Critical severity · published Oct 5, 2025
CVE-2025-61882
Oracle E-Business Suite Unspecified Vulnerability
RansomwareIn wildKEV
9.8
CVSS
99.7%
EPSS
Yes
On KEV
Description
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.7% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Oct 6, 2025
Federal remediation dueOct 27, 2025
Ransomware campaign useKnown
Affected products
Which versions
OC
Oracle Concurrent Processing · Oracle Corporation
12.2.3 through 12.2.14 · source: vendor
CP
Concurrent Processing · Oracle
12.2.3 through 12.2.14 · source: NVD
ES
E-Business Suite · Oracle
All versions, or not specified · source: KEV
In the news
VulnerabilityHigh
[CISA KEV] CVE-2025-61882: Oracle E-Business Suite - Oracle E-Business Suite Unspecified Vulnerability
Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.
ESE-Business SuiteCVE-2025-61882
Oct 6, 2025·CISA KEV
Affected product
OC
Oracle Concurrent Processing
Oracle Corporation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-61882
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-61882
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vendor-advisory
https://www.oracle.com/security-alerts/alert-cve-2025-61882.html
More from Oracle Concurrent Processing
8.2
CVE-2026-101704
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other)
7.8
CVE-2026-101676
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues)
7.4
CVE-2026-101707
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues)
6.3
CVE-2026-61051
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration)
6.0
CVE-2026-101701
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Request Submission and Scheduling)