CVE DatabaseCVE-2025-61882

Updated 2026-10-09한국어 권고문 →

CVE-2025-618829.8/CRITICALCISA KEVCWE-287

CVE-2025-61882 Technical Vulnerability Analysis & Patch Advisory (CVSS 9.8)

⚡ Jump to Patch

Affected Vendors

security-advisory

Affected Components

enterprise-software

Published Date

2025-10-05

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

99.7%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Systems running unpatched versions impacted by CVE-2025-61882

Impact

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versi...

Mitigation

Apply vendor security patches and restrict external network exposure.

Affected Products & Version Scope

All unpatched versions listed in the official NVD CPE configurations

Remediation & Live Workaround Commands

PATCH & WORKAROUND

Remediation Steps

Upgrade to the latest patched release from the vendor.
Apply virtual patching or network segmentation until maintenance windows allow full patching.

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Reduce your attack surface immediately with automated vulnerability scanning and runtime protection.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

Technical Overview

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Score: 9.8 (CRITICAL)
CWE IDs: CWE-287

Official Vendor Advisories & References

NVD Original English Description

https://www.oracle.com/security-alerts/alert-cve-2025-61882.html

Source: secalert_us@oracle.com · Vendor Advisory

https://blogs.oracle.com/security/post/apply-july-2025-cpu

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61882

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Press/Media Coverage

Frequently Asked SecOps Questions (CVE-2025-61882)

FAQ

Q1. How critical is CVE-2025-61882 and is it actively exploited in the wild?

CVE-2025-61882 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2025-61882?

Primary impacted vendors include security-advisory across enterprise-software. Scope summary: All unpatched versions listed in the official NVD CPE configurations

Q3. What temporary mitigations or workarounds exist for CVE-2025-61882 before patching?

[Mitigation] Apply vendor security patches and restrict external network exposure. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION

Generate an Internal Engineering Notice or CISO Report for CVE-2025-61882

Instantly format this advisory into an executive CISO summary or engineering patch ticket.

Generate Report →

🔗 Related Advisories in Similar Stack (security-advisory)

View Category →

CVE-2026-1201147.2/HIGH

EPSS 0.4%

CVE-2026-120114 Technical Vulnerability Analysis & Patch Advisory (CVSS 7.2)

[Affected Scope] Systems running unpatched versions impacted by CVE-2026-120114

CVE-2026-2012710.0/CRITICALCISA KEV

EPSS 87.6%

Cisco Catalyst SD-WAN Authentication Bypass and Admin Privilege Escalation (CVE-2026-20127) Critical Security Advisory

[Affected Scope] Cisco Catalyst SD-WAN Controller (formerly vSmart), Cisco Catalyst SD-WAN Manager (formerly vManage), and Cisco Catalyst SD-WAN Validator (formerly vBond).

CVE-2026-468179.8/CRITICALCISA KEV

EPSS 12.3%

Oracle E-Business Suite Payments File Transmission Authentication Bypass and Remote Code Execution (CVE-2026-46817)

[Affected Scope] Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, specifically the Oracle Payments (File Transmission) component

CVE-2026-598228.2/HIGHCISA KEV

EPSS 0.8%

LiteLLM MCP Streamable Endpoint Authentication Bypass Vulnerability (CVE-2026-59822)

[Affected Scope] LiteLLM proxy server and AI Gateway environments running versions prior to 1.84.0

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed:

PatchKO