CVE-2025-61882
Published: 05 October 2025
Summary
CVE-2025-61882 is a critical-severity Improper Authentication (CWE-287) vulnerability in Oracle Concurrent Processing. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-4 (System Monitoring).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the CVE by requiring timely flaw remediation through application of Oracle's July 2025 Critical Patch Update patches for affected versions 12.2.3-12.2.14.
Enforces boundary protection to restrict unauthenticated network access via HTTP to the vulnerable BI Publisher Integration component, reducing remote exploitation risk.
Enables monitoring of system and network activity to identify exploitation attempts or compromises of Oracle Concurrent Processing due to this critical unauthenticated vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote exploitation over HTTP of a public-facing Oracle E-Business Suite component, directly mapping to T1190: Exploit Public-Facing Application.
NVD Description
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks…
more
of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Deeper analysisAI
CVE-2025-61882 is a critical vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite, specifically affecting the BI Publisher Integration component. Supported versions impacted include 12.2.3 through 12.2.14. Classified under CWE-287, it carries a CVSS 3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts. The vulnerability was published on 2025-10-05.
An unauthenticated attacker with network access via HTTP can easily exploit this vulnerability to compromise Oracle Concurrent Processing, potentially resulting in a full takeover of the component. No special privileges, user interaction, or complex preconditions are required, making it highly accessible over the network.
Oracle advisories, including the security alert at https://www.oracle.com/security-alerts/alert-cve-2025-61882.html and a blog post urging application of the July 2025 Critical Patch Update at https://blogs.oracle.com/security/post/apply-july-2025-cpu, detail patches and mitigation steps for affected systems.
This vulnerability appears in the CISA Known Exploited Vulnerabilities Catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61882), signaling real-world exploitation. CrowdStrike has documented a campaign targeting Oracle E-Business Suite via this zero-day (https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/).
Details
- CWE(s)
- KEV Date Added
- 06 October 2025