2025-61884 · KEV 2025-10-20 · Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI).

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Oracle — Security Alert Advisory CVE-2025-61882 oracle.com
  2. CVE.org — CVE-2025-61882 cve.org
  3. CISA — Known Exploited Vulnerabilities catalog (JSON feed) cisa.gov
  4. Google Threat Intelligence Group — Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign cloud.google.com
  5. CrowdStrike — Campaign Targeting Oracle E-Business Suite Zero-Day CVE-2025-61882 crowdstrike.com