VORANT. Threat Intelligence Sign in Get the full feed

Oracle EBS RCE flaw exploited in wild

critical vulnerability

CVE-2025-61882, a remote code execution vulnerability in Oracle E-Business Suite versions 12.2.3-12.2.14, is being actively exploited to compromise Oracle Concurrent Processing.

Oracle E-Business Suite contains a critical remote code execution vulnerability (CVE-2025-61882) affecting versions 12.2.3 through 12.2.14. The flaw allows unauthenticated attackers with network access via HTTP to compromise Oracle Concurrent Processing, resulting in complete system takeover. Oracle has confirmed active exploitation in the wild.

Successful exploitation enables attackers to execute arbitrary code within the context of the affected component, allowing them to install malware, manipulate or exfiltrate data, and establish persistent access through new privileged accounts. The vulnerability requires no authentication and can be exploited remotely over HTTP, making it highly accessible to threat actors.

Immediate patching is critical for all organizations running affected Oracle EBS versions. The MS-ISAC recommends implementing compensating controls including network segmentation, vulnerability scanning, and exploit protection features while patches are being tested and deployed.

Mentioned in this report

Vulnerabilities CVE-2025-61882KEV

Detection guidance

Suspicious Child Process from Oracle EBS/Java Web Application Process

ATT&CK T1190

Detects command/script interpreter processes spawned by Java or Oracle EBS concurrent processing components, consistent with post-exploitation of CVE-2025-61882 RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process from Oracle EBS/Java Web Application Process
id: ef600756-63be-508a-b496-f3e790207136
status: experimental
description: Detects cmd.exe, powershell.exe, sh, or bash spawned directly from java.exe
  or Oracle EBS/Concurrent Processing related processes, indicating possible exploitation
  of an unauthenticated RCE vulnerability such as CVE-2025-61882.
references:
- https://www.cisa.gov (Oracle EBS CVE-2025-61882 advisory)
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    - \perl.exe
    - \FNDCPESR.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \sh.exe
    - \bash.exe
    - \wscript.exe
    - \cscript.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate administrative scripts or scheduled batch jobs invoked by custom EBS
  concurrent programs
- Third-party monitoring agents that shell out from Java-based management consoles
level: high
tags:
- attack.t1190
- attack.execution
author: Vorant

Web Server Process Spawning Shell on Linux Host Running Oracle EBS

ATT&CK T1190

Detects shell or interpreter processes spawned by Java/WebLogic processes typical of Oracle E-Business Suite application tier, indicative of exploitation of an unauthenticated RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Spawning Shell on Linux Host Running Oracle EBS
id: d357ac1a-2d21-518c-80cd-853340c5fc00
status: experimental
description: Detects shell interpreters (sh, bash, python, perl) spawned as children
  of java or WebLogic-related processes on Linux hosts, consistent with exploitation
  of Oracle EBS CVE-2025-61882 to gain remote code execution.
references:
- https://www.cisa.gov (Oracle EBS CVE-2025-61882 advisory)
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /java
    - /startWebLogic.sh
    - /beasvc
  selection_child:
    Image|endswith:
    - /bin/sh
    - /bin/bash
    - /bin/dash
    - /usr/bin/python
    - /usr/bin/python3
    - /usr/bin/perl
  condition: selection_parent and selection_child
falsepositives:
- Legitimate administrative or deployment scripts executed by WebLogic management
  processes
- Scheduled maintenance jobs invoked through Java-based schedulers
level: high
tags:
- attack.t1190
- attack.execution
author: Vorant

New Privileged Local Account Creation Following Web Application Exploitation

ATT&CK T1190

Detects creation of a new local user account shortly after suspicious activity from a web/application server process, consistent with post-exploitation persistence following Oracle EBS RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: New Privileged Local Account Creation Following Web Application Exploitation
id: e346d247-e73e-517c-b276-318841f9e0f0
status: experimental
description: Detects use of net.exe or useradd/usermod commands to create or elevate
  a local account, spawned from a Java or web application server process context,
  which may indicate persistence established after exploiting an unauthenticated RCE
  such as CVE-2025-61882.
references:
- https://www.cisa.gov (Oracle EBS CVE-2025-61882 advisory)
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
    - \w3wp.exe
    - \httpd.exe
  selection_cmd:
    CommandLine|contains:
    - net user
    - net localgroup administrators
    - useradd
    - usermod -aG
  condition: selection_parent and selection_cmd
falsepositives:
- Automated provisioning or IT helpdesk tools that create accounts via scripted web
  interfaces
- Legitimate administrative scripts executed through custom web-based management consoles
level: medium
tags:
- attack.t1190
- attack.persistence
- attack.t1136
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-oracle-e-business-suite-could-allow-for-remote-code-execution_2025-093

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free