Input validation error in Oracle Concurrent Processing and Oracle E-Business Suite - CVE-2025-61882
Published: October 6, 2025 / Updated: January 22, 2026
Vulnerability identifier: #VU116601
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-61882
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input within the BI Publisher Integration component. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the system.
Note, the vulnerability is being actively exploited in the wild.
Affected software
Oracle Concurrent Processing
Oracle E-Business Suite
Oracle E-Business Suite
How to mitigate CVE-2025-61882
Install updates from vendor's website.
Oracle Concurrent Processing - update to 12.2.15
Oracle E-Business Suite - update to 12.2.15
Oracle E-Business Suite - update to 12.2.15
Links to Public Exploits and PoC-codes
- Exploit #12324 - Oracle E-Business Suite CVE-2025-61882 RCE (January 22, 2026)
- Exploit #12225 - CVE-2025-61882 (CVE-2025-61882: Oracle E-Business Suite RCE Scanner and Exploit ) (January 4, 2026)
- Exploit #12037 - CVE-2025-61882-Oracle-EBS (October 24, 2025)
- Exploit #12010 - CVE-2025-61882 (October 8, 2025)