---
id: "CVE-2025-61882"
kind: "vulnerability"
aliases: ["CVE-2025-61882"]
title: "Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Oracle E-Business Suite", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "oracle concurrent processing", "fixed": [], "affected": ">= 12.2.3, <= 12.2.14", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["bi-publisher", "exploited", "on-premises", "oracle-e-business-suite", "ransomware", "vendor"]
not_affected_if: ["managed-hosting"]
published_at: "2025-10-05T04:15:40+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-61882", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61882", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher…

Oracle E-Business Suite's BI Publisher Integration component has an unspecified flaw that lets an unauthenticated attacker over HTTP take over Oracle Concurrent Processing. CISA lists it as actively exploited, with ransomware use tagged in the catalog.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle E-Business Suite affected ? fixed ?
- vendor:oracle concurrent processing affected >= 12.2.3, <= 12.2.14 fixed ?

## Fix

Apply the mitigations Oracle publishes for CVE-2025-61882; the sources do not name a patched version. If no mitigation is available, CISA says to discontinue use of the product.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-61882
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-61882

## From the sources

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_