Inkmoro

**Name of the Vulnerable Software and Affected Versions** Oracle E-Business Suite versions 12.2.3 through 12.2.14 **Description** An unauthenticated remote code execution flaw exists in the BI Publisher Integration component of the Oracle Concurrent Processing product. An attacker with network access via HTTP can send specially crafted requests to the `/OA HTML/RF.jsp` and `/OA HTML/OA.jsp` endpoints to upload a malicious XSLT template. When this template is previewed, it executes embedded commands, allowing the attacker to deploy a web shell and take full control of the system. This issue has been exploited in the wild by threat actors such as Cl0p, Scattered LAPSUS$ Hunters, and GRACEFUL SPIDER. Real-world impacts include the theft of terabytes of sensitive corporate, financial, and employee data from over 100 organizations, including Harvard University, The Washington Post, Logitech, and Korean Air, where approximately 30,000 employee records were compromised. **Recommendations** Apply Oracle security updates for versions 12.2.3 through 12.2.14 immediately. As a temporary mitigation, restrict network access to the `/OA HTML/RF.jsp` and `/OA HTML/OA.jsp` endpoints to minimize the risk of exploitation.