CrowdStrike Alerts on Oracle E-Business Suite 0-Day Under Mass Exploitation

According to CrowdStrike Intelligence, a novel zero-day vulnerability in Oracle E-Business Suite (CVE-2025-61882) is being actively exploited in a mass data exfiltration campaign, with primary involvement attributed to the GRACEFUL SPIDER threat group and warnings that public PoC details could spur further attacks.

The first suspected exploitation emerged on 9 August 2025, with Oracle E-Business Suite exposed to unauthenticated remote code execution, and by 29 September 2025 GRACEFUL SPIDER operatives had emailed multiple organisations claiming access to data. On 3 October 2025 a Telegram channel post appeared to weaponise the exploit, insinuating collaboration among SCATTERED SPIDER, SLIPPY SPIDER, and ShinyHunters, including a SHA256 hash associated with the PoC.

Oracle’s security advisory later published the same PoC as an indicator of compromise, underscoring in-the-wild exploitation, and while CrowdStrike cannot rule out multiple threat actors, the observed patterns align with the PoC and GRACEFUL SPIDER’s methods. Oracle disclosed CVE-2025-61882 on 4 October 2025, describing an unauthenticated RCE vulnerability and detailing the exploit chain involving specific HTTP endpoints and the deployment of web shells for persistence and command execution.