CVE-2025-61882
Critical 9.8 Exploited in the wild (KEV) Used in ransomware campaigns
Confirmed active exploitation — CISA KEV catalog
- Name
- Oracle E-Business Suite Unspecified Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Metrics
- CVSS 3.1
-
9.8 (CRITICAL)
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 100% (percentile: 100) as of 1 November 2026
- CWE
- CWE-287
Affected products
oracle: concurrent processing
References
- https://www.oracle.com/security-alerts/alert-cve-2025-61882.html Vendor Advisory
- https://blogs.oracle.com/security/post/apply-july-2025-cpu Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025… US Government Resource
- https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targetin… Press/Media Coverage