Skip to main content
kcheung
Staff
kcheung
Staff
October 30, 2025

FortiGuard Outbreak Alert: Oracle E-Business Suite RCE Zero-day

  • October 30, 2025
  • 0 replies
  • 206 views
Description

Oracle E-Business Suite is an integrated set of enterprise applications for automating and managing core business operations.


Cl0p ransomware group is seen actively exploiting CVE-2025-61882 in Oracle E-Business Suite.


CVE-2025-61882 is a remote code execution (RCE) vulnerability in Oracle E-Business Suite specifically in the Concurrent Processing component (BI Publisher Integration).

 

An unauthenticated attacker can send a crafted request to run arbitrary code and take complete control of affected systems.


The following versions of Oracle E-Business Suite are vulnerable to CVE-2025-61882:

  • 12.2.3 ≤ Version ≤ 12.2.14
CVE ID    

CVE-2025-61882 (https://nvd.nist.gov/vuln/detail/CVE-2025-61882)

NDR Cloud Detection Rule

FortiNDR Cloud v25.3c+

Detection Rule Name

Category

Primary MITRE ID

 FortiGuard Outbreak Alert: Oracle E-Business Suite Remote Code Injection - CVE-2025-61882

Attack: Exploitation

T1190 - Exploit Public-Facing Application
Playbook 

N/A

Threat Hunting

 FortiNDR Cloud users can use the following IOCs from Fortinet to hunt for "Oracle E-Business Suite RCE Zero-day" related activities.
IOC source: https://www.fortiguard.com/outbreak-ioc?tag=Oracle%20E-Business%20Suite%20RCE
All IOCs relating to "Oracle E-Business Suite RCE Zero-day" have been added to Threat Intelligence Intel.

Suricata Coverage

 Customers can create custom investigation/detections using the Suricata signatures below:
2065105 -> ET WEB_SERVER Oracle E-Business Suite (EBS) Unauthenticated Server-Side Request Forgery (CVE-2025-61882)
2065106 -> ET WEB_SERVER Oracle E-Business Suite (EBS) CRLF Injection (CVE-2025-61882)
2065107 -> ET WEB_SERVER Oracle E-Business Suite (EBS) Authentication Filter Bypass (apps. example. com) (CVE-2025-61882)
2065108 -> ET WEB_SERVER Oracle E-Business Suite (EBS) XSL Transformation Outbound Fetch (CVE-2025-61882)

Other Fortinet Products

 For more details regarding mitigating the vulnerability by utilizing Fortinet products, please refer to:
https://www.fortiguard.com/outbreak-alert/oracle-e-business-suite-rce
Terms & ConditionsAccessibility statement