Exploitation of Oracle EBS Zero-Day Started 2 Months Before Patching

According to SecurityWeek, the Oracle E-Business Suite zero-day CVE-2025-61882 was exploited in the wild well before patching, with CrowdStrike noting that attacks began at least as early as August and continuing after Oracle’s patch in July and the confirmation of the zero-day on 4 October 2025. The flaw affects the BI Publisher Integration component of Oracle Concurrent Processing and allows remote code execution by an unauthenticated attacker, with a CVSS score of 9.8.

Observed activity ties the campaigns to Cl0p, and CrowdStrike has associated the intrusions with a Russia-linked actor it tracks as Graceful Spider, though it also suggests multiple groups may be involved. The report notes that over 2,000 internet-exposed Oracle E-Business Suite instances were seen by Censys, with Shadowserver identifying more than 570 potentially vulnerable instances, the United States hosting the largest share followed by China.

PoC exploits have been published by ShinyHunters and Scattered Spider (now Scattered LAPSUS$ Hunters), and were used to demonstrate pre-authenticated remote code execution. Written by Eduard Kovacs, the piece highlights the ongoing risk as other threat actors may add CVE-2025-61882 to their arsenals.