Zero-day CVE-2025-61882 exploited in Oracle EBS extortion

Security researchers say a coordinated extortion campaign that targeted Oracle E-Business Suite customers began in mid-July and escalated in August, with attackers exploiting a critical zero-day vulnerability to steal data from dozens of organizations and later sending ransom demands to executives. The flaw, tracked as CVE-2025-61882, permits unauthenticated remote code execution against affected EBS instances and was patched by Oracle in an emergency update in early October.

Researchers at multiple cybersecurity firms found evidence of suspicious activity against EBS environments as early as July 10, and observed exploitation of CVE-2025-61882 beginning on August 9, weeks before a public fix was available. Attackers uploaded malicious XSLT templates via Oracle’s XML Publisher Template Manager and used EBS servlet pages to trigger a multistage Java-based payload chain. That chain included an in-memory downloader identified as GoldVein.Java and a nested sequence of loaders and filters tracked as SageGift, SageLeaf and SageWave, which together enabled execution of final payloads without writing files to disk.

The intrusion sequence often opened outbound TLS connections to attacker...