Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is in the KEV database since yesterday.

Exploitation active

Automatable yes

Technical Impact total

Affected Vendors & Products

Vendors Products
Oracle
  • Concurrent Processing

Configuration 1 [-]

cpe:2.3:a:oracle:concurrent_processing:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://blogs.oracle.com/security/post/apply-july-2025-cpu cve-icon cve-icon
https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/ cve-icon cve-icon
https://www.oracle.com/security-alerts/alert-cve-2025-61882.html cve-icon cve-icon
History

Tue, 07 Oct 2025 19:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-91
CWE-93

Mon, 06 Oct 2025 22:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284 CWE-22
CWE-444
CWE-611
CWE-918

Mon, 06 Oct 2025 19:15:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 06 Oct 2025 17:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:oracle:concurrent_processing:*:*:*:*:*:*:*:*

Mon, 06 Oct 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2025-10-07T00:00:00+00:00', 'dueDate': '2025-10-28T00:00:00+00:00'}

Mon, 06 Oct 2025 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 06 Oct 2025 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle
Oracle concurrent Processing
Vendors & Products Oracle
Oracle concurrent Processing

Sun, 05 Oct 2025 03:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published: 2025-10-05T03:17:01.644Z

Updated: 2025-10-07T19:08:44.015Z

Reserved: 2025-10-03T06:59:29.438Z

Link: CVE-2025-61882

cve-icon Vulnrichment

Updated: 2025-10-06T16:02:13.038Z

cve-icon NVD

Status : Analyzed

Published: 2025-10-05T04:15:40.340

Modified: 2025-10-07T21:00:13.017

Link: CVE-2025-61882

cve-icon Redhat

No data.