CVE-2025-61882 is an unauthenticated, remotely exploitable vulnerability in the BI Publisher Integration component of Oracle E-Business Suite (Oracle Concurrent Processing) that allows full takeover of that component over HTTP, and it was exploited as a zero-day in a mass data-theft and extortion campaign against EBS customers before Oracle's October 2025 patch.
Vulnerability summary
9.8
Critical
99.7%
EPSS score (FIRST)
Yes
CISA KEV catalog
2025-10-05
Published
Vulnerability ID: CVE-2025-61882 · Source: NVD (CNA/Oracle score, not yet NVD Primary)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Oracle E-Business Suite (Oracle Concurrent Processing / BI Publisher Integration) | cpe:2.3:a:oracle:e-business_suite:*:*:*:*:*:*:*:* | 12.2.3 through 12.2.14 |
What this means
CVE-2025-61882 affects the Oracle Concurrent Processing product of Oracle E-Business Suite, specifically the BI Publisher Integration component, on supported versions 12.2.3-12.2.14. NVD describes it as an "easily exploitable vulnerability" that "allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing," with successful attacks resulting in "takeover of Oracle Concurrent Processing" (NVD).
The CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In NVD's own CVE 2.0 API record, this score is listed as a Secondary metric sourced from Oracle's own PSIRT ([email protected]) — NVD has not yet published an independent Primary score for this CVE, so the 9.8 figure is Oracle/CNA-sourced rather than NVD-confirmed (NVD).
Oracle's own Security Alert advisory states the flaw "is remotely exploitable without authentication" and "may result in remote code execution," lists the affected product as Oracle E-Business Suite versions 12.2.3-12.2.14 (component: BI Publisher Integration, protocol: HTTP), and credits CrowdStrike and Mandiant for reporting. The advisory also publishes indicators of compromise, including two IP addresses observed in GET/POST activity and file hashes for a proof-of-concept archive named referencing "scattered_lapsus_retard" and "cl0p_hunters" (Oracle Security Alert Advisory CVE-2025-61882).
CISA added CVE-2025-61882 to the Known Exploited Vulnerabilities (KEV) catalog on 2025-10-06, with a required-action due date of 2025-10-27, and the catalog marks knownRansomwareCampaignUse as "Known." CISA's short description matches NVD's: unauthenticated attacker with network access via HTTP can compromise Oracle Concurrent Processing via the BI Publisher Integration component (CISA KEV).
CrowdStrike, cited as a reference source in NVD's own record, reported that it assesses "with moderate confidence" that the actor it tracks as GRACEFUL SPIDER is likely involved in the campaign exploiting this vulnerability, that first known exploitation occurred around August 9, 2025, and that on September 29, 2025 the actor emailed multiple organizations claiming to have accessed and exfiltrated data from victims' Oracle EBS applications using "Clop"-branded messaging; CrowdStrike notes these attribution and exfiltration assessments are made with "moderate confidence" (CrowdStrike). Oracle publicly disclosed and patched the vulnerability on October 4, 2025, as part of a Security Alert (with the October 2023 Critical Patch Update as a prerequisite for applying the fix) (Oracle Security Alert Advisory CVE-2025-61882).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.9973 (99.953rd percentile), among the highest EPSS scores possible, consistent with confirmed in-the-wild mass exploitation and continued scanning (FIRST EPSS).
Any Oracle E-Business Suite 12.2.3-12.2.14 environment should be confirmed patched per Oracle's Security Alert, checked against the published IOCs, and reviewed for signs of prior compromise given the confirmed pre-patch exploitation and KEV-recorded ransomware/extortion use.
Evidence
- Unauthenticated, network-exploitable vulnerability in the BI Publisher Integration component of Oracle E-Business Suite / Oracle Concurrent Processing, affecting versions 12.2.3-12.2.14, resulting in takeover of the component. — NVD
- CVSS v3.1 base score 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; in NVD's record this is a Secondary metric sourced from Oracle's PSIRT ([email protected]), not an NVD Primary score. — NVD
- Oracle's Security Alert confirms the vulnerability is remotely exploitable without authentication, may result in remote code execution, affects E-Business Suite 12.2.3-12.2.14, and credits CrowdStrike and Mandiant; the advisory publishes IOCs including IPs and file hashes referencing a POC archive named with the 'cl0p_hunters' string. — Oracle Security Alert Advisory CVE-2025-61882
- Added to the CISA Known Exploited Vulnerabilities catalog on 2025-10-06, due date 2025-10-27, knownRansomwareCampaignUse recorded as 'Known'. — CISA KEV
- CrowdStrike assesses with moderate confidence that the actor it tracks as GRACEFUL SPIDER is likely involved in the campaign, with first known exploitation around August 9, 2025 and Clop-branded extortion emails sent to victims on September 29, 2025. — CrowdStrike
- EPSS score is 0.9973 (99.953rd percentile) as of 2026-10-30. — FIRST EPSS
