CVE-2025-61882Oracle E-Business Suite Unspecified Vulnerability
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1oracle (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA required action
⚡ Known exploited · remediation due Oct 27, 2025
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2025-61882
- Status
- Analyzed
- Assigner (CNA)
- oracle
- Published
- Oct 5, 2025
- Last modified
- 2026-10-09 10:10 UTC
- Weaknesses
Affected Products
As published by the CNA in the CVE record.
Oracle CorporationOracle Concurrent Processing1 version range
- 12.2.3 through 12.2.14
References
- oracle.com https://www.oracle.com/security-alerts/alert-cve-2025-61882.html
- blogs.oracle.com https://blogs.oracle.com/security/post/apply-july-2025-cpu
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61882
- crowdstrike.com https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/