CVE-2025-61882

🗓️ 05 Oct 2025 03:17:01Reported by oracleType

cve🔗 web.nvd.nist.gov📰️ 95 Media mentions👁 695 Views🌐 WEB

CVE-2025-61882 is a security vulnerability.

Reporter	Title	Published	Views	Family All 53
GithubExploit	Exploit for Improper Authentication in Oracle Concurrent_Processing	23 Oct 202507:57	–	githubexploit
GithubExploit	Exploit for CVE-2025-61882	5 Oct 202518:35	–	githubexploit
GithubExploit	Exploit for Improper Access Control in Oracle Concurrent_Processing	6 Oct 202522:02	–	githubexploit
GithubExploit	Exploit for Improper Access Control in Oracle Concurrent_Processing	6 Oct 202520:56	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Oracle Concurrent_Processing	10 Feb 202600:33	–	githubexploit
GithubExploit	Exploit for CRLF Injection in Oracle Concurrent_Processing	16 Oct 202515:33	–	githubexploit
GithubExploit	Exploit for CRLF Injection in Oracle Concurrent_Processing	10 Oct 202518:28	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Oracle Concurrent_Processing	5 Oct 202518:35	–	githubexploit
GithubExploit	Exploit for CRLF Injection in Oracle Concurrent_Processing	16 Oct 202505:15	–	githubexploit
GithubExploit	Exploit for Improper Authentication in Oracle Concurrent_Processing	21 Nov 202520:05	–	githubexploit

NVD

Vulners

CNA

Node

oracle concurrent_processingRange12.2.3–12.2.14

[
  {
    "vendor": "Oracle Corporation",
    "product": "Oracle Concurrent Processing",
    "versions": [
      {
        "version": "12.2.3",
        "status": "affected",
        "lessThanOrEqual": "12.2.14",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
oracle	www.oracle.com/security-alerts/alert-cve-2025-61882.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
blogs	www.blogs.oracle.com/security/post/apply-july-2025-cpu
crowdstrike	www.crowdstrike.com/en-us/blog/crowdstrike-identifies-campaign-targeting-oracle-e-business-suite-zero-day-CVE-2025-61882/

Parameter	Position	Path	Description	CWE
redirectFromJsp	request body	OA_HTML/configurator/UiServlet	UIServlet exploit endpoint used to deliver crafted UI payload triggering pre-auth RCE via CSRF bypass, request smuggling and XSLT/Javascript engine injection	CWE-287
getUiType	request body	OA_HTML/configurator/UiServlet	UIServlet exploit endpoint used to deliver crafted UI payload triggering pre-auth RCE via CSRF bypass, request smuggling and XSLT/Javascript engine injection	CWE-287

17 Jun 2026 09:51Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.19.8

EPSS0.99722

SSVC

CVE-2025-61882