Oracle E-Business Suite / Cl0p - Unauthenticated XSLT Injection → Server-Side RCE → Two Months of Silent Zero-Day → Executive Email Extortion
CVE-2025-61882 is an unauthenticated remote code execution flaw in Oracle E-Business Suite, CVSS 9.8, reachable without any credential. The Cl0p extortion crew began exploiting it as a zero-day around August 2025; Oracle published its security alert and emergency patch on October 4, and CISA added the flaw to its Known Exploited Vulnerabilities catalog two days later. That gap is the story. For roughly two months, organizations running a fully patched, fully supported ERP system were being emptied of data with no advisory to act on and no patch to apply, and the first many of them heard about it was an extortion email addressed to their executives. This chain is the counterweight to most of the identity-driven incidents on this page: no credential was stolen, no employee was tricked, and no token was forged. Cl0p's model is industrial - acquire or find an unauthenticated flaw in software deployed at thousands of large enterprises, harvest quietly at scale, then monetize months later through email extortion and a leak site, without ever deploying ransomware.
Before any of this was a security advisory it was a listing. In June 2025, posts on criminal forums offered an Oracle EBS zero-day at around seventy thousand dollars. Set that number against what it produced - data theft from many large enterprises and extortion demands sized to their revenue - and the economics are stark: an unauthenticated flaw in widely deployed enterprise software is one of the highest-return purchases available to a crew like Cl0p, and the price is trivial against the payoff. The public existence of a listing also matters for defenders as a timing signal. Threat-intelligence coverage of exploit markets is not academic; it is occasionally the only warning that exists during the window when no patch does.
August 2025: Cl0p begins exploitation in the wild
Economics: A five-figure purchase against extortion demands sized to enterprise revenue
Defender relevance: Exploit-market intelligence is sometimes the only pre-patch warning available
Everything that makes this severe is contained in the word unauthenticated. There is no phishing step, no credential to steal, no MFA to defeat and no insider to recruit - reaching the endpoint over the network is the entire prerequisite. The vulnerable component is Oracle Concurrent Processing, associated with the BI Publisher Integration, reached through EBS configuration endpoints in the configurator and UiServlet flow. Affected versions run from 12.2.3 through 12.2.14, which is to say essentially the supported 12.2 line rather than some neglected legacy release. The organizations hit here were not running unsupported software. They were running current, patched, vendor-supported ERP, and that was not sufficient because the vendor did not yet know.
Component: Oracle Concurrent Processing, via the BI Publisher Integration
Entry point: EBS configuration endpoints - the configurator / UiServlet flow
Affected: Oracle E-Business Suite 12.2.3 through 12.2.14
Prerequisites: Network reachability. No credential, no user interaction
Runtime.getRuntime().exec()The chain is a good teaching example because no single link is exotic; the exploit is assembled from ordinary enterprise-Java behaviour. First, server-side request forgery: the payload points at a stylesheet URL and the EBS server obediently fetches it from attacker infrastructure. Second, XSLT injection: the server-side transformation engine processes that stylesheet as instructions rather than data. Third, the transformation instantiates a Java ScriptEngine and evaluates Base64-encoded JavaScript embedded in the stylesheet. Fourth, that JavaScript reaches java.lang.Runtime.getRuntime().exec(...) and runs operating-system commands as the application user. Four legitimate features, each individually documented, composing into unauthenticated remote code execution. Notice also that step one requires the server to make an outbound connection - which is precisely why egress filtering on an ERP host is not paranoia.
Link 2: XSLT injection - the stylesheet is processed as instructions, not data
Link 3: A Java ScriptEngine evaluates Base64-encoded JavaScript from the stylesheet
Link 4:
java.lang.Runtime.getRuntime().exec(...) executes OS commandsControl that breaks link 1: Egress filtering, so the server cannot fetch the stylesheet at all
Cl0p's target selection is not accidental. An ERP is the system an enterprise deliberately consolidates its most sensitive records into: employee personal data and payroll, financial reporting, supplier contracts and pricing, customer information. One foothold therefore yields a collection that is simultaneously regulated, commercially sensitive and personally identifiable - which is exactly the combination that makes an extortion demand credible without any need to encrypt a thing. This is also why the "crown jewels" framing in a data-classification exercise has to survive contact with reality: the ERP is usually on that list, and just as usually reachable from the internet because a supplier portal or a remote finance team needs it.
Why the target: Enterprises consolidate their most sensitive records into ERP by design
Extortion leverage: Regulated, commercially sensitive and personally identifiable, all at once
Recurring tension: The crown-jewel system is also the one with the internet-facing portal
There is no dramatic moment in a Cl0p intrusion. Nothing is encrypted, no ransom note appears on a screen, no service goes down - because visible disruption would end the access, and the access is the asset. The crew harvests steadily from many victims at once and keeps quiet, which means the detection burden falls entirely on outbound data-flow monitoring from a server that nobody expects to initiate large transfers. An ERP application host has a highly predictable network profile: it talks to its database, to a handful of internal integrations, and to whatever portal fronts it. Sustained outbound volume to an unfamiliar destination is about as clear an anomaly as that environment can produce, and it is only visible to someone who baselined the normal case in advance.
Method: Sustained data theft over an extended period
Not used: Ransomware, encryption, or any deliberately visible disruption
Why quiet: Visible impact ends the access, and the access is the asset
Best available signal: Outbound volume from a host whose network profile is otherwise highly predictable
For many victims the notification chain ran backwards: the extortion email addressed to leadership was the first indication of anything, arriving before Oracle's advisory and therefore before any internal patching conversation could have started. Consider what that does to an incident response process built on the assumption that detection precedes disclosure. The security team is asked to confirm or refute a criminal's claim about a system they have no reason to suspect, with no CVE to reference, no indicators published, and executives already reading a ransom demand. Cl0p has run this pattern repeatedly - Accellion FTA, GoAnywhere MFT, MOVEit Transfer - and each time the distinguishing feature is the same: mass exploitation of one unauthenticated flaw, a long quiet harvest, then simultaneous extortion of everyone at once.
Timing: For many organizations, before Oracle's advisory existed
Pressure: Leak-site publication as the deadline mechanism
Precedent: Accellion FTA, GoAnywhere MFT, MOVEit Transfer - the same playbook each time
IR implication: Your process must handle "the criminal told us first"
Oracle published its security alert and out-of-cycle patch for CVE-2025-61882 on October 4, 2025, and CISA added it to the Known Exploited Vulnerabilities catalog on October 6, confirming active use in ransomware-adjacent campaigns. In the same period an exploit bundle leaked publicly, containing exp.py, server.py and a readme with setup instructions; researchers noted it was not fully established whether that code exploited CVE-2025-61882 itself or an older n-day. Either way, the practical effect on defenders is identical, and it is the familiar post-disclosure squeeze: the moment a patch exists, the flaw becomes usable by everyone rather than only by whoever paid for it, and the interval in which patching is optional closes immediately. Anyone patching on October 4 also had to assume compromise dating back to August, because the exploitation predates the advisory by two months.
October 6, 2025: CISA adds CVE-2025-61882 to the KEV catalog
Early October: Leaked exploit bundle -
exp.py, server.py, readmeUnresolved: Whether the leaked code targets this CVE or an older n-day
Required alongside patching: Threat hunting back to August, since exploitation predates the advisory