Oracle EBS Zero-Day (CVE-2025-61882) Under Active RCE Exploitation by GRACEFUL SPIDER

According to CrowdStrike, Oracle EBS CVE-2025-61882 is a remote code execution vulnerability that is being exploited in a mass campaign against Oracle E-Business Suite applications to exfiltrate data. The campaign began around 9 August 2025, with exploitation attempts observed, and by late September GRACEFUL SPIDER was directly contacting victims and claiming intrusions.

On 29 September 2025, GRACEFUL SPIDER emailed multiple organisations claiming they had accessed and exfiltrated data from the victim’s Oracle EBS applications. The exploitation chain starts with an HTTP POST to /OA_HTML/SyncServlet, causing an authentication bypass, after which attackers target Oracle XML Publisher’s Template Manager to upload and execute a malicious XSLT template via GET and POST requests to /OA_HTML/RF.jsp and /OA_HTML/OA.jsp.

The malicious template triggers outbound connections from the Oracle web server to attacker-controlled infrastructure, typically on port 443, enabling deployment of web shells such as FileUtils.java and Log4jConfigQpgsubFilter.java for memory-resident persistence. CrowdStrike notes the October 3, 2025 PoC leak has raised threat levels, and immediate patching and network monitoring are advised.