CVE-2025-61882
Oracle E-Business Suite Unspecified Vulnerability
Description
CVE-2025-61882 is a critical improper authentication vulnerability in Oracle E-Business Suite's Concurrent Processing component (BI Publisher Integration), affecting versions 12.2.3 through 12.2.14. The vulnerability allows an unauthenticated attacker with network access via HTTP to completely take over the Oracle Concurrent Processing system. With a CVSS v3.1 base score of 9.8 and confirmed ransomware exploitation, CVE-2025-61882 represents one of the most dangerous Oracle E-Business Suite vulnerabilities disclosed. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 27, 2025, and its EPSS score of 87.37% at the 99th percentile indicates near-certain exploitation activity in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | concurrent processing | >= 12.2.3, <= 12.2.14 |
References
- https://www.oracle.com/security-alerts/alert-cve-2025-61882.html(Vendor Advisory)
- https://blogs.oracle.com/security/post/apply-july-2025-cpu(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61882(US Government Resource)
- https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/(Press/Media Coverage)
Weakness Type
CWE-287: Improper Authentication
CVE-2025-61882 is classified under CWE-287 (Improper Authentication), which occurs when software does not sufficiently prove that an actor claiming an identity is who they say they are. In the Oracle E-Business Suite Concurrent Processing component, the BI Publisher Integration module fails to properly validate authentication claims, allowing unauthenticated attackers to bypass the authentication mechanism entirely and gain full access to the system without valid credentials.
Learn more: CWE-287 — Improper Authentication
Impact Analysis
CVE-2025-61882 represents an extreme security risk for organizations running Oracle E-Business Suite. The vulnerability is remotely exploitable over HTTP (AV:N) with low attack complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N), meaning any network-accessible instance can be compromised with minimal effort. Confidentiality (High): An attacker can access all data managed by Oracle Concurrent Processing, including financial records, business intelligence reports, and sensitive operational data typically stored in EBS environments. Integrity (High): Full system takeover enables modification of financial data, business reports, and system configurations, which could go undetected without proper audit controls. Availability (High): The attacker can disrupt concurrent processing jobs critical to business operations, potentially halting financial reporting, procurement workflows, and other essential EBS functions. With a CVSS score of 9.8 (Critical) and confirmed ransomware usage, this Oracle E-Business Suite vulnerability poses an immediate threat to enterprise environments. The EPSS score of 87.37% confirms this is among the most actively exploited vulnerabilities currently tracked.
Exploit Maturity
CVE-2025-61882 demonstrates very high exploit maturity with confirmed active exploitation. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, and critically, ransomware campaigns are known to exploit this vulnerability, making it an immediate priority for all affected organizations. The EPSS score of 87.37% at the 99th percentile places it among the top 1% of all vulnerabilities in terms of exploitation probability. CrowdStrike has published detailed research on campaigns targeting this vulnerability, confirming that threat actors are actively targeting Oracle E-Business Suite installations. The combination of unauthenticated remote access, full system takeover capability, and confirmed ransomware exploitation makes CVE-2025-61882 one of the most urgent vulnerabilities to remediate.
Remediation
-
Apply Oracle's security patches immediately. Oracle has released a security alert for CVE-2025-61882. Apply the patches documented in the Oracle Security Alert and follow the guidance in the July 2025 CPU blog post. The CISA required action states to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
-
Patch all affected versions. Oracle Concurrent Processing versions 12.2.3 through 12.2.14 are vulnerable. Verify your exact version and apply the corresponding patch from Oracle Support.
-
Restrict network access to the BI Publisher Integration endpoints as an interim mitigation. Implement firewall rules or web application firewall (WAF) policies to limit HTTP access to Oracle EBS to trusted IP ranges only. Disable or restrict external access to the Concurrent Processing web interface.
-
Monitor for indicators of compromise. Given the confirmed ransomware association, review system and application logs for unauthorized access attempts, unexpected concurrent processing jobs, and signs of data exfiltration. Implement enhanced monitoring of Oracle EBS authentication events and BI Publisher activities.
-
Strengthen authentication controls for Oracle E-Business Suite long-term. Implement multi-factor authentication for all EBS access, enforce strict network segmentation around EBS infrastructure, and conduct regular security assessments of authentication mechanisms across all EBS components.
Technical Details
CVE-2025-61882 is an improper authentication vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite, specifically in the BI Publisher Integration component. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates that the vulnerability is network-exploitable via HTTP with no complexity barriers, no authentication requirement, and no user interaction needed, achieving maximum impact across all three CIA dimensions. The vulnerability stems from CWE-287 (Improper Authentication), where the BI Publisher Integration component fails to properly validate authentication claims, allowing attackers to bypass the authentication mechanism entirely. This enables an unauthenticated attacker to issue HTTP requests that are processed as if they originated from a legitimate, authenticated user, resulting in complete takeover of the Oracle Concurrent Processing subsystem. The affected versions span the entire 12.2.3 through 12.2.14 release range, representing a large attack surface across enterprise Oracle E-Business Suite deployments.
Frequently Asked Questions
Is CVE-2025-61882 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-61882 to the Known Exploited Vulnerabilities catalog. More critically, this vulnerability is known to be exploited by ransomware campaigns. CrowdStrike has published research identifying active targeting campaigns against Oracle E-Business Suite installations using this vulnerability.
What products are affected by CVE-2025-61882?
Oracle Concurrent Processing (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.14 are affected. The vulnerability is specifically in the BI Publisher Integration component. All organizations running these versions should treat this as an emergency patching priority.
How do I fix CVE-2025-61882?
Apply the security patches from the Oracle Security Alert for CVE-2025-61882 immediately. Oracle has provided specific patches through the July 2025 Critical Patch Update. As an interim measure, restrict network access to the BI Publisher Integration endpoints and implement WAF rules to limit HTTP access to trusted sources.
How severe is CVE-2025-61882?
CVE-2025-61882 is rated Critical with a CVSS v3.1 base score of 9.8 out of 10. The vulnerability allows unauthenticated remote attackers to completely take over Oracle Concurrent Processing. Its EPSS score of 87.37% at the 99th percentile and confirmed ransomware exploitation make it one of the most dangerous Oracle vulnerabilities currently known.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.