CVE-2025-61882
Oracle E-Business Suite Unspecified Vulnerability
Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2025-10-27.
7 articles across 6 outlets · first covered Jan 26, 2026 · latest Sep 21, 2026
Associated threat actors
Coverage timeline
-
ShinyHunters Claims Breach of Rival Clop’s Leak Site and Demands Bitcoinwww.darkreading.com · Sep 21, 2026
-
ShinyHunters Hijacks Clop Leak Site and Threatens to Expose Secretssocradar.io · Sep 21, 2026
-
ShinyHunters Claims It Hacked and Extorted Clop Ransomware Groupwww.infosecurity-magazine.com · Sep 21, 2026
-
ShinyHunters Claims It Breached and Defaced Clop’s Leak Sitedatabreaches.net · Sep 19, 2026
-
M-Trends 2026: Initial Access Handoff Shrinks From Hours to 22 Secondswww.securityweek.com · Mar 23, 2026
-
MSG data breach tied to Cl0p's Oracle flaw CVE-2025-61882securityaffairs.com · Mar 3, 2026
-
CISA Makes Unpublicized Ransomware Updates to KEV Catalogwww.darkreading.com · Feb 4, 2026