Loading story…
Oracle E-Business Suite was recently found to be vulnerable to a critical security flaw, CVE-2025-61882, which has been actively exploited in the wild. Oracle published a security bulletin disclosing the vulnerability, providing a patch, and sharing indicators of compromise observed during incident response. Attackers leveraged a Python-based exploit script, referred to as 'exp.py', which automates the exploitation process by interacting with specific endpoints in Oracle E-Business Suite. The script initiates by sending a GET request to '/OA_HTML/runforms.jsp' to determine the internal host, followed by a POST request to '/OA_HTML/JavaScriptServlet' to retrieve a CSRF token required for further exploitation. The final exploit request is sent to '/OA_HTML/configurator/UiServlet', with a crafted payload designed to trigger the vulnerability.
Analysis of attack logs reveals that the initial exploitation is followed by the dropping of malicious template files onto the target system. These templates are then activated by previewing them, which triggers further malicious activity. Apache logs from compromised systems show a sequence of GET and POST requests to endpoints such as '/OA_HTML/OA.jsp?page=/oracle/apps/xdo/oa/template/webui/TemplateCopyPG' and '/OA_HTML/OA.jsp?page=/oracle/apps/xdo/oa/template/webui/TemplateFileAddPG', indicating the deployment and activation of these templates. Two distinct types of malicious templates have been identified. The first type contacts a hardcoded command-and-control (C2) IP address and executes arbitrary Java code within the context of the Oracle WebLogic server, allowing attackers to maintain persistence without dropping additional files to disk. This template retrieves the HTTP response object, sends data back to the attacker, and establishes a connection to the C2 server using a custom protocol string, then loads and executes a Java class received from the C2 server after decrypting it.
The second template type embeds a Java class file directly within the template, which is decoded and executed upon activation. This template installs a backdoor that enables attackers to send specially crafted POST requests to a specific endpoint ('/support/state/content/destination./navId.1/navvSetId.iHelp/') to execute arbitrary Java code remotely. Both template types use base64 encoding to obfuscate their payloads, which are decoded and executed in memory, making detection and forensic analysis more challenging. The exploitation chain demonstrates a sophisticated understanding of Oracle E-Business Suite internals and leverages multiple stages to achieve code execution and persistence.
Oracle's response included the release of a patch and detailed indicators of compromise, such as specific HTTP request patterns and file artifacts, to aid defenders in identifying affected systems. Security researchers have provided in-depth technical analyses of the exploit script and the malicious templates, highlighting the importance of monitoring for unusual template file activity and suspicious HTTP requests in Oracle E-Business Suite environments. The attack underscores the critical need for organizations to apply security patches promptly and to monitor for signs of exploitation, especially in widely deployed enterprise applications like Oracle E-Business Suite. The use of in-memory execution and custom C2 protocols further complicates detection and response efforts. Organizations are advised to review Oracle's security bulletin, apply the provided patch, and search for the published indicators of compromise to ensure their environments are not affected by this active threat.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
On 2025-10-06, an independent researcher published a technical blog post titled "It's Java All The Way Down," apparently related to the same Oracle E-Business Suite exploitation topic. This represents additional public technical analysis emerging around the suspected CVE-2025-61882 exploit activity.
