All intelligence
// vulnerability record
cached · NVD via COSMOS syncCVE-2025-61882
CRITICALKEVpublished 2025-10-05 04:15 UTC · 10 months ago · modified 2026-06-17 09:51 UTC
9.8
CVSS / 10
// description
Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.
// required action (CISA KEV)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
added 2025-10-06 00:00 UTC
// weaknesses (CWE)
- CWE-287
// references (4)
- https://www.oracle.com/security-alerts/alert-cve-2025-61882.html
- https://blogs.oracle.com/security/post/apply-july-2025-cpu
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61882
- https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/