HackerFeeds
All CVEs

CVE-2025-61884

HIGH7.5
CISA KEV

Published 2025-10-12 · Updated 2026-10-08 · Source secalert_us@oracle.com

Summary

CVE-2025-61884 is a high-severity (CVSS 7.5) vulnerability in Oracle E-Business Suite. CISA added it to the Known Exploited Vulnerabilities catalog on October 20, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by November 10, 2025. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Oracle has 46 vulnerabilities in the KEV catalog, 13 of them linked to ransomware.

All 46 known-exploited Oracle vulnerabilities →

Description

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-22CWE-93CWE-287CWE-444CWE-501CWE-918

CISA Known-Exploited Vulnerability

Product: Oracle — E-Business Suite

Name: Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability

Date added: 2025-10-20 · Due: 2025-11-10

USED IN RANSOMWARE

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

References

View on NVD