Oracle E-Business Suite BI Publisher Integration unauth RCE
A critical authentication-bypass and remote-code-execution flaw in the BI Publisher Integration component of Oracle E-Business Suite (versions 12.2.3–12.2.14). Exploited in the wild by Cl0p since August 2025; linked to the Estée Lauder HR-system breach disclosed July 20, 2026.
- Vendor
- Oracle
- Product
- E-Business Suite — BI Publisher Integration (versions 12.2.3–12.2.14)
- CVSS
- 9.8
- EPSS (exploit probability)
- 99.7%
- Status
- kevransomware use
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2025-61882 being exploited?
Yes. CISA added CVE-2025-61882 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. CISA marks it as known to be used in ransomware campaigns.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 99.7% (scored October 20, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
CVE-2025-61882 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (21 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2025-61882 is an unauthenticated remote-code-execution flaw in the BI Publisher Integration component of Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.14. Per NVD, a network attacker can bypass authentication and execute code in the context of the EBS process — CVSS 9.8. The Cl0p extortion crew has been exploiting the flaw in the wild since early August 2025, per BleepingComputer’s reporting on the Estée Lauder disclosure of 2026-07-20.
Why it matters
Oracle E-Business Suite carries the HR-of-record, payroll, and payments data for a large share of Fortune 500 and public-sector organizations. BI Publisher Integration is a reporting and document-generation surface with reach into the underlying EBS data model — a full compromise of that component is a full read of whatever the EBS instance holds.
Unauthenticated over the network means there is no credential requirement and no user interaction. Any Internet-reachable EBS instance in the affected version band that was unpatched during the Cl0p mass-exploitation window should be treated as breached, not “at risk.” The Estée Lauder timeline — access on 2025-08-09, discovery on 2026-06-19 — is the concrete example of what dwell looks like on this specific bug against this specific attacker.
What to do
Confirm the EBS build number against Oracle’s security-alert publications for CVE-2025-61882 and apply the vendor-supplied fix if the instance is in the 12.2.3–12.2.14 range and unpatched. Do not rely on patch-management dashboards alone — cross-check the running build. If the instance was exposed to the Internet during the exploitation window (August 2025 forward), pull BI Publisher access logs, search for unfamiliar service or admin accounts, and review outbound flows sized to match record-set extraction. For related coverage of the parallel EBS Payments/File Transmission RCE, see CVE-2026-46817.
Other Oracle E-Business Suite CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-46817 Oracle E-Business Suite Payments improper privilege management (unauth RCE)write-up | [ CRITICAL ] | 9.8 | 0.8% | |
| CVE-2025-61884 Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerabilityransomware use | [ HIGH ] | 7.5 | 95.9% | |
| CVE-2022-21587 Oracle E-Business Suite Unspecified Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 98.3% |
