CISA Alerts on Oracle E-Business Suite 0-Day Actively Exploited for Ransomware Attacks

According to CISA, a critical zero-day vulnerability in Oracle E-Business Suite, tracked as CVE-2025-61882, is being actively exploited to deploy ransomware worldwide. The flaw affects the BI Publisher Integration component and allows unauthenticated attackers to compromise Oracle Concurrent Processing systems without any user credentials, potentially giving attackers complete takeover of the Oracle environment.

Intelligence reports indicate several ransomware groups have incorporated CVE-2025-61882 into their arsenals, using it to establish initial footholds before encryption payloads are deployed. The vulnerability is accessible via standard HTTP network connections, enabling remote exploitation and heightening risk for organisations running Oracle E-Business Suite.

CISA has designated this vulnerability for immediate remediation under its Known Exploited Vulnerabilities catalogue, with affected organisations given until 27 October 2025 to implement protective measures, including vendor mitigations, network segmentation, and strengthened backups. GBHackers also urges organisations to identify all Oracle E-Business Suite installations, particularly those with BI Publisher Integration exposed to network traffic, and to apply patches or mitigations promptly.