Security readout for executives and security teams
Plain-English summary
Oracle E-Business Suite has a critical flaw that lets an attacker on the internet take over the system without a password or any user clicking anything. Oracle issued an emergency advisory and CISA added it to the Known Exploited Vulnerabilities catalog, meaning attackers are actively using it. Any business running affected E-Business Suite versions should treat this as an urgent patching priority.
Executive priority
Treat as a top-tier emergency. This flaw is being exploited in the wild against Oracle E-Business Suite, a system commonly tied to finance and ERP operations. Authorize out-of-cycle patching, hunting, and exposure review now; delay risks data theft, fraud, and operational disruption with potential regulatory and audit consequences.
Technical view
CVE-2025-61882 is an unauthenticated remote code execution vulnerability in the BI Publisher Integration component of Oracle Concurrent Processing within Oracle E-Business Suite versions 12.2.3 through 12.2.14. CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with full confidentiality, integrity, and availability impact. CWE-287 (Improper Authentication) applies. Oracle published an out-of-cycle Security Alert addressing the issue.
Likely exposure
Internet-reachable Oracle E-Business Suite 12.2.3–12.2.14 deployments with the Concurrent Processing/BI Publisher Integration component exposed over HTTP are at highest risk. Internal-only EBS environments still face threat from any network-adjacent attacker. Many enterprises run EBS for finance, HR, and supply chain, so exposure is often broad and business-critical.
Exploitation context
Active exploitation is confirmed: CISA added CVE-2025-61882 to the Known Exploited Vulnerabilities catalog, and CrowdStrike published research identifying a campaign targeting Oracle E-Business Suite using this zero-day. Oracle issued an out-of-cycle Security Alert. The vulnerability requires no authentication and no user interaction over the network.
Researcher notes
Vulnerability sits in BI Publisher Integration within Oracle Concurrent Processing. CWE-287 plus a 9.8 CVSS and unauthenticated network vector point to an authentication-bypass leading to takeover. CrowdStrike attributes a targeted campaign exploiting this as a zero-day prior to Oracle's alert. Validate patch chain dependencies; some Oracle alerts require prerequisite CPUs. Track CISA KEV due date and Oracle advisory updates for additional affected components or workarounds.
Mitigation direction
- Apply Oracle's Security Alert patch for CVE-2025-61882 to all EBS 12.2.3–12.2.14 environments immediately.
- Restrict internet exposure of Oracle Concurrent Processing and BI Publisher endpoints behind VPN or allow-lists.
- Follow Oracle's July 2025 Critical Patch Update guidance and any referenced prerequisite patches.
- Hunt for indicators of compromise published in CrowdStrike's reporting on the EBS zero-day campaign.
- Engage Oracle Support if patching is blocked to obtain interim vendor guidance.
- Increase WAF and network monitoring around EBS HTTP services until patches are verified.
Validation and detection
- Inventory all Oracle E-Business Suite instances and confirm versions against the 12.2.3–12.2.14 affected range.
- Verify patch level against Oracle's CVE-2025-61882 Security Alert advisory after deployment.
- Review web server, EBS Concurrent Processing, and BI Publisher logs for anomalous unauthenticated requests.
- Check endpoint and EDR telemetry against CrowdStrike-published indicators tied to the campaign.
- Confirm CISA KEV remediation deadline is tracked and reported in vulnerability management records.
- Re-test external attack surface to ensure EBS HTTP services are not unintentionally exposed.
Public sources used
Michael Williams reviewed this cited source version on .
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-287: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-61882 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- Oracle AdvisoryCVE reference · vendor-advisory
- https://blogs.oracle.com/security/post/apply-july-2025-cpuCVE reference · vendor-advisory
- https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/CVE reference · third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61882CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Authentication
Improper Authentication represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.