Description
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Oracle | Oracle Concurrent Processing | 12.2.3 – ≤ 12.2.14 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Oracle E-Business Suite CVE-2025-61882 RCE
exploit/multi/http/oracle_ebs_cve_2025_61882_exploit_rce
GitHub 13 repositories · most starred shown
-
watchtowrlabs/watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882 ★ 55 · Oct 6, 2025
-
rxerium/CVE-2025-61882-CVE-2025-61884 ★ 36 · Oct 5, 2025
Detection for CVE-2025-61882 & CVE-2025-61884
-
zerozenxlabs/CVE-2025-61882-Oracle-EBS ★ 20 · Oct 10, 2025
-
AdityaBhatt3010/CVE-2025-61882-Oracle-E-Business-Suite-Pre-Auth-RCE-Exploit ★ 12 · Oct 16, 2025
A critical pre-authentication Remote Code Execution (RCE) flaw in Oracle E-Business Suite (versions 12.2.3 - 12.2.14) allows attackers to gain full control over vulnerable servers via malicious HTTP …
-
Sachinart/CVE-2025-61882 ★ 11 · Oct 6, 2025
Exploit for CVE-2025-61882 (do not use without any written permission).
-
BattalionX/http-oracle-ebs-cve-2025-61882.nse ★ 2 · Oct 23, 2025
Detects Oracle E-Business Suite (CVE-2025-61882). Detection: multi-tier checks — fingerprinting, version checks, endpoint & SSRF tests, timing analysis & controlled exploitation 4 high-confidence res…
-
George0Papasotiriou/CVE-2025-61882-Oracle-BI-Publisher-RCE ★ 1 · Feb 10, 2026
-
Zhert-lab/CVE-2025-61882-CVE-2025-61884 ★ 0 · Nov 21, 2025
Sorumluluk Reddi Kendi sorumluluğunuzda kullanın, size ait olmayan veya tarama izninizin olmadığı altyapılarda gerçekleştireceğiniz yasa dışı faaliyetlerden sorumlu olmayacağım.
-
222dff-afk/Blackash-CVE-2025-61882 ★ 0 · Oct 17, 2025
CVE-2025-61882
-
MindflareX/CVE-2025-61882-POC ★ 0 · Oct 16, 2025
POC of CVE-2025-61882
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Oracle E-Business Suite 12.2.3–12.2.14 – Remote Code Execution http/cves/2025/CVE-2025-61882.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 2
- WID-SEC-2025-2195 Oracle E-Business Suite: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Oct 21, 2025
- NCSC-2025-0303 Kwetsbaarheid verholpen in Oracle E-Business Suite NCSC-NL (Netherlands) · Oct 8, 2025
References
- Oracle Advisory vendor-advisory