CVE-2025-61882
Oracle E-Business Suite Unspecified Vulnerability
Oracle·E-Business Suite
- Added
- Oct 6, 2025
- Fix due
- Oct 27, 2025
- Ransomware
- Known use
- Published
- Oct 5, 2025
- Updated
- Aug 4, 2026
- First covered
- Jun 29, 2026
- Latest story
- 5 months ago
Summary
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CWE-287Improper Authentication
Attack profile
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products
- Oracle Concurrent Processing12.2.3 to 12.2.14