---
title: "Oracle EBS CVE-2025-61882: Cl0p Zero-Day Data Theft"
url: https://erroneo.us/security/briefs/oracle-ebs-cve-2025-61882-cl0p-zero-day/
description: "Unauthenticated RCE in Oracle E-Business Suite 12.2.3-12.2.14 used by Cl0p for mass data theft. Patch, then hunt for templates and implants. Act now if not."
type: security-brief
section: "Security Digest"
date_published: 2025-10-04
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2025-61882", "CVE-2025-61884"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Oracle EBS CVE-2025-61882: Cl0p Zero-Day Data Theft

**Verdict: Act now.** Any internet-reachable Oracle EBS 12.2.x server that missed the October 2025 alerts should be treated as compromised until a hunt proves otherwise.

- **Who must act:** Organizations running Oracle E-Business Suite 12.2.3 through 12.2.14, especially with the web tier reachable from the internet.
- **Who can relax:** Organizations that do not run Oracle E-Business Suite, including users of Oracle Fusion Cloud applications, which are a different product.
- **Affected:** Oracle E-Business Suite 12.2.3 through 12.2.14 (Oracle Concurrent Processing, BI Publisher Integration)
- **Fixed:** Oracle Security Alert for CVE-2025-61882 (October 4, 2025; requires the October 2023 Critical Patch Update); Oracle Security Alert for CVE-2025-61884 (October 11, 2025)
- **CVEs:** CVE-2025-61882, CVE-2025-61884
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Apply the CVE-2025-61882 Security Alert patch, after confirming the October 2023 CPU prerequisite is installed
2. Apply the CVE-2025-61884 Security Alert patch and the latest quarterly CPU
3. Remove direct internet exposure of the EBS web tier or put it behind a WAF and VPN while you investigate
4. Block non-essential outbound internet traffic from EBS application servers
5. Run a compromise assessment even if you are already patched: database, web logs, processes and Java memory

### How to check if you are affected

- Query XDO_TEMPLATES_B and XDO_LOBS for templates whose TEMPLATE_CODE starts with TMP or DEF
- Search web logs for POSTs to /OA_HTML/SyncServlet and TemplatePreviewPG requests with TMP/DEF template codes
- Alert on Java processes (applmgr) spawning bash -i or recon commands, and Java-originated outbound 443 connections
- Check for Oracle's published IOCs, including 200.107.207.26 and 185.181.60.11

## What happened

On September 29, 2025, executives at numerous companies began receiving extortion emails claiming that the Cl0p gang had stolen data from their Oracle E-Business Suite (EBS) systems. According to [Google Threat Intelligence Group (GTIG)](https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation), the emails came from "hundreds, if not thousands" of compromised third-party accounts, and the data theft behind them began weeks earlier. GTIG puts the earliest confirmed exploitation of the underlying bug at August 9, 2025, with suspicious traffic as early as July 10.

On October 4, Oracle published an out-of-band [Security Alert for CVE-2025-61882](https://www.oracle.com/security-alerts/alert-cve-2025-61882.html). Oracle says the flaw "is remotely exploitable without authentication" and "may result in remote code execution." The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-61882) scores it CVSS 3.1 9.8 and places it in the BI Publisher Integration component of Oracle Concurrent Processing. Oracle also took the unusual step of publishing indicators of compromise, including file hashes for an exploit that had leaked on Telegram on October 3. A week later, Oracle shipped a second alert for a related SSRF flaw, CVE-2025-61884.

CISA added CVE-2025-61882 to its [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) on October 6, 2025, and marked it as known to be used in ransomware campaigns. CVE-2025-61884 followed on October 20.

## Who is affected

Affected: Oracle E-Business Suite 12.2.3 through 12.2.14. Oracle notes that the October 2023 Critical Patch Update is a prerequisite for the fix, so badly lagging systems need two rounds of patching. Oracle Fusion Cloud applications are a separate product and are not covered by this advisory.

