CVE-2025-61884

What it actually does

CVE-2025-61884 is an unauthenticated, network-exploitable confidentiality vulnerability in the Oracle Configurator Runtime UI component of Oracle E-Business Suite versions 12.2.3 through 12.2.14. An attacker with HTTP access can compromise Oracle Configurator data access controls and retrieve critical data or all data reachable through the Configurator component without valid credentials. The vulnerability is low-complexity, requires no user interaction, and has no integrity or availability impact in the published CVSS vector, but the data exposure can support credential theft, business-data theft, extortion, or follow-on intrusion.

Why it matters to the business

Organizations running affected Oracle E-Business Suite deployments may be exposed to unauthorized disclosure of sensitive business data handled by Oracle Configurator, including configuration, pricing, product, customer, or operational information depending on deployment. Because this issue is listed in CISA KEV, has a very high EPSS score, is reported as actively exploited in the wild, and is associated with ransomware activity, unpatched internet-accessible systems should be treated as high-risk and potentially already targeted. The CISA remediation due date of 2025-11-10 has passed, increasing regulatory and operational urgency for organizations subject to KEV-driven remediation requirements.

How an attack unfolds

An attacker first identifies an Oracle E-Business Suite instance exposing Oracle Configurator Runtime UI over HTTP or HTTPS. Because exploitation requires no authentication and low complexity, the attacker can send crafted HTTP requests directly to the vulnerable Configurator Runtime UI component. If successful, the component returns data the attacker should not be able to access, potentially including critical Oracle Configurator-accessible information. In real-world campaigns, this type of exposure may be used for rapid data collection, validation of sensitive records, extortion preparation, or as part of broader Oracle E-Business Suite exploitation activity, including ransomware-linked operations. Defenders should assume that repeated unauthenticated probing of Oracle E-Business Suite HTTP endpoints, especially Configurator-related runtime paths, may represent exploit attempts.

How to fix it

Apply the relevant Oracle Critical Patch Update or Security Alert update that remediates CVE-2025-61884 for Oracle E-Business Suite. Affected supported versions are 12.2.3 through 12.2.14; organizations on these versions should patch immediately or upgrade to a release level that includes Oracle's fix. If immediate patching is not possible, restrict HTTP/HTTPS access to Oracle E-Business Suite to trusted networks, place affected endpoints behind VPN or strong access controls, block direct internet exposure, and use WAF or reverse-proxy rules to limit unauthenticated access to Oracle Configurator Runtime UI paths. Review Oracle guidance for any required post-patch steps, configuration changes, or invalidation/restart procedures for Oracle E-Business Suite application tiers. Because active exploitation and ransomware use are reported, mitigation should not be treated as equivalent to patching except as a short-term containment measure.

How to confirm the fix worked

Confirm the Oracle E-Business Suite version and patch inventory show the Oracle fix for this vulnerability applied across all application tiers. Validate that instances are no longer running affected unpatched versions 12.2.3 through 12.2.14. From an unauthenticated network position, verify that Oracle Configurator Runtime UI functionality is not reachable except through intended authenticated workflows and trusted access paths. Review web server, application server, reverse proxy, and WAF logs to confirm that requests to Configurator Runtime UI endpoints are either blocked, authenticated, or no longer produce unauthorized data responses. Where compensating controls are used, test that direct internet-originated requests to Oracle E-Business Suite HTTP endpoints are denied.

Typical attack path

1. Discover an Oracle E-Business Suite web endpoint exposed to the internet or reachable from a compromised network segment.
2. Fingerprint the deployment to identify Oracle E-Business Suite and the Oracle Configurator Runtime UI component.
3. Send unauthenticated crafted HTTP requests to the vulnerable Runtime UI interface.
4. Abuse the flaw to retrieve data accessible through Oracle Configurator without logging in.
5. Automate enumeration to extract larger volumes of sensitive configuration or business data.
6. Use the stolen data for extortion, resale, competitive intelligence, credential harvesting, or to support additional intrusion activity.

How to detect it

To determine whether exploitation already occurred, review Oracle E-Business Suite web access logs, Oracle HTTP Server or WebLogic logs, reverse proxy logs, WAF alerts, application diagnostic logs, and database audit logs covering the period before patching through the present. Focus on unauthenticated HTTP requests to Oracle Configurator Runtime UI functionality, repeated requests from unfamiliar external IP addresses, abnormal response sizes, unusual 200 responses where authentication would normally be expected, bursts of parameterized requests, and access patterns inconsistent with normal user sessions. Correlate web requests with application logs showing Configurator Runtime UI activity without an authenticated user context. Look for evidence of large-scale data enumeration, such as many sequential object lookups, repeated access to configuration-related data, or increased database reads initiated by the application tier. Because this vulnerability is KEV-listed, has a very high EPSS score, and is associated with ransomware activity, also examine outbound network logs from Oracle E-Business Suite application servers for unexpected callbacks or transfers, and review security tooling for alerts related to Oracle E-Business Suite exploitation, server-side request forgery, data staging, compression, or exfiltration. If exploitation is suspected, preserve logs and memory/disk artifacts from application tiers before remediation activities overwrite evidence.

What your security team should do

• Patch all affected Oracle E-Business Suite 12.2.3 through 12.2.14 systems immediately; the KEV remediation deadline has already passed and exploitation is active.
• Treat internet-facing Oracle E-Business Suite systems as high priority for compromise assessment, especially if they were exposed before patching.
• Restrict Oracle E-Business Suite HTTP/HTTPS access to trusted networks and remove direct internet exposure wherever possible.
• Hunt historical logs for unauthenticated requests to Oracle Configurator Runtime UI and unusual high-volume data retrieval patterns.
• Inspect outbound connections from Oracle E-Business Suite application tiers for unexpected destinations, especially if SSRF-style behavior is suspected in observed exploit activity.
• Increase monitoring on Oracle E-Business Suite web, application, and database access logs for anomalous unauthenticated access, large responses, and repeated probing.
• Preserve relevant web server, application server, WAF, reverse proxy, and database audit logs before rotation to support forensic review.
• If suspicious access is found, rotate credentials and secrets that may have been exposed through Oracle E-Business Suite data or configuration stores.
• Confirm incident response playbooks account for ransomware-linked exploitation and potential data-extortion scenarios.