What breaks and who should care
If your organisation runs Oracle E‑Business Suite and you expose the BI Publisher Integration component over HTTP, an unauthenticated attacker can take over the Concurrent Processing engine. That means they could run arbitrary code, steal data, or launch ransomware – all without needing a valid user account.
For the wider picture, our Known Exploited Vulnerabilities tracker lists every flaw CISA has confirmed under active attack.
This is a critical issue (CVSS 9.8). It has been confirmed in the wild and is listed in the CISA Known Exploited Vulnerabilities catalog. If you manage Oracle applications, you need to act now.
What the vulnerability is
The NVD description calls it an “unspecified vulnerability” in the BI Publisher Integration component that leads to compromise of Oracle Concurrent Processing. Oracle has not published the exact technical details, so we cannot say whether it is an injection flaw, a deserialization bug, or something else. What we do know is the attack vector:
- Unauthenticated – no credentials required.
- Network‑level – the attacker only needs to reach the HTTP endpoint that serves BI Publisher.
- Remote code execution – successful exploitation gives the attacker full control over the Concurrent Processing service.
Because the vulnerability lives inside the integration layer, any system that forwards BI Publisher requests to the concurrent engine is at risk. The impact is total compromise of the job scheduler, which can be used to launch further attacks across the whole Oracle stack.
How to know if you are affected
First, confirm that you are running Oracle E‑Business Suite. If you are, check whether the BI Publisher Integration component is installed and exposed over HTTP. The following checks will tell you if the vulnerable code path exists in your environment.
Check the application tier
Log onto the application tier host and run:
ps -ef | grep -i bi_publisher
If you see a process such as bi_publisher or owbipublisher listening, the component is present.
Verify the HTTP endpoint
Run a simple curl against the known BI Publisher URL:
curl -I http://your-host/bi_publisher/
A 200 or 302 response means the service is reachable. If it is only reachable from the internal network, note the IP ranges that can reach it.
Confirm Concurrent Processing is active
On the concurrent processing host, check the daemon:
ps -ef | grep -i concurrent
Or query the Oracle instance:
sqlplus / as sysdba@your-db <
If rows are returned, the engine is running.
Cross‑reference the table below
Match your installation against the table below. Any entry that falls within the affected range means you are vulnerable until you apply the vendor’s patched release for your branch.
Why this is severe
A CVSS score of 9.8 places this at the top of the risk ladder. The attack does not need credentials, so it bypasses any strong password policies you may have. It targets the job scheduler, a core piece of the ERP that runs financial close, payroll, and supply‑chain processes. Compromise can therefore lead to data theft, financial loss, and the kind of ransomware that encrypts critical business files. CISA has already linked this CVE to active ransomware campaigns, so the threat is not theoretical – it is happening now.
What to do – step‑by‑step remediation
1. Apply the vendor patch
The safest, quickest fix is to upgrade to the patched release for your branch. Oracle’s security advisory provides a patch bundle that replaces the vulnerable BI Publisher Integration libraries. Follow the standard patch‑apply procedure:
- Download the patch from Oracle Support (use your support contract credentials).
- Stop the BI Publisher service:
adctl stop bi_publisher. - Apply the patch with the
opatchutility. - Restart the service:
adctl start bi_publisher. - Validate the version with
adctl version bi_publisher– it should show the patched build identifier.
After the patch, re‑run the curl test. A healthy response without error messages indicates the component is now running the fixed code.
2. Implement mitigations if you cannot patch immediately
Oracle and CISA both advise that you can buy time with mitigations while you arrange the patch. Choose one or more of the following:
- Network isolation: Block inbound HTTP traffic to the BI Publisher port (usually 80 or 443) from any network that does not need it. Use a firewall rule such as
iptables -A INPUT -p tcp --dport 80 -s trusted‑subnet -j ACCEPTand then drop everything else. - Reverse proxy with authentication: Put an Apache or Nginx front‑end in front of BI Publisher that requires basic auth or client‑certificate auth. This adds a credential check before the request reaches the vulnerable component.
- Disable the integration if you do not use BI Publisher for reporting. Stop the service and remove it from the startup scripts:
adctl stop bi_publisher && adctl disable bi_publisher. - Apply BOD 22‑01 guidance for cloud‑hosted instances – restrict public‑facing endpoints, enforce MFA, and enable continuous monitoring.
Each mitigation reduces the attack surface. The most effective is to block unauthenticated HTTP entirely, because that is the only vector the CVE exploits.
3. If a patch is unavailable for your branch
In rare cases the vendor may not have released a fix for the exact branch you run. In that scenario you have two options:
- Upgrade to the nearest supported branch that has a patch. This may involve a full application upgrade – plan it carefully, test in a sandbox, and follow Oracle’s upgrade guide.
- Temporarily retire the vulnerable component. Disable BI Publisher Integration, migrate any reporting jobs to an alternative tool, and keep the service offline until a patch appears.
While you work on a longer‑term fix, keep the mitigations from the previous section in place and monitor logs for any unexpected requests to /bi_publisher/.
Verification after remediation
Once you have applied the patch or mitigations, run these checks to confirm you are no longer exposed:
- Re‑run the curl command. You should receive a standard HTTP 200 response with no stack traces or error pages that reveal internal details.
- Inspect the BI Publisher logs (usually under
$FND_TOP/log/bi_publisher) for any failed authentication attempts or suspicious payloads. - Use a vulnerability scanner to rescan the host. The CVE should now be marked as “not detected”.
If any of these steps still show signs of vulnerability, double‑check that the patch was applied to the correct file system location and that no older libraries remain on disk.
Long‑term hardening recommendations
Even after you have dealt with CVE-2025-61882, the same attack pattern can appear in other Oracle components. Consider these ongoing practices:
- Keep all Oracle patches up to date – subscribe to Oracle Critical Patch Updates and apply them within the vendor’s recommended window.
- Enforce least‑privilege network zones. Only allow the application tier to talk to the concurrent processing tier on the ports it really needs.
- Enable logging and centralise it in a SIEM. Look for sudden spikes in HTTP requests to BI Publisher endpoints.
- Run regular penetration tests that include unauthenticated scans of HTTP services.
These steps will reduce the chance that a future, unknown flaw becomes a full‑blown incident.
Summary
Oracle E‑Business Suite’s BI Publisher Integration component contains a critical, unauthenticated remote‑code‑execution flaw that can compromise the Concurrent Processing engine. The vulnerability is actively exploited in ransomware campaigns. To protect your environment:
- Confirm the component is present and reachable.
- Cross‑reference the table below to see if your installation falls in the affected range.
- Apply Oracle’s patched release for your branch immediately.
- If you cannot patch, block HTTP access, add authentication, or disable the component.
- Verify the fix with curl, log checks, and a rescanned report.
Time is of the essence. The longer the vulnerable service stays exposed, the greater the chance an attacker will strike. Follow the steps above, document what you did, and keep your patch cadence tight. The table below will give you the exact version mapping you need for reference.
Affected versions
Straight from the NVD record for CVE-2025-61882. If your build is inside one of these ranges, treat it as vulnerable.
| Product | Affected range | Fixed in |
|---|---|---|
concurrent_processing |
12.2.3 up to 12.2.14 | see vendor advisory |
