---
title: Oracle EBS flaw exploited in active ransomware campaigns
description: CISA adds Oracle E-Business Suite flaw CVE-2025-61882 to KEV list. Actively exploited in ransomware campaigns—patch now to prevent remote code execution.
---

[Blog, News & Press Releases - Field Effect ](https://fieldeffect.com/blog)

# [Oracle EBS flaw exploited in active ransomware campaigns](https://fieldeffect.com/blog/oracle-ebs-flaw-exploited-active-ransomware-campaigns)

 Written by [Field Effect Security Intelligence Team](https://fieldeffect.com/blog/author/field-effect-security-intelligence-team) | Oct 8, 2025 8:14:43 PM

On October 6, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) [added](https://www.cisa.gov/news-events/alerts/2025/10/06/cisa-adds-seven-known-exploited-vulnerabilities-catalog) CVE-2025-61882 to its Known Exploited Vulnerabilities (KEV) catalog. The Canadian Centre for Cyber Security also issued a [threat advisory](https://www.cyber.gc.ca/en/alerts-advisories/al25-013-vulnerability-impacting-oracle-e-business-suite-cve-2025-61882) on the flaw.

Following our [recent blog from October 2](https://fieldeffect.com/blog/extortion-campaign-oracle-ebs-data-theft) on the extortion campaign targeting Oracle E-Business Suite (EBS) users, researchers have reported a significant escalation in the targeting of the software.

The activity intensified after Oracle released [an out-of-band patch](https://www.oracle.com/security-alerts/alert-cve-2025-61882.html#AppendixEBS) on October 4, 2025, disclosing [CVE-2025-61882](https://nvd.nist.gov/vuln/detail/CVE-2025-61882). The flaw affects EBS versions 12.2.3 through 12.2.14, and carries a CVSS score of 9.8. It allows unauthenticated remote code execution by exploiting what appears to be a chain of a number of distinct issues.

Evidence suggests that exploitation began as early as August 9, 2025, and has since evolved into multiple active campaigns. Some researchers [attribute the activity](https://www.securityweek.com/exploitation-of-oracle-ebs-zero-day-started-2-months-before-patching/) to the Cl0p ransomware group, while others have observed signs of collaboration or code-sharing with groups such as Scattered Spider, LAPSUS$, and ShinyHunters.

Researchers also reported the availability of [proof-of-concept (PoC) code](https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/), which significantly lowers the barrier for exploitation.

## Analyst insight

Oracle E-Business Suite is a widely deployed enterprise resource planning (ERP) platform used across finance, supply chain, and HR functions. Its exposure to the internet and integration with critical business processes make it a high-value target.

Organizations running Oracle EBS are advised to:

- Apply the latest patch immediately
- Isolate internet-facing EBS instances or protect them with strict access controls
- Hunt for indicators of compromise, including: 
    - Reverse shell activity
    - Unauthorized access to /OA_HTML/SyncServlet and related endpoints
    - Outbound connections over port 443 from EBS servers
- Review logs for suspicious HTTP requests and unusual template preview activity

Given the active exploitation and extortion attempts, rapid response and containment are critical.

[View full post](https://fieldeffect.com/blog/oracle-ebs-flaw-exploited-active-ransomware-campaigns)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Field Effect Security Intelligence Team"
  },
  "dateModified" : "2025-10-08T20:14:43.019Z",
  "datePublished" : "2025-10-08T20:14:43Z",
  "headline" : "Oracle EBS flaw exploited in active ransomware campaigns",
  "image" : {
    "@type" : "ImageObject",
    "height" : 1353,
    "url" : "https://8376691.fs1.hubspotusercontent-na1.net/hubfs/8376691/Website-Blog/Blog-Thumb-Threat-Brief_01.jpg",
    "width" : 2400
  },
  "mainEntityOfPage" : "https://fieldeffect.com/blog/oracle-ebs-flaw-exploited-active-ransomware-campaigns",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Blog"
  }
}
```