CVE-2025-61882 (CVSS 9.8): Critical RCE Flaw in Oracle E-Business Suite

CVE-2025-61882 (CVSS 9.8) is described by Oracle as a critical remote code execution flaw in Oracle E-Business Suite that can be exploited remotely without authentication to run arbitrary commands on the server. According to the advisory, the vulnerability may be exploited over a network without the need for a username and password, risking full compromise of business-critical applications and data exfiltration.

The issue affects Oracle E-Business Suite versions 12.2.3 through 12.2.14, and an October 2023 Critical Patch Update is a prerequisite for applying the new fix, with Oracle urging customers to apply the updates as soon as possible. Oracle has issued a Security Alert and provided IOCs, including two malicious IP addresses, a reverse shell command, and three SHA-256 hashes observed in exploitation attempts.

The article notes claims that a group tied to the Cl0p ransomware gang has been sending extortion emails about stolen Oracle E-Business Suite data, with investigations by Mandiant and the Google Threat Intelligence Group ongoing.