CVE-2025-61882: Hackers Jump to a Zero-Day in Oracle E-Business Suite
The CrowdSec Network has detected a wave of exploitation attempts targeting CVE-2025-61882 in Oracle E-Business Suite. This vulnerability, disclosed just eight days ago, allows unauthenticated attackers to take control of the Concurrent Processing component of the software. With a CVSS score of 9.8, the vulnerability is considered critical. CrowdSec intelligence reveals that 45 distinct threat actors are already exploiting this vulnerability within one week of release. The vulnerability affects Oracle E-Business Suite versions 12.2.3 through 12.2.14, covering the majority of active enterprise deployments globally.
Key findings
CrowdSec has been tracking this vulnerability since the 9th of October.
Exploitation attempts have been discovered almost immediately after the release of the detection rule, with attacks showing no sign of stopping.
As reported by Hacker News, CVE-2025-61882 is the second critical vulnerability to hit the E-Business Suite within the last 14 days, with CVE-2025-61884 being disclosed this Saturday.
What is Oracle EBS
Oracle E-Business Suite functions as the central nervous system for enterprise operations—managing everything from human resources to financial reporting. CVE-2025-61882 exploits a flaw in the BI Publisher Integration component, allowing attackers to bypass all security controls through crafted HTTP requests. What makes this particularly dangerous is the combination of widespread deployment and the critical nature of the data these systems handle: employee records, financial transactions, and proprietary business intelligence.
...
