Oracle E-Business Suite Unspecified Vulnerability

cve CVE-2025-61882 2 sources, 2 claims · Watch

CISA Known Exploited Vulnerabilities writes:
Oracle E-Business Suite Unspecified Vulnerability Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://www.oracle.com/security-alerts/alert-cve-2025-61882.html ; https://nvd… the claim

What each source says

PropertySourceSaidMeans here
Due date
due_date
CISA Known Exploited Vulnerabilities2025-10-27
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
2025-10-27
Read by
field:dueDate
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 18:00 UTC
What the source handed over
{
  "cveID": "CVE-2025-61882",
  "cwes": "",
  "dateAdded": "2025-10-06",
  "dueDate": "2025-10-27",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Known",
  "notes": "https://www.oracle.com/security-alerts/alert-cve-2025-61882.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-61882",
  "product": "E-Business Suite",
  "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.",
  "vendorProject": "Oracle",
  "vulnerabilityName": "Oracle E-Business Suite Unspecified Vulnerability"
}
—
Exploited
exploited
CISA Known Exploited Vulnerabilitiesyes
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
yes
Read by
const:yes
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 18:00 UTC
What the source handed over
{
  "cveID": "CVE-2025-61882",
  "cwes": "",
  "dateAdded": "2025-10-06",
  "dueDate": "2025-10-27",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Known",
  "notes": "https://www.oracle.com/security-alerts/alert-cve-2025-61882.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-61882",
  "product": "E-Business Suite",
  "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.",
  "vendorProject": "Oracle",
  "vulnerabilityName": "Oracle E-Business Suite Unspecified Vulnerability"
}
—
Forensic triage
forensic_triage
CISA Known Exploited Vulnerabilitiesfalse
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
No
Read by
field:forensicTriage
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 18:00 UTC
What the source handed over
{
  "cveID": "CVE-2025-61882",
  "cwes": "",
  "dateAdded": "2025-10-06",
  "dueDate": "2025-10-27",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Known",
  "notes": "https://www.oracle.com/security-alerts/alert-cve-2025-61882.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-61882",
  "product": "E-Business Suite",
  "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.",
  "vendorProject": "Oracle",
  "vulnerabilityName": "Oracle E-Business Suite Unspecified Vulnerability"
}
—
Known ransomware campaign use
known_ransomware_campaign_use
CISA Known Exploited VulnerabilitiesKnown
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
Known
Read by
field:knownRansomwareCampaignUse
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 18:00 UTC
What the source handed over
{
  "cveID": "CVE-2025-61882",
  "cwes": "",
  "dateAdded": "2025-10-06",
  "dueDate": "2025-10-27",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Known",
  "notes": "https://www.oracle.com/security-alerts/alert-cve-2025-61882.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-61882",
  "product": "E-Business Suite",
  "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.",
  "vendorProject": "Oracle",
  "vulnerabilityName": "Oracle E-Business Suite Unspecified Vulnerability"
}
—
Platform
platform
Metasploit exploit modulesLinux,Unix,Windows
receipt
Source
Metasploit exploit modules
Its words
Linux,Unix,Windows
Read by
field:platform
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 17:59 UTC
Original
open at the source
What the source handed over
{
  "aliases": [],
  "arch": "cmd",
  "author": [
    "watchTowr (Sonny, Sina Kheirkhah, Jake Knott)",
    "Mathieu Dupas"
  ],
  "autofilter_ports": [
    80,
    8080,
    443,
    8000,
    8888,
    8880,
    8008,
    3000,
    8443
  ],
  "autofilter_services": [
    "http",
    "https"
  ],
  "check": true,
  "default_credential": false,
  "description": "This module exploits CVE-2025-61882 in Oracle E-Business Suite\n          by combining SSRF, Path Traversal, HTTP request smuggling and XSLT injection.\n\n          The exploit hosts a malicious XSL file\n          that the target will fetch and process, leading to RCE.\n\n          This module provides an interactive shell session.\n          Vulnerable versions affected are 12.2.3-12.2.14.",
  "disclosure_date": "2025-10-04",
  "fullname": "exploit/multi/http/oracle_ebs_cve_2025_61882_exploit_rce",
  "is_install_path": true,
  "mod_time": "2026-04-22 11:57:58 +0000",
  "name": "Oracle E-Business Suite CVE-2025-61882 RCE",
  "needs_cleanup": null,
  "notes": {
    "Reliability": [
