Oracle EBS Under Fire as Cl0p Exploits CVE-2025-61882 in Real-World Attacks

CrowdStrike, according to CrowdStrike, attributes the exploitation of CVE-2025-61882 in Oracle E-Business Suite to a threat actor it tracks as Graceful Spider (aka Cl0p) with moderate confidence, noting that the first known exploitation occurred on 9 August 2025. CVE-2025-61882 is described as a critical remote code execution vulnerability that can be exploited without authentication and carries a CVSS score of 9.8.

The article also discusses a Telegram channel that circulated an exploit claim and discusses possible links to other groups, but notes that it is not known how the exploit was obtained or whether those groups have weaponized it in real-world attacks. CrowdStrike’s analysis is complemented by WatchTowr Labs, which described a chain of at least five bugs leading to pre-authenticated remote code execution, including an SSRF and CRLF injection sequence culminating in loading a malicious XSLT template.

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-61882 to the KEV catalog, with a note that it has been used in ransomware campaigns and a patch deadline of 27 October 2025. The piece quotes Jake Knott of WatchTowr, warning Oracle EBS users to patch immediately, hunt aggressively, and tighten controls.