CVE-2025-61882 — Oracle E-Business Suite Unauthenticated Remote Code Execution

CVSS 9.8 CRITICAL

Overview

CVE-2025-61882 is an unauthenticated remote code execution vulnerability in Oracle E-Business Suite (EBS), affecting the Concurrent Processing and BI Publisher components. The flaw allows an unauthenticated attacker with network access via HTTP to completely compromise the target system. It has been exploited in the wild by the Clop ransomware group among others, and was added to the CISA Known Exploited Vulnerabilities (KEV) catalog in October 2025.

Technical Details

The vulnerability resides in the way Oracle EBS handles deserialization of untrusted data within the Concurrent Processing / BI Publisher subsystems. By sending a crafted serialized object payload to exposed endpoints, an attacker can achieve arbitrary code execution on the Oracle EBS application server. No authentication is required, and the attack complexity is low.

Affected Versions

• Oracle E-Business Suite 12.2.3 through 12.2.14
• Both Concurrent Processing and BI Publisher components are affected

Reproduction Steps

1. Identify a target running Oracle EBS 12.2.3–12.2.14 with BI Publisher or Concurrent Processing exposed.
2. Confirm the target is reachable on the relevant HTTP(s) port.