Oracle · E-Business Suite

CVE-2025-61882

Oracle E-Business Suite Unspecified Vulnerability

Exploited in attacks Used by ransomware Critical 9.8 Attack chance: 99.7%

What it is

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CISA: Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: October 27, 2025

oracle.com/security-alerts/alert-cve-2025-61882.html

Added to the CISA list: October 6, 2025
Published: October 5, 2025
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 99.7% in the top 0.1% of all known vulnerabilities
More details: NVD · CVE.org · CISA

More exploited flaws from Oracle

Added	Vulnerability	Product	Severity	Attack chance
Jul 15, 2026	Improper Privilege ManagementCVE-2026-46817	E-Business Suite	Critical 9.8	12%
Oct 20, 2025	Server-Side Request Forgery (SSRF)CVE-2025-61884used by ransomware	E-Business Suite	High 7.5	96%
Feb 2, 2023	UnspecifiedCVE-2022-21587used by ransomware	E-Business Suite	Critical 9.8	98%
Aug 24, 2026	Improper Access ControlCVE-2026-21962	HTTP Server and Oracle Weblogic Server Proxy Plug-in	Critical 10.0	73%
Jun 12, 2026	PeopleSoft Enterprise PeopleTools Missing Authentication for Critical FunctionCVE-2026-35273used by ransomware	PeopleSoft Enterprise PeopleTools	Critical 9.8	97%
Jun 1, 2026	UnspecifiedCVE-2024-21182	WebLogic Server	High 7.5	74%
Nov 21, 2025	Missing Authentication for Critical FunctionCVE-2025-61757	Fusion Middleware	Critical 9.8	89%
Feb 24, 2025	DeserializationCVE-2024-20953	Agile Product Lifecycle Management (PLM)	High 8.8	3.9%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.