      "repeatable-session"
    ],
    "SideEffects": [
      "artifacts-on-disk",
      "ioc-in-logs"
    ],
    "Stability": [
      "crash-safe"
    ]
  },
  "path": "/modules/exploits/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb",
  "platform": "Linux,Unix,Windows",
  "post_auth": false,
  "rank": 600,
  "ref_name": "multi/http/oracle_ebs_cve_2025_61882_exploit_rce",
  "references": [
    "CVE-2025-61882",
    "URL-https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/",
    "URL-https://www.oracle.com/security-alerts/alert-cve-2025-61882.html"
  ],
  "rport": 8000,
  "session_types": false,
  "targets": [
    "Linux/Unix (Interactive Shell)",
    "Windows (Interactive Shell)"
  ],
  "type": "exploit"
}
—
Product
product
CISA Known Exploited VulnerabilitiesE-Business Suite
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
E-Business Suite
Read by
field:product
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 18:00 UTC
What the source handed over
{
  "cveID": "CVE-2025-61882",
  "cwes": "",
  "dateAdded": "2025-10-06",
  "dueDate": "2025-10-27",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Known",
  "notes": "https://www.oracle.com/security-alerts/alert-cve-2025-61882.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-61882",
  "product": "E-Business Suite",
  "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.",
  "vendorProject": "Oracle",
  "vulnerabilityName": "Oracle E-Business Suite Unspecified Vulnerability"
}
—
Rank
rank
Metasploit exploit modules600
Excellent. Cannot crash the service. A memory-corruption exploit does not qualify.
receipt
Source
Metasploit exploit modules
Its words
600
Read by
field:rank
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 17:59 UTC
Original
open at the source
What the source handed over
{
  "aliases": [],
  "arch": "cmd",
  "author": [
    "watchTowr (Sonny, Sina Kheirkhah, Jake Knott)",
    "Mathieu Dupas"
  ],
  "autofilter_ports": [
    80,
    8080,
    443,
    8000,
    8888,
    8880,
    8008,
    3000,
    8443
  ],
  "autofilter_services": [
    "http",
    "https"
  ],
  "check": true,
  "default_credential": false,
  "description": "This module exploits CVE-2025-61882 in Oracle E-Business Suite\n          by combining SSRF, Path Traversal, HTTP request smuggling and XSLT injection.\n\n          The exploit hosts a malicious XSL file\n          that the target will fetch and process, leading to RCE.\n\n          This module provides an interactive shell session.\n          Vulnerable versions affected are 12.2.3-12.2.14.",
  "disclosure_date": "2025-10-04",
  "fullname": "exploit/multi/http/oracle_ebs_cve_2025_61882_exploit_rce",
  "is_install_path": true,
  "mod_time": "2026-04-22 11:57:58 +0000",
  "name": "Oracle E-Business Suite CVE-2025-61882 RCE",
  "needs_cleanup": null,
  "notes": {
    "Reliability": [
      "repeatable-session"
    ],
    "SideEffects": [
      "artifacts-on-disk",
      "ioc-in-logs"
    ],
    "Stability": [
      "crash-safe"
    ]
  },
  "path": "/modules/exploits/multi/http/oracle_ebs_cve_2025_61882_exploit_rce.rb",
  "platform": "Linux,Unix,Windows",
  "post_auth": false,
  "rank": 600,
  "ref_name": "multi/http/oracle_ebs_cve_2025_61882_exploit_rce",
  "references": [
    "CVE-2025-61882",
    "URL-https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/",
    "URL-https://www.oracle.com/security-alerts/alert-cve-2025-61882.html"
  ],
  "rport": 8000,
  "session_types": false,
  "targets": [
    "Linux/Unix (Interactive Shell)",
    "Windows (Interactive Shell)"
  ],
  "type": "exploit"
}
—
Vendor project
vendor_project
CISA Known Exploited VulnerabilitiesOracle
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
Oracle
Read by
field:vendorProject
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 18:00 UTC
What the source handed over
{
  "cveID": "CVE-2025-61882",
  "cwes": "",
  "dateAdded": "2025-10-06",
  "dueDate": "2025-10-27",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Known",
  "notes": "https://www.oracle.com/security-alerts/alert-cve-2025-61882.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-61882",
  "product": "E-Business Suite",
  "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.",
  "vendorProject": "Oracle",
  "vulnerabilityName": "Oracle E-Business Suite Unspecified Vulnerability"
}
—

vulnerability

Oracle E-Business Suite Unspecified Vulnerability
zetlyn/cve-kev · 2025-10-06
due_date 2025-10-27 exploited yes forensic_triage false known_ransomware_campaign_use Known product E-Business Suite vendor_project Oracle

exploit

Oracle E-Business Suite CVE-2025-61882 RCE
zetlyn/cve-metasploit · 2025-10-04
platform Linux,Unix,Windows rank 600 source