## Do you really need to act?

If you run EBS 12.2.x, yes. This is a pre-authentication bug in a system that holds finance, HR and supply-chain data. A financially motivated group exploited it at scale before a patch existed, and working exploit code has been public since October 2025. GTIG assesses that servers patched through the October 11 update are likely no longer vulnerable to the known chains.

Patching does not undo a compromise. The chain [CrowdStrike describes](https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/) starts with a POST to `/OA_HTML/SyncServlet` to bypass authentication. The attacker then uploads a malicious XSLT template through XML Publisher Template Manager, and code runs when that template is previewed. GTIG found multi-stage Java implants (GOLDVEIN.JAVA and the SAGEGIFT/SAGELEAF/SAGEWAVE chain) that mostly live in memory. Both firms report that the patch was available before many intrusions were discovered. GTIG has not formally attributed the campaign to one group. It notes overlaps with FIN11 and the Cl0p brand, and CrowdStrike attributes it to GRACEFUL SPIDER with moderate confidence. The total victim count was not consolidated in the sources reviewed here.

## What to do now

1. Confirm the October 2023 CPU is applied, then apply the CVE-2025-61882 Security Alert patch and the CVE-2025-61884 patch, or simply move to the latest quarterly CPU.
2. Take the EBS web tier off the open internet, or restrict it to VPN or allow-listed sources, while you investigate.
3. Block outbound internet access from EBS application servers except where it is required. GTIG recommends this to disrupt C2 and exfiltration.
4. Work with your DBA to review recently created XML Publisher templates (see below).
5. If you find indicators, treat it as a data breach: preserve memory images of the Java processes, rotate EBS application and database credentials, and plan for notification.

## How to tell if you were hit

- Run `SELECT * FROM XDO_TEMPLATES_B ORDER BY CREATION_DATE DESC;` and the same query on `XDO_LOBS`. Templates whose `TEMPLATE_CODE` begins with `TMP` or `DEF` are high-fidelity indicators, per GTIG.
- Search web logs for POSTs to `/OA_HTML/SyncServlet`, for `TemplatePreviewPG` requests carrying TMP/DEF codes, and for unusual hits on `/OA_HTML/configurator/UiServlet`.
- Look for Java (account `applmgr`) spawning `bash -i` or recon commands such as `netstat -an`, `ps -aux` or `cat /proc/net/arp`. Also look for Java-originated outbound 443 connections to non-private IPs, which CrowdStrike flags. Check `icx_sessions` for odd UserID 0 or 6 sessions.
- Match against Oracle's IOCs (for example 200.107.207.26 and 185.181.60.11) and GTIG's C2 addresses.

## Timeline

- Jul 10, 2025 — Earliest suspicious traffic GTIG observed against EBS.
- Aug 9, 2025 — Earliest confirmed zero-day exploitation (GTIG, CrowdStrike).
- Sep 29, 2025 — Cl0p-branded extortion emails begin.
- Oct 3, 2025 — Exploit leaked on Telegram.
- Oct 4, 2025 — Oracle Security Alert for CVE-2025-61882.
- Oct 6, 2025 — Added to CISA KEV.
- Oct 11, 2025 — Oracle patches the related CVE-2025-61884.

## Sources

1. [Oracle — Security Alert Advisory CVE-2025-61882](https://www.oracle.com/security-alerts/alert-cve-2025-61882.html)
2. [CVE.org — CVE-2025-61882](https://www.cve.org/CVERecord?id=CVE-2025-61882)
3. [CISA — Known Exploited Vulnerabilities catalog (JSON feed)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
4. [Google Threat Intelligence Group — Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign](https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation)
5. [CrowdStrike — Campaign Targeting Oracle E-Business Suite Zero-Day CVE-2025-61882](https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/)

---
Source page: https://erroneo.us/security/briefs/oracle-ebs-cve-2025-61882-cl0p-zero-day/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt