NCSC Warns of Active Exploitation of Oracle E-Business Suite Vulnerability
Summary
The NCSC warns that CVE-2025-61882 is actively exploited and may enable unauthenticated remote code execution in Oracle E-Business Suite versions 12.2.3–12.2.14.
Key points
- The vulnerability affects the BI Publisher Integration component of Oracle Concurrent Processing in Oracle E-Business Suite.
- Attackers can send specially crafted HTTP requests without authentication or user interaction to potentially achieve full system compromise.
- Oracle E-Business Suite versions 12.2.3 to 12.2.14 are affected; internet-exposed systems are at greatest risk.
- The NCSC urges affected organisations to perform a compromise assessment and review the indicators of compromise in Oracle’s advisory.
- Organisations that suspect compromise should contact Oracle PSIRT; UK organisations should also report it to the NCSC.
Article Details
- Vulnerability Types
- Unauthenticated remote code execution
- Affected Versions
- Oracle E-Business Suite 12.2.3 to 12.2.14
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available