CVE-2025-61882: the unauthenticated Oracle EBS pre-auth RCE that Cl0p turned into a data-theft campaign

CVE-2025-61882 lets an attacker who can merely reach your Oracle E-Business Suite web tier run code on it -- no login, no user interaction. It is not theoretical: it powered a mass data-theft and extortion campaign that named victims including The Washington Post, GlobalLogic, Harvard, and Dartmouth. This is the full breakdown -- the chain, who is affected, the in-the-wild story, and exactly what to do.

What CVE-2025-61882 actually is

The bug lives in Oracle E-Business Suite, product Oracle Concurrent Processing, component BI Publisher Integration, and affects EBS 12.2.3 through 12.2.14. NVD labels it CWE-287 (Improper Authentication), but that single label hides a multi-stage chain: two public analyses describe two different pre-auth paths that both end at the same place.

watchTowr documented a five-bug chain via /OA_HTML/configurator/UiServlet: SSRF -> CRLF injection -> HTTP keep-alive smuggling -> a /OA_HTML/help/../ auth-filter bypass -> XSLT RCE. Google/Mandiant and CrowdStrike documented the path used in the live Cl0p campaign: unauthenticated POST /OA_HTML/SyncServlet plants a malicious template in the XDO Template Manager, then it is triggered via TemplatePreviewPG. In both, a malicious XSL stylesheet abuses Java extension functions (ScriptEngineManager + eval) to run commands as the EBS OS user.

The exploitation chain

From a single unauthenticated request to stolen data and extortion. Each stage below has a defensive chokepoint -- the cheapest is the first one: take the web tier off the public internet.

Am I affected?

Oracle lists EBS 12.2.3 through 12.2.14 (Oracle Concurrent Processing). The fix is the out-of-band patch of 4 October 2025 -- but mind two gotchas: it requires the October 2023 Critical Patch Update already installed as a baseline, and you must also apply CVE-2025-61884 (patched 11 October 2025), because watchTowr showed the SSRF entry point still worked after the 61882 fix alone. The table below is the at-a-glance risk picture.

Exploited in the wild

Google/Mandiant traced the earliest suspicious traffic to 10 July 2025 and widespread exploitation to 9 August 2025 -- the attacker exfiltrated data quietly for weeks before launching a mass executive extortion-email campaign on 29 September 2025. Oracle's emergency patch followed on 4 October, CISA added it to KEV on 6 October, and a working exploit had already leaked on 3 October. Confirmed victims include The Washington Post (9,720 people), GlobalLogic/Hitachi (~10,471), Harvard, Dartmouth, and Envoy Air.

Detection & hunting

Because this ran as a zero-day with months of dwell time, hunt for prior compromise, not just live attempts. ProjectDiscovery ships an official Nuclei template (CVE-2025-61882) for exposure scanning, and the campaign's behaviour supports high-fidelity log and database hunts. The single highest-fidelity indicator: any TemplatePreviewPG request whose TemplateCode begins with TMP or DEF followed by 16 hex characters.

• Access logs: unauth POST /OA_HTML/SyncServlet and /OA_HTML/configurator/UiServlet; /OA_HTML/RF.jsp; /OA_HTML/help/../ path traversal.
• Web shell: requests to /OA_HTML/help/state/content/destination./navId.1/navvSetId.iHelp/ (and the /support/state/... SAGEWAVE variant).
• Database: rows in XDO_TEMPLATES_B / XDO_LOBS with TEMPLATE_CODE like TMP% or DEF%, and icx_sessions with UserID 0 (sysadmin) or 6 (guest) -- focus on anything created after 10 July 2025.
• Host: the Java (applmgr) process spawning bash -i shells or recon commands, and unexpected outbound 443 to attacker infrastructure (e.g. 200.107.207.26, 161.97.99.49).

# PROPOSED, NOT OFFICIAL - the high-fidelity CVE-2025-61882 IoC on OHS/WebLogic access logs
title: Oracle EBS CVE-2025-61882 XDO TemplatePreview Exploitation (TemplateCode TMP/DEF)
status: experimental
logsource:
  category: webserver          # OHS / WebLogic oacore access log, OA_HTML zone
detection:
  selection_preview:
    cs-uri-query|contains: 'TemplatePreviewPG'
  selection_code:
    cs-uri-query|re: 'TemplateCode=(TMP|DEF)[A-Fa-f0-9]{16}'
  condition: selection_preview and selection_code
fields: [c-ip, cs-user-agent, cs-uri-stem, cs-uri-query, sc-status]
level: critical

What to do now

1. Patch both CVEs. Apply the 4 Oct 2025 emergency patch for CVE-2025-61882 (it needs the Oct-2023 CPU baseline first) and the 11 Oct patch for CVE-2025-61884. Verify with AD_PATCH.IS_PATCH_APPLIED and ad_adop_session_patches.
2. If you cannot patch immediately, take /OA_HTML off the public internet and WAF-block the entry endpoints and TemplateCode=TMP**/DEF.
3. Assume breach if you were exposed since ~July 2025. Run the database and web-shell hunts above; a planted backdoor survives the patch.
4. Rotate every secret the app tier could reach -- DB/APPS passwords, EBS dbc/wallet secrets, and integration credentials. Patching does not undo stolen data.
5. Prepare for extortion/disclosure. If data was taken, Cl0p emails executives and names victims publicly; align legal, comms, and regulatory notification early.

FAQ

Sources

• NVD -- CVE-2025-61882
• Oracle Security Alert -- CVE-2025-61882
• Google Cloud / Mandiant (GTIG) -- Oracle EBS zero-day exploitation
• watchTowr Labs -- the pre-auth RCE chain
• CrowdStrike -- campaign targeting the EBS zero-day
• Rapid7 -- ETR: critical 0-day in Oracle EBS
• BleepingComputer -- Oracle silently fixes leaked zero-day exploit