Skip to content

CVE · Exploited · On CISA KEV

CVE-2025-61882

Oracle E-Business Suite Unspecified Vulnerability

9.8
CVSS 3.1
3
stories
OCT 6
added to KEV
Severity
9.8 Critical · vendor score
Vendor
Oracle
Product
E-Business Suite
Published
Oct 5, 2025
Added to KEV
Oct 6, 2025
KEV deadline
Oct 27, 2025
Ransomware use
Known
Weakness
CWE-287
Part of Oracle E-Business Suite Clop Attacks →

What it is

Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 3 stories

Newest first ↑
  1. Oracle Patches E-Business Suite Zero-Day Amid Clop Extortion AttacksOracle has patched a critical zero-day remote code execution flaw in its E-Business Suite, which was being exploited by the Clop gang in a rash of data theft and extortion attacks.LINDSEY O'DONNELL-WELCH · 2 MIN
  2. IntrusionsOracle Clop Data Theft Campaign Started Months AgoThe Clop extortion campaign on Oracle customers last week stemmed from months of intrusion activity tracking back to July 10.LINDSEY O'DONNELL-WELCH · 2 MIN
  3. VulnerabilitiesOracle Warns of E-Business Suite BugA Saturday advisory from Oracle’s CISO warned of a vulnerability impacting some deployments of E-Business Suite (CVE-2025-61884).LINDSEY O'DONNELL-WELCH · 1 MIN

Official references

5 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisoryoracle.com/security-alerts/alert-cve-2025-61882.htmlVendor advisoryblogs.oracle.com/security/post/apply-july-2025-cpu