cve-2025-61882

{
  "cvss": 9.8,
  "datePublished": "2025-10-05T04:15:40.340",
  "dateUpdated": "2026-10-09T10:10:00.193",
  "description": "Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).",
  "id": "CVE-2025-61882",
  "raw": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "Oracle Concurrent Processing",
            "vendor": "Oracle Corporation",
            "versions": [
              {
                "lessThanOrEqual": "12.2.14",
                "status": "affected",
                "version": "12.2.3",
                "versionType": "custom"
              }
            ]
          }
        ],
        "source": "secalert_us@oracle.com"
      }
    ],
    "cisaActionDue": "2025-10-27",
    "cisaExploitAdd": "2025-10-06",
    "cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
    "cisaVulnerabilityName": "Oracle E-Business Suite Unspecified Vulnerability",
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:oracle:concurrent_processing:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "AD6FCD78-CA2D-4594-A5FA-EDD501044E9F",
                "versionEndIncluding": "12.2.14",
                "versionStartIncluding": "12.2.3",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."
      },
      {
        "lang": "es",
        "value": "Vulnerabilidad en el producto Oracle Concurrent Processing de Oracle E-Business Suite (componente: BI Publisher Integration). Las versiones compatibles que están afectadas son 12.2.3-12.2.14. Una vulnerabilidad fácilmente explotable permite a un atacante no autenticado con acceso a la red vía HTTP comprometer Oracle Concurrent Processing. Los ataques exitosos de esta vulnerabilidad pueden resultar en la toma de control de Oracle Concurrent Processing. Puntuación Base CVSS 3.1 de 9.8 (impactos en Confidencialidad, Integridad y Disponibilidad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."
      }
    ],
    "id": "CVE-2025-61882",
    "lastModified": "2026-10-09T10:10:00.193",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.9,
          "source": "secalert_us@oracle.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-61882",
            "options": [
              {
                "exploitation": "active"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-10-06T00:00:00+00:00",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-10-05T04:15:40.340",
    "references": [
      {
        "source": "secalert_us@oracle.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://www.oracle.com/security-alerts/alert-cve-2025-61882.html"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://blogs.oracle.com/security/post/apply-july-2025-cpu"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "US Government Resource"
        ],
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61882"
      },
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "tags": [
          "Press/Media Coverage"
        ],
        "url": "https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/"
      }
    ],
    "sourceIdentifier": "secalert_us@oracle.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-287"
          }
        ],
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "severity": "CRITICAL",
  "source": "nvd",
  "title": "Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integra..."
}