What is the CVSS score of CVE-2025-61882?

CVE-2025-61882 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 99.7%.

Is there a public PoC exploit available for CVE-2025-61882?

Yes, a public proof-of-concept exploit is available for CVE-2025-61882. Prioritise patching immediately. EPSS: 99.7%.

How to fix or mitigate CVE-2025-61882?

Within 24 hours: Identify all instances of Oracle E-Business Suite running versions 12.2.3-12.2.14 and immediately restrict HTTP access to the Concurrent Processing tier to trusted networks only using firewall rules. Within 7 days: Deploy authentication controls in front of BI Publisher Integration (reverse proxy, WAF, or identity gateway requiring multi-factor authentication); enable detailed logging and real-time alerting on all access attempts to affected components. Within 30 days: Plan and execute migration or upgrade away from affected versions; consult with Oracle on available upgrade paths to supported releases and fully validate changes in a staging environment before production deployment.

Oracle E-Business Suite CVE-2025-61882

CRITICAL

Improper Authentication (CWE-287)

2025-10-05 secalert_us@oracle.com

Authentication Bypass Oracle Concurrent Processing

9.8

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify internet-facing Oracle EBS 12.2
Delivery

Send crafted HTTP request to BI Publisher endpoint
Exploit

Bypass authentication (CWE-287)
Execution

Reach Concurrent Processing functionality
Persist

Execute server-side takeover of component
Impact

Exfiltrate data or establish persistence

Vulnerability Assessment

Weakness	CWE CWE-287 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Authentication mechanism validation MITRE ATT&CK 2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires network HTTP access to an Oracle E-Business Suite 12.2.3-12.2.14 instance whose Oracle Concurrent Processing tier and its BI Publisher Integration component are reachable by the attacker - typically an internet-exposed or otherwise attacker-reachable EBS web tier. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are needed beyond the affected component being present and network-accessible; the primary limiting factor is network reachability of the EBS HTTP endpoints, so instances restricted to internal/VPN-only access are materially harder to reach. Deployments on versions outside 12.2.3-12.2.14, or without the BI Publisher Integration exposed, would not be exploitable via this path.
Impact	This is a top-priority, patch-now issue with corroborating signals across sources. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes trivial exploitation: network-reachable, low complexity, no privileges, no user interaction, with full CIA impact. Critically, that theoretical severity is confirmed in practice - the vulnerability appears in the CISA KEV catalog and CrowdStrike attributes an active campaign exploiting it as a zero-day against Oracle EBS, so this is confirmed actively exploited (CISA KEV), not merely a high-CVSS-but-low-real-risk issue. No EPSS score was provided in the input, but EPSS is largely moot given documented in-catalog active exploitation. One caveat: the description scopes impact to 'takeover of Oracle Concurrent Processing' (the component) rather than explicitly the full host, though real-world reporting indicates hands-on follow-on activity - prudently treat it as full application-server compromise.
Exploit ScenarioDerived	An attacker scans for internet-facing Oracle EBS 12.2 instances and sends a crafted HTTP request to the BI Publisher Integration endpoint that bypasses authentication, gaining unauthenticated access to Concurrent Processing functionality. From there they execute server-side operations to take over the component and pivot to data theft or persistence - a chain already used in the wild as a zero-day per CrowdStrike, and the CVE is listed in CISA KEV.

Emergency Immediate action required. Why: CRITICAL + in CISA KEV (actively exploited), no patch available.

Exploited in the wild (CISA KEV) No patch listed yet 99.7% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 04, 2026

Unauthenticated remote takeover of Oracle E-Business Suite's Concurrent Processing tier (via the BI Publisher Integration component) affects supported releases 12.2.3 through 12.2.14, letting a network attacker with no credentials fully compromise the component over HTTP. Rooted in an authentication weakness (CWE-287), the flaw is confirmed actively exploited (CISA KEV) and was leveraged as a zero-day in a mass-exploitation campaign documented by CrowdStrike, with full confidentiality, integrity, and availability impact (CVSS 9.8).

RemediationAI

Apply the emergency fix from Oracle's out-of-band Security Alert immediately: Patch available per vendor advisory at https://www.oracle.com/security-alerts/alert-cve-2025-61882.html (Oracle released a dedicated Security Alert patch; a specific numeric fix version was not included in the input, so apply the patch referenced in that alert and confirm the exact patch number via My Oracle Support). Oracle notes the fix requires a recent Critical Patch Update baseline as a prerequisite, so bring EBS current per https://blogs.oracle.com/security/post/apply-july-2025-cpu before applying. Because this is confirmed actively exploited, treat it as urgent: until patched, remove or tightly restrict internet exposure of the EBS web tier - block external HTTP/HTTPS access to Concurrent Processing and BI Publisher endpoints via WAF/reverse-proxy rules or network ACLs limiting access to trusted internal ranges/VPN, accepting that this may break external self-service or integration flows. Given documented zero-day exploitation, also hunt for prior compromise (review web/application logs, unexpected concurrent jobs, and IOCs from the CrowdStrike report at https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/) rather than assuming patching alone is sufficient.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle E-Business Suite is Oracle's flagship on-premises ERP platform; the affected subsystem is Oracle Concurrent Processing, the batch/job-execution engine that runs concurrent programs and reports, exposed here through its BI Publisher (Oracle's reporting/publishing engine) integration. The CPE cpe:2.3:a:oracle:concurrent_processing pinpoints the Concurrent Processing application component rather than the database or middleware tier. The root-cause class is CWE-287 (Improper Authentication): the HTTP-facing integration path fails to properly enforce authentication, allowing an unauthenticated request to reach privileged functionality - consistent with the 'Authentication Bypass' tag. Because Concurrent Processing executes server-side jobs, bypassing its access controls translates directly into execution and takeover on the EBS application tier.

Know when Concurrent Processing gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.8 CRITICAL

Unauthenticated network HTTP access at low complexity with no user interaction yields full component takeover, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Aug 04, 2026 - 05:31 CISA

CVE Published

Oct 05, 2025 - 04:15 cve.org

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Oracle E-Business Suite Concurrent Processing tier (versions 12.2.3-12.2.14) is vulnerable to unauthenticated remote takeover via the BI Publisher Integration component, confirmed actively exploited (CISA KEV). Organizations running affected versions face complete system compromise without vendor patch options, putting sensitive financial and operational data at immediate risk. Urgent mitigation and upgrade planning are required.

Business Impact: Severe

Compensating Controls

Implement network-level access controls via firewall to restrict HTTP access to Concurrent Processing tier from untrusted networks; deploy a reverse proxy or WAF with enforced authentication in front of BI Publisher Integration component; enable comprehensive logging and real-time alerts for suspicious or unauthorized access attempts; temporarily isolate affected systems from external networks if business continuity allows pending vendor patch release.

Threat Intelligence Overview

Threat Score

8.0/10

Composite threat intelligence

EPSS Score

99.7%

Top 0% exploitable

Prevalence

High

widely-deployed enterprise ERP across large organizations and government

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

NVD

CVE.org

CISA KEV

EPSS POC (2)

GitHub Nuclei

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV Yes

Public POC Yes

EPSS 99.7%

Patch available No

Active threat Yes

Deciding rule

CRITICAL + in CISA KEV (actively exploited), no patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.