Oracle EBS Post-Exploitation Suspicious Java Child Process (CVE-2025-61882)

Duo Tech@duotech

•updated Oct 9, 2025•2•1•81

Detects suspicious child processes spawned by a Java process, which may indicate post-exploitation activity related to the Oracle E-Business Suite vulnerability CVE-2025-61882. The exploit chain often results in a reverse shell.