Oracle · E-Business Suite

CVE-2025-61884

Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability

Exploited in attacks Used by ransomware High 7.5 Attack chance: 96%

What it is

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CISA: Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: November 10, 2025

oracle.com/security-alerts/alert-cve-2025-61884.html

Added to the CISA list: October 20, 2025
Published: October 12, 2025
Severity: High 7.5 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 96% in the top 0.1% of all known vulnerabilities
Weakness: CWE-918
More details: NVD · CVE.org · CISA

More exploited flaws from Oracle

Added	Vulnerability	Product	Severity	Attack chance
Jul 15, 2026	Improper Privilege ManagementCVE-2026-46817	E-Business Suite	Critical 9.8	12%
Oct 6, 2025	UnspecifiedCVE-2025-61882used by ransomware	E-Business Suite	Critical 9.8	99.7%
Feb 2, 2023	UnspecifiedCVE-2022-21587used by ransomware	E-Business Suite	Critical 9.8	98%
Aug 24, 2026	Improper Access ControlCVE-2026-21962	HTTP Server and Oracle Weblogic Server Proxy Plug-in	Critical 10.0	73%
Jun 12, 2026	PeopleSoft Enterprise PeopleTools Missing Authentication for Critical FunctionCVE-2026-35273used by ransomware	PeopleSoft Enterprise PeopleTools	Critical 9.8	97%
Jun 1, 2026	UnspecifiedCVE-2024-21182	WebLogic Server	High 7.5	74%
Nov 21, 2025	Missing Authentication for Critical FunctionCVE-2025-61757	Fusion Middleware	Critical 9.8	89%
Feb 24, 2025	DeserializationCVE-2024-20953	Agile Product Lifecycle Management (PLM)	High 8.8	3.9%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.