{"id":"CVE-2025-61882","published":"2025-10-05T04:15:40Z","modified":"2026-10-09T10:10:00Z","title":"Oracle E-Business Suite Unspecified Vulnerability","vendor":"Oracle","product":"E-Business Suite","tier":"core","eol":null,"description":{"text":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an unspecified vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite, located in the BI Publisher Integration component. An unauthenticated attacker with network access over HTTP can exploit it with low complexity and no user interaction to take over Oracle Concurrent Processing.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:01:34Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99728,"percentile":0.99953,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-10-06","dueDate":"2025-10-27","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.oracle.com/security-alerts/alert-cve-2025-61882.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-61882","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-10-04","exploitedFirstSeen":"2025-10-04","ransomware":true,"evidence":[{"url":"https://blogs.oracle.com/security/post/apply-july-2025-cpu","date":"2025-10-04"},{"url":"https://www.oracle.com/security-alerts/alert-cve-2025-61882.html","date":"2025-10-04"},{"url":"https://www.cybereason.com/blog/oracle-ebs-extortion-cl0p","date":"2025-10-05"},{"url":"https://www.linkedin.com/feed/update/urn:li:activity:7380595612443893760/","date":"2025-10-05"},{"url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/","date":"2025-10-06"},{"url":"https://viz.greynoise.io/tags/oracle-e-business-suite-bi-publisher-integration-remote-takeover-cve-2025-61882-rce-attempt","date":"2025-10-07"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-10-07"},{"url":"https://fortiguard.fortinet.com/outbreak-alert/oracle-e-business-suite-rce","date":"2025-10-08"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-61882","date":"2025-10-09"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation","date":"2025-10-09"}],"evidenceTotal":258,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Oracle E-Business Suite RCE Flaw Sees Reported Probing After Patch","url":"https://otx.alienvault.com/pulse/6ae288d3c33baa0075719162","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"https://www.oracle.com/security-alerts/alert-cve-2025-61882.html","tags":["Vendor Advisory"]},{"url":"https://blogs.oracle.com/security/post/apply-july-2025-cpu","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61882","tags":["US Government Resource"]},{"url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/","tags":["Press/Media Coverage"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated network exploitation of a public-facing application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP","start":182,"end":275}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Takeover implies gaining valid or privileged access to the system","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing","start":321,"end":416}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-32142","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-32142","exploited":true,"exploitedSince":"2025-10-06","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":12,"skipped":1,"earliest":"2025-10-05","earliestUrl":"https://github.com/rxerium/CVE-2025-61882-CVE-2025-61884","repos":[{"name":"watchtowrlabs/watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882","url":"https://github.com/watchtowrlabs/watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882","stars":55,"created":"2025-10-06"},{"name":"rxerium/CVE-2025-61882-CVE-2025-61884","url":"https://github.com/rxerium/CVE-2025-61882-CVE-2025-61884","stars":36,"created":"2025-10-05"},{"name":"zerozenxlabs/CVE-2025-61882-Oracle-EBS","url":"https://github.com/zerozenxlabs/CVE-2025-61882-Oracle-EBS","stars":20,"created":"2025-10-10"},{"name":"AdityaBhatt3010/CVE-2025-61882-Oracle-E-Business-Suite-Pre-Auth-RCE-Exploit","url":"https://github.com/AdityaBhatt3010/CVE-2025-61882-Oracle-E-Business-Suite-Pre-Auth-RCE-Exploit","stars":12,"created":"2025-10-16"},{"name":"Sachinart/CVE-2025-61882","url":"https://github.com/Sachinart/CVE-2025-61882","stars":11,"created":"2025-10-06"}]},"metasploit":[{"name":"Oracle E-Business Suite CVE-2025-61882 RCE","module":"exploit/multi/http/oracle_ebs_cve_2025_61882_exploit_rce","type":"exploit","disclosureDate":"2025-10-04","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb"}],"nuclei":[{"id":"CVE-2025-61882","name":"Oracle E-Business Suite 12.2.3–12.2.14 – Remote Code Execution","severity":"critical","path":"http/cves/2025/CVE-2025-61882.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-61882.yaml"}],"first":{"date":"2025-10-04","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1078"],"provenance":"ai"}],"timeline":[{"date":"2025-10-04","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2025-10-05","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb","provenance":"source"},{"date":"2025-10-04","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blogs.oracle.com/security/post/apply-july-2025-cpu","provenance":"source"},{"date":"2025-10-05","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61882","provenance":"source"},{"date":"2025-10-06","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-10-06","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-32142","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":1},"priority":{"score":79.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 391 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9995"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"12 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}