Introduction
Attackers can seize control of Oracle E-Business Suite environments without authenticating, by exploiting a critical flaw in the Concurrent Processing (BI Publisher Integration) component. The flaw, tracked as CVE-2025-61882, exposes thousands of enterprises to remote compromise through a single HTTP request.
About Oracle and E-Business Suite: Oracle is one of the world's largest enterprise software vendors. Thousands of organizations worldwide run their ERP, financials, supply chain, and HR on Oracle E-Business Suite (EBS). EBS is a highly integrated suite, and its security directly affects business operations across industries.
Technical information
CVE-2025-61882 is a critical vulnerability in the BI Publisher Integration component of Oracle Concurrent Processing within Oracle E-Business Suite. An unauthenticated attacker can send specially crafted HTTP requests to the affected component. A successful exploit means full system compromise: the attacker can access sensitive data, modify configurations, and disrupt operations.
- Attack vector: Network (HTTP)
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Scope: Unchanged
- Impact: High (Confidentiality, Integrity, Availability)
- CVSS 3.1 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The flaw is reachable through HTTP endpoints associated with the BI Publisher Integration. It needs no authentication and no user interaction. It is also easy to exploit, which makes it suitable for automated attacks. No public code snippets or proof-of-concept details are available yet.
Affected systems and versions
- Product: Oracle E-Business Suite (Concurrent Processing, BI Publisher Integration component)
- Affected versions: 12.2.3 through 12.2.14
- Vulnerable configurations: Any Oracle EBS deployment that exposes the Concurrent Processing HTTP endpoints is at risk.
Vendor security history
Oracle E-Business Suite has had critical, remotely exploitable vulnerabilities before. The July 2025 Critical Patch Update fixed nine EBS vulnerabilities, three of them critical and exploitable without authentication. Oracle has also issued out-of-cycle security alerts for severe issues, including CVE-2025-61882, and an out-of-cycle alert signals that the risk of real-world exploitation is urgent. Oracle generally patches critical EBS flaws promptly, but complex customer environments often delay adoption of those patches.
References
- Oracle Security Alert for CVE-2025-61882
- Official CVE Entry
- Infosecurity Magazine: Hackers Target Oracle EBS Flaws
- SecurityWeek: Cybercriminals Claim Theft of Data from Oracle E-Business Suite Customers
- Help Net Security: Oracle EBS Data Theft Extortion
- Arctic Wolf: Alleged Cl0p Extortion Emails Linked to July 2025 Oracle E-Business Suite Vulnerabilities
