CVE-2025-61882 Oracle Concurrent Processing
| Affected software | Oracle Concurrent Processing |
|---|---|
| Affected versions | 12.2.3-12.2.14 |
| Severity | 9.8 Critical CVSS 3.1 |
| Fixed in | Oracle Security Alert CVE-2025-61882 |
| Weakness | Improper authentication (CWE-287) |
| Published | 5 Oct 2025 |
| Updated | 20 Oct 2026 |
Description
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2025-10-06 · remediation due 2025-10-27 · ransomware use: known
- VulnCheck KEV listed Exploitation reported in the wild. 80 citations · honeypot sightings · 6 exploits · earliest 2025-10-04.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
- Indexed PoC 14 indexed Published artifacts you can open, in GitHub PoC, Metasploit, Nuclei; first seen 2025-10-05.
- EPSS 99.8% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2025-61882 in VulnCheck (free account), which lists 75 more citations and 1 more exploit reference not shown here.
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | Shadowserver honeypots | Exploitation attempts seen on 178 days | 2025-10-09 to 2026-09-21 |
| Reported exploitation | blogs.oracle.com | /security/post/apply-july-2025-cpu | 2025-10-04 |
| Reported exploitation | oracle.com | /security-alerts/alert-cve-2025-61882.html | 2025-10-04 |
| Reported exploitation | cybereason.com | /blog/oracle-ebs-extortion-cl0p | 2025-10-05 |
| Reported exploitation | linkedin.com | /feed/update/urn:li:activity:7380595612443893760 | 2025-10-05 |
| Reported exploitation | crowdstrike.com | /en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882 | 2025-10-06 |
| Exploit reference | VulnCheck XDB 1c3a7eaa6e6c | Exploit type: initial-access | 2025-10-06 |
| Exploit reference | VulnCheck XDB 8db320d42361 | Exploit type: initial-access | 2025-10-06 |
| Exploit reference | VulnCheck XDB dcdb633f53a3 | Exploit type: initial-access | 2025-10-10 |
| Exploit reference | VulnCheck XDB 677bed287c2d | Exploit type: infoleak | 2025-10-23 |
| Exploit reference | VulnCheck XDB 677bed287c2d | Exploit type: infoleak | 2025-10-24 |
Waratek protection
A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.
- Protection none
- Action feasible
- Review automated AI triage
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | An AI triage run set this CVE's status to Mitigation candidate. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Unauthenticated XSLT injection: an attacker-supplied stylesheet or XML Publisher template runs in Oracle's XSLT processor, whose http://www.oracle.com/XSL/Transform/java/ extensions can call any Java class. The ARMR Process rule (with /bin/*, /usr/bin/*, cmd.exe listed) stops the published exploits' Runtime.exec; reading data or loading a hidden webshell without starting a program is not stopped.
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Security Alert CVE-2025-61882 ↗ | Alert | 2025-Q4 | Oracle E-Business Suite / BI Publisher Integration (12.2.3-12.2.14) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle E-Business Suite | BI Publisher Integration | 12.2.3-12.2.14 |
Products and versions
1 product, 1 version entry| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | oracle | concurrent processing | generic | ≥ 12.2.3 and ≤ 12.2.14 |
References
Timeline
Timeline
| VulnCheck KEV: earliest evidence | 2025-10-04 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
|---|---|---|
| Published | 2025-10-05 | By the CVE Program. |
| Added to CISA KEV | 2025-10-06 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| VulnCheck KEV: latest evidence | 2026-09-30 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| NVD record modified | 2026-10-09 | NVD's own last-modified date for this record. |
| Last VRT activity | 2026-10-20 | Most recent commit touching this CVE's classification, patch or rule file. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |