What is the CVSS score of CVE-2025-61882?

CVE-2025-61882 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 99.7%.

Which versions of Oracle E-Business Suite are affected by CVE-2025-61882?

Oracle E-Business Suite Concurrent Processing tier (versions 12.2.3-12.2.14) is vulnerable to unauthenticated remote takeover via the BI Publisher Integration component, confirmed actively exploited…

Is CVE-2025-61882 being actively exploited?

Yes, CVE-2025-61882 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

How to fix or mitigate CVE-2025-61882?

Within 24 hours: Identify all instances of Oracle E-Business Suite running versions 12.2.3-12.2.14 and immediately restrict HTTP access to the Concurrent Processing tier to trusted networks only using firewall rules. Within 7 days: Deploy authentication controls in front of BI Publisher Integration (reverse proxy, WAF, or identity gateway requiring multi-factor authentication); enable detailed logging and real-time alerting on all access attempts to affected components. Within 30 days: Plan and execute migration or upgrade away from affected versions; consult with Oracle on available upgrade paths to supported releases and fully validate changes in a staging environment before production deployment.

Oracle E-Business Suite CVE-2025-61882

CRITICAL

Improper Authentication (CWE-287)

2025-10-05 secalert_us@oracle.com

Oracle Authentication Bypass Concurrent Processing

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network HTTP access at low complexity with no user interaction yields full component takeover, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Aug 04, 2026 - 05:31 CISA

Analysis Generated

Aug 04, 2026 - 05:29 vuln.today

CVE Published

Oct 05, 2025 - 04:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Unauthenticated remote takeover of Oracle E-Business Suite's Concurrent Processing tier (via the BI Publisher Integration component) affects supported releases 12.2.3 through 12.2.14, letting a network attacker with no credentials fully compromise the component over HTTP. Rooted in an authentication weakness (CWE-287), the flaw is confirmed actively exploited (CISA KEV) and was leveraged as a zero-day in a mass-exploitation campaign documented by CrowdStrike, with full confidentiality, integrity, and availability impact (CVSS 9.8).

Technical ContextAI

Oracle E-Business Suite is Oracle's flagship on-premises ERP platform; the affected subsystem is Oracle Concurrent Processing, the batch/job-execution engine that runs concurrent programs and reports, exposed here through its BI Publisher (Oracle's reporting/publishing engine) integration. The CPE cpe:2.3:a:oracle:concurrent_processing pinpoints the Concurrent Processing application component rather than the database or middleware tier. The root-cause class is CWE-287 (Improper Authentication): the HTTP-facing integration path fails to properly enforce authentication, allowing an unauthenticated request to reach privileged functionality - consistent with the 'Authentication Bypass' tag. Because Concurrent Processing executes server-side jobs, bypassing its access controls translates directly into execution and takeover on the EBS application tier.

RemediationAI

Apply the emergency fix from Oracle's out-of-band Security Alert immediately: Patch available per vendor advisory at https://www.oracle.com/security-alerts/alert-cve-2025-61882.html (Oracle released a dedicated Security Alert patch; a specific numeric fix version was not included in the input, so apply the patch referenced in that alert and confirm the exact patch number via My Oracle Support). Oracle notes the fix requires a recent Critical Patch Update baseline as a prerequisite, so bring EBS current per https://blogs.oracle.com/security/post/apply-july-2025-cpu before applying. Because this is confirmed actively exploited, treat it as urgent: until patched, remove or tightly restrict internet exposure of the EBS web tier - block external HTTP/HTTPS access to Concurrent Processing and BI Publisher endpoints via WAF/reverse-proxy rules or network ACLs limiting access to trusted internal ranges/VPN, accepting that this may break external self-service or integration flows. Given documented zero-day exploitation, also hunt for prior compromise (review web/application logs, unexpected concurrent jobs, and IOCs from the CrowdStrike report at https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/) rather than assuming patching alone is sufficient.