CVE-2025-61882

KEV

🔴 Łataj teraz

Luka w Oracle E-Business Suite pozwala zdalnie przejąć kontrolę nad procesowaniem równoległym.

CVSS

9.8

EPSS

99.7%

Exploit

weaponized

Vendor

oracle

Opis źródłowy (NVD)

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

brak Brak patcha

Źródła i daty

Źródło	Wartość
NVD – CVSS	9.8
CISA KEV (aktywnie wykorzystywane)	Tak
FIRST EPSS (prawdopodobieństwo exploita)	99.7%
Opublikowano (NVD)	2025-10-05 04:15:40 UTC
Ostatnia modyfikacja (NVD)	2026-08-04 05:16:36 UTC

Referencje

https://www.oracle.com/security-alerts/alert-cve-2025-61882.html (secalert_us@oracle.com) [Vendor Advisory]
https://blogs.oracle.com/security/post/apply-july-2025-cpu (134c704f-9b21-4f2e-91b3-4a467353bcc0) [Vendor Advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61882 (134c704f-9b21-4f2e-91b3-4a467353bcc0) [US Government Resource]
https://www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/ (134c704f-9b21-4f2e-91b3-4a467353bcc0) [Press/Media Coverage]