# CVE-2025-61882: Oracle E-Business Suite improper authentication in BI Publisher Integration

Source: https://junglewise.ai/threats/cve-2025-61882-oracle-e-business-suite-improper-authentication-in-bi-publisher  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-05. Updated: 2026-05-15  
License: CC BY 4.0 with a link back

CVE-2025-61882 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2025-10-05

Oracle E-Business Suite, a comprehensive suite of business applications for enterprise resource planning and supply chain management, contains a critical security flaw in its BI Publisher Integration component. This vulnerability allows an unauthorized person to gain full control over the Concurrent Processing system, which manages high-volume background tasks and report generation. An attacker could exploit this to access sensitive business data, disrupt operations, or compromise the entire application environment.

Technologies: [Oracle E-Business Suite](https://junglewise.ai/threats/technologies/e-business-suite). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2025-61882 exploited in the wild?** Yes. CVE-2025-61882 is known to be exploited in the wild, first recorded on 6 October 2025. Treat it as urgent.

**How severe is CVE-2025-61882?** Critical severity, with a CVSS score of 9.8, published 5 October 2025.

**Which products and versions are affected?** Oracle Concurrent Processing 12.2.3-12.2.14; Oracle E-Business Suite 12.2.3-12.2.14.

**Is there a fix for CVE-2025-61882?** A patch was published on 2025-07-15: Addressed in Oracle July 2025 Critical Patch Update Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-61882 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-61882?** Check whether you run Oracle Concurrent Processing or Oracle E-Business Suite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper authentication vulnerability (CWE-287) exists in the BI Publisher Integration component of Oracle Concurrent Processing within Oracle E-Business Suite. The flaw is remotely exploitable via HTTP without any prior authentication or user interaction. A successful exploit allows a network-based attacker to fully compromise the Oracle Concurrent Processing environment, leading to a complete loss of confidentiality, integrity, and availability. This vulnerability has been observed in active exploitation in the wild and is addressed in the Oracle July 2025 Critical Patch Update.

## Affected products

- Oracle E-Business Suite 12.2.3-12.2.14
- Oracle Concurrent Processing 12.2.3-12.2.14

## Timeline

- 2025-07-15: patched: Addressed in Oracle July 2025 Critical Patch Update
- 2025-10-06: disclosed: Initial disclosure and NVD publication
- 2025-10-06: kev added: Added to CISA Known Exploited Vulnerabilities catalog
- 2025-10-06: exploited: Reported as exploited in the wild by CISA and security researchers

## Related threats

- [Oracle E-Business Suite Workflow Notification Mailer privilege escalation](https://junglewise.ai/threats/cve-2026-91496-vulnerability-in-the-workflow-product-of-oracle-e-business-suite)
- [Oracle Applications Framework XSS/CSRF in Personalization](https://junglewise.ai/threats/cve-2026-87408-vulnerability-in-the-oracle-applications-framework-product-of)
- [Oracle E-Business Suite Applications Framework information disclosure in Web Utilities](https://junglewise.ai/threats/cve-2026-87366-vulnerability-in-the-oracle-applications-framework-product-of)
- [Oracle E-Business Suite Order Capture privilege escalation](https://junglewise.ai/threats/cve-2026-87357-vulnerability-in-the-order-capture-product-of-oracle-e-business)
- [Oracle E-Business Suite Applications Platform Engineering privilege escalation](https://junglewise.ai/threats/cve-2026-87356-vulnerability-in-the-applications-platform-engineering-product-of)