Paper/Archive/CVE-2025-61882

CVE-2025-61882

Oracle Corporation Oracle Concurrent Processing — Oracle E-Business Suite Unspecified Vulnerability

KEV · due 27 Oct ransomware use EPSS 100%public exploit SSVC act CVSS 9.8

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 In CISA KEV+3030.0 EPSS percentile 100.01.000 × 2020.0 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected

ProductAffectedFixed inSource

Oracle Concurrent Processing12.2.3 – 12.2.14–CNA

Scores by source

oracle (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

advisoryoracle.com/security-alerts/alert-cve-2025-61882.html advisoryblogs.oracle.com/security/post/apply-july-2025-cpu writeupcrowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882 refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61882 kevcisa.gov/known-exploited-vulnerabilities-catalog