CVE-2025-61882: Oracle E-Business Suite improper authentication in BI Publisher Integration

CVE-2025-61882 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2025-10-05

Oracle E-Business Suite, a comprehensive suite of business applications for enterprise resource planning and supply chain management, contains a critical security flaw in its BI Publisher Integration component. This vulnerability allows an unauthorized person to gain full control over the Concurrent Processing system, which manages high-volume background tasks and report generation. An attacker could exploit this to access sensitive business data, disrupt operations, or compromise the entire application environment.

Technologies: Oracle E-Business Suite. Vendors: Oracle.

Quick answers

Is CVE-2025-61882 exploited in the wild?
Yes. CVE-2025-61882 is known to be exploited in the wild, first recorded on 6 October 2025. Treat it as urgent.
How severe is CVE-2025-61882?
Critical severity, with a CVSS score of 9.8, published 5 October 2025.
Which products and versions are affected?
Oracle Concurrent Processing 12.2.3-12.2.14; Oracle E-Business Suite 12.2.3-12.2.14.
Is there a fix for CVE-2025-61882?
A patch was published on 2025-07-15: Addressed in Oracle July 2025 Critical Patch Update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-61882 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-61882?
Check whether you run Oracle Concurrent Processing or Oracle E-Business Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper authentication vulnerability (CWE-287) exists in the BI Publisher Integration component of Oracle Concurrent Processing within Oracle E-Business Suite. The flaw is remotely exploitable via HTTP without any prior authentication or user interaction. A successful exploit allows a network-based attacker to fully compromise the Oracle Concurrent Processing environment, leading to a complete loss of confidentiality, integrity, and availability. This vulnerability has been observed in active exploitation in the wild and is addressed in the Oracle July 2025 Critical Patch Update.

Affected products

  • Oracle E-Business Suite 12.2.3-12.2.14
  • Oracle Concurrent Processing 12.2.3-12.2.14

Timeline

  • 2025-07-15: patched: Addressed in Oracle July 2025 Critical Patch Update
  • 2025-10-06: disclosed: Initial disclosure and NVD publication
  • 2025-10-06: kev added: Added to CISA Known Exploited Vulnerabilities catalog
  • 2025-10-06: exploited: Reported as exploited in the wild by CISA and security researchers

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.