CVE-2025-61882

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.2.3 through 12.2.14

Description An unauthenticated remote code execution flaw exists in the BI Publisher Integration component of Oracle Concurrent Processing. The issue stems from authentication and authorization deficiencies, allowing an attacker to compromise the system by sending specially crafted HTTP requests. Specifically, the exploitation targets the XML Publisher Template Manager via the /OA HTML/RF.jsp and /OA HTML/OA.jsp endpoints. Attackers can upload a malicious XSLT template that executes embedded commands when previewed, enabling the deployment of web shells and backdoors.

Real-world exploitation has been attributed to threat actors including Cl0p, Scattered LAPSUS$ Hunters, and GRACEFUL SPIDER. It is estimated that over 40 organizations have been confirmed as victims, with potentially more than 100 affected. Notable victims include Harvard University, The Washington Post, Logitech, and Korean Air. These attacks primarily focused on the massive theft of corporate financial data, intellectual property, and employee records for extortion purposes.

Recommendations Apply Oracle's security updates for versions 12.2.3 through 12.2.14 immediately. Restrict access to the /OA HTML/RF.jsp and /OA HTML/OA.jsp endpoints to minimize the risk of exploitation.