CrowdStrike Warns of New Mass Exploitation Campaign Leveraging Oracle E-Business Suite 0-Day
A novel zero-day vulnerability in the Oracle E-Business Suite (EBS) , identified as CVE-2025-61882 , is currently being exploited in a widespread campaign.
A novel zero-day vulnerability in the Oracle E-Business Suite (EBS) , identified as CVE-2025-61882 , is currently being exploited in a widespread campaign.
First reported on August 9, 2025, this vulnerability allows unauthenticated remote code execution (RCE), enabling attackers to bypass authentication, deploy web shells, and extract sensitive information from EBS instances exposed to the internet.
CrowdStrike has indicated moderate confidence that the group known as GRACEFUL SPIDER is responsible for the mass exploitation, although evidence suggests other groups may also be involved.
On September 29, 2025, GRACEFUL SPIDER reportedly disseminated emails branded as Clop to various organizations, claiming successful data theft from Oracle EBS applications.
Following the proof-of-concept (POC) disclosure on October 3, 2025, and the subsequent release of an Oracle patch, information emerged suggesting collaboration among various threat actor groups. This included a post on Telegram alleging cooperation between SCATTERED SPIDER, SLIPPY SPIDER, and ShinyHunters .
The post referenced an EBS exploit with a SHA256 hash of 76b6d36e04e367a2334c445b51e1ecce97e4c614e88dfb4f72b104ca0f31235d and criticized GRACEFUL SPIDER's methods.
A novel zero-day vulnerability in the Oracle E-Business Suite (EBS) , identified as CVE-2025-61882 , is currently being exploited in a widespread campaign.
Oracle has incorporated this POC as an indicator of compromise (IOC) in their advisory, highlighting concerns over active exploitation.
Initial compromise often leverages Java Servlets, with the exploit commencing via an HTTP POST request to /OA_HTML/SyncServlet, allowing authentication bypass. Attackers have been seen utilizing administrative account privileges within EBS systems.
Subsequent actions involve targeting the XML Publisher Template Manager through specific GET and POST requests to upload malicious XSLT templates. Execution occurs upon preview, leading to further exploitation.
Successful template execution results in outbound connections via port 443 to attacker-controlled infrastructure, facilitating the deployment of web shells. This typically involves a two-step process: initially loading FileUtils.java, followed by a secondary backdoor, Log4jConfigQpgsubFilter.java.
The backdoor operates through a doFilter chain at the public endpoint /OA_HTML/help/state/content/destination./navId.1/navvSetId.iHelp/, enabling command execution and persistence.
Organizations are advised to apply the Oracle patch released on October 4, 2025, immediately. Additional steps include auditing outbound connections for suspicious activity, reviewing xdo_templates_vl for unauthorized templates, investigating icx_sessions for anomalies in UserID 0 and UserID 6, and deploying web application firewalls to secure exposed EBS services.
Monitoring Java process behaviors in alignment with published Falcon LogScale and SIEM detection rules can further reduce ongoing exploitation risks.
Based on reporting by Cyber Security News.