Oracle E-Business Suite CVE-2025-61882 (CVSS 9.8, unauthenticated RCE in Concurrent Processing / BI Publisher, exploited by Cl0p for data theft): how do I patch and check for compromise?

What it is: CVE-2025-61882 is an unauthenticated remote code execution flaw in the Concurrent Processing component (BI Publisher Integration) of Oracle E-Business Suite. The Cl0p extortion group exploited it as a zero-day from about August 2025 to steal data from many organizations, then emailed executives extortion demands. Oracle issued an emergency Security Alert in early October 2025, followed by a related alert for CVE-2025-61884 (an information disclosure flaw in Oracle Configurator runtime) a few days later. It is in CISA's Known Exploited Vulnerabilities catalog. Am I affected: - Oracle E-Business Suite 12.2.3 through 12.2.14 without the Security Alert patch, especially if EBS web interfaces are reachable from the internet. - Check each EBS instance's patch level, including whether the October 2023 Critical Patch Update is installed, which Oracle lists as a prerequisite for the Security Alert patch. Fix: 1. Make sure each instance has the October 2023 CPU, then apply the CVE-2025-61882 Security Alert patch and the CVE-2025-61884 patch, or a later Critical Patch Update that includes them. 2. Don't expose EBS directly to the internet; put it behind a VPN or tightly restricted reverse proxy. After (do this even if patched, since exploitation began months before the fix): - Use the indicators of compromise from Oracle's alert and from incident response firms (CrowdStrike, Mandiant) to hunt in web and application logs for requests to the affected Concurrent Processing / BI Publisher endpoints, unusual templates or reports, and outbound connections from EBS servers since August 2025. - Look for unexpected Java processes, new files in EBS application directories, and large data exports. - If you received a Cl0p extortion email, involve incident response and legal teams, since data theft may have occurred even if no ransomware ran. Sources: https://www.oracle.com/security-alerts/alert-cve-2025-61882.html https://www.bleepingcomputer.com/news/security/oracle-patches-ebs-zero-day-exploited-in-clop-data-theft-attacks/ https://www.helpnetsecurity.com/2025/10/06/cl0p-oracle-data-theft-extortion-cve-2025-61882/