On 2025-10-06, SANS ISC published a quick analysis of a suspected exploit script targeting Oracle E-Business Suite and referencing CVE-2025-61882. The post indicates technical details of the suspected exploitation activity were being examined publicly.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Oracle E-Business Suite (EBS) was found to contain a critical zero-day vulnerability, tracked as CVE-2025-61884 and CVE-2025-61882, which allowed unauthenticated remote code execution and was actively exploited by threat actors, including the Clop ransomware group. The vulnerability, present in EBS versions 12.2.3 through 12.2.14, enabled attackers to access sensitive resources without authentication by exploiting a pre-authentication Server-Side Request Forgery (SSRF) flaw. Oracle released an out-of-band security update to address the issue, but did so without publicly acknowledging that the flaw was being actively exploited or that a proof-of-concept exploit had been leaked by the ShinyHunters extortion group. Security researchers and customers confirmed that the patch addressed the SSRF vulnerability used in the attacks. The exploit chain was complex, involving an unauthenticated HTTP POST to a specific servlet, manipulation of return_url parameters to trigger SSRF, CRLF/header injection, HTTP connection reuse, and ultimately the delivery of a malicious XSL stylesheet. This XSLT payload, containing embedded Java code, was processed by the server, leading to arbitrary code execution and the potential for attackers to spawn reverse shells. The Clop ransomware group sent extortion emails to Oracle EBS customers, claiming to have stolen sensitive data by exploiting this flaw, and confirmed their involvement in the campaign. The attack campaign was detected by Mandiant and Google, who observed that multiple threat actors were leveraging the vulnerability for data theft and extortion. The exploit chain demonstrated the risk of chaining multiple weaknesses in enterprise software to achieve full remote code execution. Security vendors, such as Imperva, responded by confirming protection for their customers against this exploit. The incident highlighted Oracle's lack of transparency regarding active exploitation and the public availability of exploit code. The technical details of the exploit, including SSRF, CRLF injection, and XSLT-based code execution, underscored the sophistication of the attack. The vulnerability's exploitation in the wild emphasized the importance of rapid patching and monitoring for signs of compromise in Oracle EBS environments. The campaign also illustrated the ongoing threat posed by ransomware and extortion groups targeting critical business applications. Organizations using Oracle EBS were urged to apply the security update immediately and review their systems for indicators of compromise. The incident raised concerns about the security of widely used enterprise resource planning (ERP) platforms and the need for proactive vulnerability management.
Jun 29, 2026
Oracle E-Business Suite (EBS) was found to contain a critical remote code execution (RCE) vulnerability, tracked as CVE-2025-61882, which has been actively exploited in the wild. The flaw resides in the Oracle Concurrent Processing component, specifically within the BI Publisher Integration, and carries a CVSS base score of 9.8 due to its unauthenticated and easily exploitable nature. Attackers can leverage this vulnerability to execute arbitrary code remotely without requiring valid credentials, posing a severe risk to organizations running affected EBS versions. Oracle confirmed that versions 12.2.3 through 12.2.14 are impacted by this vulnerability. The company released an emergency security update to address the issue, but customers must first apply the October 2023 Critical Patch Update before deploying the new fix. The vulnerability was exploited by the Clop ransomware group in a series of data theft attacks in August 2025, resulting in significant data exfiltration from multiple victims. Mandiant's CTO, Charles Carmakal, confirmed that Clop leveraged both this zero-day and other previously patched vulnerabilities in their campaign. Oracle's advisory included indicators of compromise that matched exploit details shared by threat actors on Telegram, highlighting the public availability of exploit information. The exploitation of this flaw underscores the importance of timely patch management, especially for business-critical applications like Oracle EBS. Oracle has urged all customers to prioritize the application of the latest patches to mitigate the risk of further exploitation. The incident demonstrates the increasing trend of ransomware groups targeting enterprise software vulnerabilities for large-scale data theft. Security researchers have emphasized the need for organizations to monitor for signs of compromise and to review their EBS deployments for unauthorized activity. The rapid release of a security alert and patch by Oracle reflects the urgency and severity of the threat posed by CVE-2025-61882. Organizations are advised to follow Oracle's remediation guidance closely and to remain vigilant for related threat activity. The incident has raised concerns about the security posture of widely used ERP platforms and the potential for future exploitation of similar vulnerabilities. The Clop attacks serve as a reminder that threat actors are adept at chaining multiple vulnerabilities to maximize impact. This event highlights the criticality of maintaining up-to-date security controls and monitoring for exploitation attempts targeting high-value enterprise systems.
Aug 31, 2026
Attackers are actively exploiting **CVE-2026-46817**, a critical `9.8` severity flaw in the Oracle Payments **File Transmission** component of **Oracle E-Business Suite**. The vulnerability affects EBS versions `12.2.3` through `12.2.15` and allows unauthenticated attackers with HTTP access to compromise confidentiality, integrity, and availability on vulnerable systems. Oracle addressed the issue in its May 2026 Critical Patch Update and urged customers to apply fixes immediately. Security researchers observed in-the-wild exploitation against Oracle EBS honeypots, including crafted `POST` requests to the `/OA_HTML/ibytransmit` endpoint with XML payloads abusing the `CODEX_PULL` transmission scheme. The activity reportedly attempted to read `/etc/passwd`, pointing to a local file read or path traversal exploitation chain, and occurred despite no known public proof-of-concept, suggesting private exploit tooling. Internet scanning data indicates more than **450** exposed Oracle EBS instances remain reachable, with attack activity recorded across multiple regions, including North America, Europe, and Asia.
Jul 12, 2026