CVE-2025-61884: Oracle E-Business Suite Configurator pre-auth data exposure flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with known ransomware use, a near-maximum EPSS score, an exploit-tagged reference, and pre-auth remote reachability.

What it is

Oracle Configurator in Oracle E-Business Suite 12.2.3 through 12.2.14 exposes a vulnerability reachable over HTTP without authentication. A successful attack gives unauthorized read access to critical data held in or reachable through Configurator. It is listed in CISA KEV with a very high EPSS score, so it should be treated as actively targeted.

Impact

An unauthenticated attacker gains read access to critical Oracle Configurator data, with the CVSS vector indicating a high confidentiality impact and no integrity or availability effect.

Attack surface

Reachable over the network via HTTP against the Configurator Runtime UI; the CVSS vector shows no privileges required and no user interaction, so it is pre-auth and remotely triggerable.

Exploitation

CISA added it to KEV on 2025-10-20 with a 2025-11-10 remediation due date and flags known ransomware campaign use; EPSS 30-day probability is about 0.959 (99.9th percentile), and a reference is tagged Exploit.

What to do

• Apply the Oracle patch or mitigation from the vendor security alert for CVE-2025-61884, and apply the referenced July 2025 CPU where applicable.
• If patching is not immediately possible, restrict network access to Oracle Configurator Runtime UI endpoints to trusted hosts only.
• Follow CISA BOD 22-01 guidance for cloud services, or discontinue use of the affected component if no mitigation is available.
• Confirm affected E-Business Suite versions (12.2.3-12.2.14) are inventoried and prioritized for emergency change.
• Monitor for and block exploitation attempts at the network edge while remediation is in progress.

Detection

• Review HTTP access logs to Configurator Runtime UI endpoints for anomalous or unexpected requests, especially from unauthenticated or unfamiliar source IPs.
• Hunt for outbound connections from E-Business Suite hosts to unusual internal or external destinations consistent with SSRF behavior.
• Alert on access to Configurator data paths outside normal business hours or from atypical client geographies.
• Correlate E-Business Suite host activity with ransomware precursor indicators given the KEV ransomware flag.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.