Actively exploited in the wild

Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability

Oracle - E-Business Suite · Listed in the CISA KEV since 2025-10-20. This indicates confirmed attacks in production environments.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2025-61884

HighCVSS 7.5KEV

Published: 12/10/2025(UTC)Updated: 04/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

97.79%

100th percentile - higher than 100% of all known CVEs

Summary

Vulnerability in Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI) affects versions 12.2.3-12.2.14. It is easily exploitable by an unauthenticated attacker with network access via HTTP, potentially resulting in unauthorized access to critical data or complete access to all Oracle Configurator data. CVSS 3.1 Base Score is 7.5 (Confidentiality impact).

Risk Assessment

The risk for the organization is potential breach of confidentiality of data stored in Oracle Configurator, including critical data, without requiring an account.

Recommendation

It is recommended to apply Oracle patches immediately for supported versions and restrict network access to the system.

Original NVD description (English source)

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).