CVE-2025-61882criticalunder attackransomwareCWE-287

CVE-2025-61882: critical vulnerability in Oracle Concurrent Processing

Published · Updated

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon1 days
Published on NVDOct 5
1st PoC+1d
metasploitOct 4
CISA KEV+1d
victimsJul 20
exploitation probability
100%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
1 group(s)10 public exploit(s)
Appeared in 1 incident(s) we investigated
Estée Lauder
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

Ransomwareclop Vexday
Action required by CISAfederal deadline: 2025-10-27

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

An unauthenticated attacker can remotely exploit Oracle Concurrent Processing through HTTP to gain complete control of the system. This is a critical flaw in versions 12.2.3-12.2.14 that requires no special conditions or user interaction to exploit.

Technical detail

An unauthenticated remote vulnerability (CWE-287: Improper Authentication) in Oracle E-Business Suite's Concurrent Processing BI Publisher Integration component allows network-based HTTP exploitation with low attack complexity. Successful exploitation results in complete system compromise including confidentiality, integrity, and availability impact (CVSS 9.8).

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Oracle Corporation · Oracle Concurrent Processing
public PoCs found — 10
githubgithub.com/George0Papasotiriou/CVE-2025-61882-Oracle-BI-Publisher-RCE★ 1githubgithub.com/Zhert-lab/CVE-2025-61882-CVE-2025-61884★ 0githubgithub.com/sid-203/Enterprise-Information-Security-Risk-Assessment-Oracle-E-Business-Suite-Case-Study★ 0githubgithub.com/NetVanguard-cmd/CVE-2025-61882★ 0githubgithub.com/MindflareX/CVE-2025-61882-POC★ 0vulncheckvulncheck.com/xdb/576048bf8df8unverifiedvulncheckvulncheck.com/xdb/8db320d42361unverifiedvulncheckvulncheck.com/xdb/1c3a7eaa6e6cunverifiedvulncheckvulncheck.com/xdb/dcdb633f53a3unverifiedvulncheckvulncheck.com/xdb/677bed287c2dunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Oracle Concurrent Processing

In the same product, most dangerous first.

CVE-2026-61051MEDIUMCVE-2026-61051EPSS 0.3%
References
https://blogs.oracle.com/security/post/apply-july-2025-cpuhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61882https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/https://www.oracle.com/security-alerts/alert-cve-2025-61882.html