Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI).

published 2025-10-12 12 mo ago modified 2026-10-08 31 d ago also EUVD-2025-33878

cvss: 7.5; version 3.1, CNA
cisa kev: Exploited; added 2025-10-20, used in ransomware
epss: 95.9%; EPSS 95.9% chance of exploitation in 30 days, percentile 99.8%
public exploits: 0; none known, plus a Nuclei check

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Patch / fix

cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Timeline

2025-10-12 Published
2025-10-17 CISA SSVC: exploitation active
2025-10-20 Added to CISA KEV
2025-11-10 CISA patch deadline

Known exploited

Added: 12 mo ago (2025-10-20)
Patch by: 2025-11-10 (11 mo ago)
Ransomware: Known to be used in ransomware campaigns
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor, product: Oracle, E-Business Suite
CISA name: Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: partial
Assessed: 12 mo ago (2025-10-17)

Exploit prediction

95.89% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Nuclei template Oracle E-Business Suite - Server-Side Request Forgery nuclei detection template
labs.watchtowr.com https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Oracle Corporation Oracle Configurator

Classification

Weakness

CWE-918 Server-Side Request Forgery
CWE-22 Improper Limitation of a Pathname to a Restricted Directory
CWE-93 Improper Neutralization of CRLF Sequences
CWE-444 Inconsistent Interpretation of HTTP Requests
CWE-287 Improper Authentication
CWE-501 Trust Boundary Violation

References

labs.watchtowr.com /well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-an
exploit, technical-description, third-party-advisory, press/media-coverage
oracle.com /security-alerts/alert-cve-2025-61884.html
vendor-advisory
blogs.oracle.com /security/post/apply-july-2025-cpu
vendor-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61884
government-resource, us-government-resource

Sources

CVE List CVE-2025-61884
NVD CVE-2025-61884

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary