NCSC Issues Alert on Active Exploitation of Oracle E-Business Suite 0-Day Vulnerability

The UK National Cyber Security Centre (NCSC) has issued a security alert following confirmation of active exploitation of a critical 0-day vulnerability tracked as CVE-2025-61882 in Oracle E-Business Suite (EBS), with Oracle’s advisory noting the risk to affected deployments.

The flaw, a remote code execution vulnerability in the BI Publisher Integration component of Oracle Concurrent Processing, can allow a remote, unauthenticated attacker to compromise a vulnerable EBS instance by sending specially crafted HTTP requests. Oracle has released an urgent security update to address the issue, and the vulnerability is being actively exploited in the wild, with a CVSS v3.1 base score of 9.8.

The vulnerability impacts Oracle E-Business Suite versions 12.2.3 through 12.2.14, and the NCSC urges organisations running affected versions to perform a compromise assessment using the published IoCs, which include suspicious IP addresses (200.107.207[.]26 and 185.181.60[.]11) and SHA256 hashes of related exploit files.

Finally, the guidance emphasises applying the latest Oracle EBS update and hardening network exposure, with recommendations for continuous monitoring and reporting suspected incidents to Oracle PSIRT and the NCSC where applicable.