Oracle E-Business Suite Unspecified Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2025-61882 · Published 05/10/2025 · updated 09/10/2026

Oracle E-Business Suite Unspecified Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 06/10/2025. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.

Package	Affected versions	Patched versions
concurrent processing oracle	`≥ 12.2.3, ≤ 12.2.14`	No fix yet

Description

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

References

oracle.com/security-alerts/alert-cve-2025-61882.html · Vendor Advisory
blogs.oracle.com/security/post/apply-july-2025-cpu · Vendor Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882 · Press/Media Coverage
CISA KEV · CVE-2025-61882

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free