CVE-2025-61882: listed in the CISA KEV catalog

CVE-2025-61882 · CVSS 9.8 CRITICAL · EPSS 99.7% · KEV 2025-10-06

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Is CVE-2025-61882 exploited?

Listed in the CISA KEV catalog on 2025-10-06.
Federal remediation due 2025-10-27.
Past that date by 292 days.
Used in ransomware campaigns.
EPSS puts exploitation in the next 30 days at 99.7%.
Public exploit code: packaged in a public tool.
Public detection rules exist.

Which products and versions are affected?

No affected package list recorded here yet.

Is there a patch?

No patch identifier recorded here yet.

What PlainSec published about CVE-2025-61882

Oracle ERP Flaw Reaches HR Data (2026-07-22)
Exposed Oracle EBS Servers Become a Mass Target (2026-07-02)
Node Kernel Bugs on GKE COS Nodes Enable Host Escalation (2026-04-15)
Google Cloud Issues Multiple Linux Kernel Privilege Escalation Fixes for GKE Nodes (2026-04-07)
Multiple Linux Kernel Flaws Elevate Privileges on GCP Container Nodes (2026-04-03)
Multiple High-Severity Cloud Vulnerabilities Impact Container Nodes (2026-04-01)
Voice Phishing Drives 11% of Intrusions in 2025 (2026-03-25)
90 Zero-Days Hit Enterprise Security and Networking Devices (2026-03-07)

Primary sources

What this record does not say

No affected package data.
No patch identifier.

KEV and EPSS are re-checked daily. Record last updated 2026-08-15.