CVE-2025-61882

Lets an attacker take over Oracle E-Business Suite without a password.

This vulnerability in Oracle E-Business Suite lets an attacker take over the system without needing a password. It affects versions 12.2.3 through 12.2.14. CISA warns that attackers are actively exploiting it, and Oracle has released an October 2026 security update to fix it.

Oracle Corporation Oracle Concurrent Processing · Updated 28 Oct · From 1 of our story and the public records

Being exploitedYesAttackers are using it

CISA known exploitedListedAdded 6 Oct; US agencies must fix by 27 Oct. Used by ransomware gangs

SeveritycriticalCVSS 9.8 of 10

FixNot yetSee what to do below

Am I affected?

The records do not list fixed versions yet. Check the vendor's advisory below.

What to do

Apply the October 2026 security update from Oracle immediately, as advised by the vendor and CISA.
Identify and patch all systems running the affected versions of Oracle E-Business Suite without delay.
Monitor your network for the active scanning activity that has been reported for this flaw.
Check CISA's Known Exploited Vulnerabilities Catalog for additional guidance.

What happened

6 OctCISA added the vulnerability to its Known Exploited Vulnerabilities catalog.
28 OctZotpaper reported attackers scanning the internet for vulnerable Oracle E-Business Suite systems.

The record

CVE	What it is	Severity	CISA listed	Exploit chance, 30 days
CVE-2025-61882	Oracle E-Business Suite Unspecified Vulnerability	critical 9.8	6 Oct	100%

Our reporting

28 OctAttackers scan the internet for unpatched Oracle E-Business Suite systems

Reported elsewhere

BleepingComputer · 28 OctHackers now scanning systems for recently-patched Oracle flaw ↗

The records

oracle.com: advisory ↗CISA known-exploited catalog ↗CVE-2025-61882 on NVD ↗

Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.

How it works