CVE-2025-61882
critical CISA KEVOracle E-Business Suite Unspecified Vulnerability
Vendor / product: Oracle — E-Business Suite
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Required action (CISA)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
References
- https://www.oracle.com/security-alerts/alert-cve-2025-61882.html secalert_us@oracle.com
- https://blogs.oracle.com/security/post/apply-july-2025-cpu 134c704f-9b21-4f2e-91b3-4a467353bcc0
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61882 134c704f-9b21-4f2e-91b3-4a467353bcc0
- https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-... 134c704f-9b21-4f2e-91b3-4a467353bcc0