CVE-2025-61882

CVE-2025-61882 in Oracle E-Business Suite's BI Publisher Integration is an unauthenticated takeover vulnerability that demands immediate attention if you run any Oracle EBS version with BI Publisher enabled. The EPSS score of 0.99722 and CISA KEV listing confirm this is actively weaponized—defenders cannot treat 'network access required' as adequate mitigation when adversaries are already exploiting this in the wild. The core issue is a trust boundary collapse at the integration seam between Concurrent Processing and BI Publisher. BI Publisher is designed as a reporting layer that normally operates within authenticated Oracle workflows. When the integration endpoint accepting HTTP requests fails to validate session context, an attacker reaching that endpoint directly can execute arbitrary code through Concurrent Processing. This is not a data theft vulnerability—it is complete system compromise through a component most administrators treat as internal plumbing rather than an attack surface. Verify your exposure immediately: determine whether BI Publisher Integration endpoints are network-reachable without credentials. Oracle's Critical Patch Updates typically enforce authentication at these integration points, so applying the relevant CPU is the primary remediation. However, patch validation should go beyond confirming the update is installed—test the integration endpoints directly with unauthenticated HTTP requests to confirm the authentication enforcement is actually functioning. Many EBS deployments will log BI Publisher activity under scheduled job contexts rather than user authentication events, which means security monitoring reliant on session correlation may not flag exploitation attempts. For compensating controls, audit the FND_WEB_PKG and related concurrent program integration paths specifically. These are the documented paths where HTTP-layer requests enter the concurrent processing framework, and they represent the likely exploitation vector regardless of patch status. If these accept direct invocation without session validation, treat them as exposed and apply network-level restrictions until the patch is validated.

Reviewed through automated stages and approved by a human before publication.