Skip to content
Hermes Codex

CVE-2025-61882: Zero-Day RCE in Oracle E-Business Suite (BI Publisher / Concurrent Processing)

HERMES

HERMES THREAT SCORE & ENTERPRISE RESOURCE PLANNING CORE

Target: Oracle E-Business Suite (Oracle Concurrent Processing / BI Publisher Integration)
Confidence: 99%
98 / 100
CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 20 / 20
Threat Activity 20 / 20
Weaponization 20 / 20
Exposure 18 / 20
Prevalence 19 / 20
Impact 20 / 20
Exploit Maturity 20 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

Hermes assesses CVE-2025-61882 at an HTS of 98 (CRITICAL). This zero-day vulnerability in Oracle EBS was weaponized in mass campaigns by threat actor GRACEFUL SPIDER (associated with Clop). The attack chain couples an authentication bypass on SyncServlet with malicious XSLT template injection in BI Publisher to siphon core enterprise databases.

🕸️ Connected Knowledge Graph & Provenance

CVE-2025-61882: Zero-Day RCE in Oracle E-Business Suite (BI Publisher / Concurrent Processing)VULNERABILITY

Connected Nodes: 1
Active Relationships (Outgoing)
→ usesATTACK TECHNIQUET1059: Command and Scripting Interpreter
90% VERY_HIGH

Adversaries abuse command and script interpreters (Bash, Python, PowerShell) to execute arbitrary commands.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1059.”

Supporting Verified Evidence:

1. Identification

Section titled “1. Identification”
ParameterTechnical SpecificationOperational Impact
CVE IdentifierCVE-2025-61882Oracle Security Alert October 2025
Impacted ComponentOracle Concurrent Processing / BI Publisher IntegrationEnterprise ERP reporting and document processing
CVSS v3.1 Score9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Applicable CPEscpe:2.3:a:oracle:e-business_suite:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:concurrent_processing:*:*:*:*:*:*:*:*		Oracle E-Business Suite deployments
Affected Versions12.2.3 through 12.2.14All HTTP-accessible Oracle EBS installations
Fixed VersionsOracle Security Alert CVE-2025-61882 Patch (October 2025)Emergency out-of-band security patch

2. Exploitation

Section titled “2. Exploitation”
  • CISA KEV: Added on October 6, 2025; confirmed active ransomware campaign involvement (KnownRansomwareCampaignUse = Known).
  • EPSS Score: 0.99732 (Percentile: 99.95%).
  • Threat Actors: GRACEFUL SPIDER (Clop / TA505 extortion operations), with exploit tooling discussions observed across Telegram channels associated with SCATTERED SPIDER / ShinyHunters.
  • Exploit Mechanics:
    1. POST request to /OA_HTML/SyncServlet bypasses authentication and fabricates an administrative session.
    2. Requests to /OA_HTML/RF.jsp and /OA_HTML/OA.jsp upload a weaponized XSLT template into the XML Publisher Template Manager.
    3. Previewing the malicious template executes commands within the Java web server context and establishes outbound egress over port 443.
  • Public Exploit Hash: 76b6d36e04e367a2334c445b51e1ecce97e4c614e88dfb4f72b104ca0f31235d.

3. Detection and Forensics

Section titled “3. Detection and Forensics”

Sigma Rule

Section titled “Sigma Rule”
title: Oracle EBS SyncServlet Auth Bypass and XSLT Template RCE (CVE-2025-61882)
id: 61882-oracle-ebs-rce-en
status: production
description: Detects authentication bypass requests to SyncServlet and malicious template uploads in Oracle EBS.
logsource:
  category: webserver
  product: oracle_ebs
detection:
  selection_auth:
    cs-method: 'POST'
    cs-uri-stem|contains: '/OA_HTML/SyncServlet'
  selection_upload:
    cs-uri-stem|contains:
      - '/OA_HTML/RF.jsp'
      - '/OA_HTML/OA.jsp'
  condition: selection_auth or selection_upload
level: critical

Database Investigation Query

Section titled “Database Investigation Query”
SELECT template_code, template_name, creation_date, last_updated_by
FROM xdo_templates_vl
WHERE creation_date > TRUNC(SYSDATE) - 60
ORDER BY creation_date DESC;

MITRE ATT&CK

Section titled “MITRE ATT&CK”
  • T1190: Exploit Public-Facing Application
  • T1059: Command and Scripting Interpreter
  • T1505.003: Web Shell
  • T1567: Exfiltration Over Web Service

4. Remediation and Hardening

Section titled “4. Remediation and Hardening”
  1. Apply Security Alert Patch: Immediately apply Oracle’s October 2025 security advisory update.
  2. Audit Template Tables: Collaborate with database administrators to query xdo_templates_vl and purge unauthorized templates.
  3. Isolate ERP Systems: Remove direct internet exposure from Oracle EBS applications using secure VPN tunnels and WAF inspection.

5. Enterprise Exploitation Scenario

Section titled “5. Enterprise Exploitation Scenario”

« What happens if this vulnerability is exploited in an enterprise? »

Section titled “« What happens if this vulnerability is exploited in an enterprise? »”
  1. Crown Jewel Breach: Threat actors from the GRACEFUL SPIDER syndicate exploit the /OA_HTML/SyncServlet endpoint to bypass authentication and gain full administrative control over the Oracle EBS application.
  2. Underlying Host Takeover: The adversary uploads a malicious XSLT template to XML Publisher, achieving remote command execution under the Java application runtime (oacore).
  3. Mass Enterprise Exfiltration: The attackers dump the entirety of the corporate ERP database, containing financial ledgers, customer credit information, payroll archives, and supplier invoices.
  4. Double Extortion Campaign: The enterprise is hit with extortion demands, threatening public leakage of sensitive records and regulatory non-compliance penalties unless a multi-million-dollar ransom is paid.