CrowdStrike ties Oracle EBS RCE (CVE-2025-61882) to Cl0p attacks began Aug 9, 2025

According to CrowdStrike, researchers linked Oracle E-Business Suite RCE CVE-2025-61882 to Cl0p, with the first known exploitation dating from 9 August 2025 and a CVSS of 9.8. The flaw allows unauthenticated remote code execution and has been used in data-theft attacks against Oracle E-Business users, exposing the Oracle Concurrent Processing component to compromise.

CrowdStrike notes that the disclosure of a proof-of-concept on 3 October and Oracle’s late-September patch will almost certainly spur threat actors familiar with Oracle EBS to develop weaponised PoCs and target Internet-exposed instances. Oracle subsequently issued an emergency patch, and CISA added CVE-2025-61882 to its Known Exploited Vulnerabilities catalog, with agencies ordered to fix the flaw by 27 October 2025.

The campaign reportedly uses a server-side chain involving SSRF and CRLF injection to fetch and execute malicious XSLT payloads, installing web shells for command execution and persistence. In some cases, attackers have used dual files to facilitate backdoor access, allowing commands to run in memory without writing to disk.