Article
Exploited vulnerabilities in 2025: what ENISA reports
This is a short list of what ENISA reports about exploited vulnerabilities in 2025. It draws on chapter 7 and the overview of the…
Read more
Exploited vulnerability
Oracle E-Business Suite remote code execution (CVE-2025-61882)
CVE-2025-61882
- On CISA KEV
- CVE ID
- CVE-2025-61882
- CISA KEV
- Listed
- Affected product
- E-Business Suite (Oracle Concurrent Processing, BI Publisher Integration component)
- Exploited
- Yes
- Published
- October 2025
In short
CVE-2025-61882 is a flaw in the BI Publisher Integration part of Oracle Concurrent Processing, which is a component of Oracle E-Business Suite (EBS), a business software suite for finance and operations. A remote user with no account can send web requests and take over that component. Oracle says it may result in remote code execution, which means running attacker commands on the server.
- CVECVE-2025-61882
- ProductOracle E-Business Suite (Oracle Concurrent Processing, BI Publisher Integration component)
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps4actions listedInstall the Oracle update · Take EBS off the internet
What it allows
An attacker with network access over HTTP and no username or password can take over Oracle Concurrent Processing and may run code on the server. Oracle and NVD both score it 9.8 out of 10 (CVSS v3.1). The UK NCSC says that organizations that have exposed EBS to the internet are at greatest risk.
Who is affected
Per the Oracle alert, Oracle E-Business Suite versions 12.2.3 to 12.2.14. Oracle says earlier versions are likely affected too, but it does not test them, and it recommends moving to a supported version. The October 2023 Critical Patch Update must be installed before the update in this alert.
Oracle released its security alert on 4 October 2025 and revised it on 6 October 2025 to clarify the indicators of compromise. NVD published the record on 5 October 2025. The UK NCSC states the flaw is being actively exploited. The sources opened here do not give a date for the first exploitation.
CISA added CVE-2025-61882 to its Known Exploited Vulnerabilities (KEV) catalog on 6 October 2025, with a due date of 27 October 2025 for US federal agencies. The KEV entry flags known use in ransomware campaigns. The Canadian Cyber Centre alert of 7 October 2025 also records the KEV addition.
No official source opened here names an actor behind the exploitation. Some file names inside Oracle's indicator list contain group names, but Oracle does not attribute the attacks to anyone, so this page does not either.
What to do
-
Install the Oracle update
Apply the update from the Oracle alert for EBS 12.2.3 to 12.2.14. Install the October 2023 Critical Patch Update first, because Oracle lists it as a prerequisite. Plan a move off unsupported versions.
-
Take EBS off the internet
The NCSC advises keeping as little software as possible directly reachable from the internet. Where EBS must be exposed, follow Oracle's deployment guidelines.
-
Assume compromise and assess
The NCSC advises a compromise assessment using Oracle's published indicators. If you think you were compromised, contact Oracle PSIRT, and in the UK report to the NCSC.
-
Detect and hunt
Oracle lists two IP addresses (200[.]107[.]207[.]26 and 185[.]181[.]60[.]11) tied to GET and POST activity, a reverse shell command that opens an outbound TCP connection, and file hashes. Search web, proxy and server logs for them. The NCSC also advises continuous network monitoring and threat hunting.
Questions
What is CVE-2025-61882?
CVE-2025-61882 is a flaw in the BI Publisher Integration part of Oracle Concurrent Processing in Oracle E-Business Suite. A remote attacker with no account can send web requests and may run code on the server. Oracle and NVD both score it 9.8.
Which Oracle E-Business Suite versions are affected?
Oracle lists E-Business Suite versions 12.2.3 to 12.2.14. Earlier versions are likely affected too, but Oracle does not test them and recommends moving to a supported version.
Is CVE-2025-61882 being exploited?
Yes. The UK NCSC states it is being actively exploited, and CISA added it to the Known Exploited Vulnerabilities catalog on 6 October 2025, flagging ransomware use. No official source opened for this page names an actor behind the attacks.
How do I defend against CVE-2025-61882?
Install the update from the Oracle alert, after the October 2023 Critical Patch Update that Oracle lists as a prerequisite. Keep EBS off the internet where possible, and run a compromise assessment using Oracle's published indicators.
In our research
Sources
- Oracle Security Alert Advisory - CVE-2025-61882 Oracle
- CVE-2025-61882 record NIST NVD
- Known Exploited Vulnerabilities catalog CISA
- CISA Adds Seven Known Exploited Vulnerabilities to Catalog (6 October 2025) CISA
- Active exploitation of vulnerability affecting Oracle E-Business Suite UK National Cyber Security Centre
- AL25-013 Vulnerability impacting Oracle E-Business Suite Canadian Centre for Cyber Security
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.