CVE entry · CVE-2025-61882
CVE-2025-61882: Oracle E-Business Suite Unspecified Vulnerability
Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.
- Actively exploited: added to CISA’s KEV catalog on October 6, 2025.
- Used by ransomware, according to CISA.
- Remediation deadline for US federal agencies: October 27, 2025.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes Oracle E-Business Suite, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
Other Oracle vulnerabilities
-
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
-
Oracle E-Business Suite Improper Privilege Management Vulnerability
-
CVE-2026-35273Used by ransomwareOracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
-
Oracle WebLogic Server Unspecified Vulnerability
-
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
-
CVE-2025-61884Used by ransomwareOracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability