Oracle Ebs Auth Bypass CVE-2025-61882

Tim Peck@timpeck

•updated Oct 7, 2025•1•1•343

Detects a potential Oracle E-Business Suite (EBS) authentication bypass attempt, associated with the exploitation of CVE-2025-61882. This activity involves an HTTP POST request to the '/OA_HTML/SyncServlet' endpoint, which is the initial step observed in the exploit chain used by threat actors like GRACEFUL SPIDER.