Detections
Analytics

CVE-2025-61884

high

Description

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

References

https://www.oracle.com/security-alerts/alert-cve-2025-61884.html

https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-oracle-flaw-by-saturday/

https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-oracle-weblogic-flaw/

https://therecord.media/google-says-90-zero-days-exploited-apt-spyware-vendors

https://cloud.google.com/blog/topics/threat-intelligence/2025-zero-day-review/

https://www.greynoise.io/blog/unmasking-cisas-hidden-kev-ransomware-updates

https://www.bleepingcomputer.com/news/security/checkoutcom-snubs-shinyhunters-hackers-to-donate-ransom-instead/

https://www.securityweek.com/nearly-30-alleged-victims-of-oracle-ebs-hack-named-on-cl0p-ransomware-site/

https://www.theregister.com/2025/10/21/cisa_windows_smb_bug/

https://www.helpnetsecurity.com/2025/10/21/cisa-warns-of-windows-smb-flaw-under-active-exploitation-cve-2025-33073/

https://www.bleepingcomputer.com/news/security/cisa-confirms-hackers-exploited-oracle-e-business-suite-ssrf-flaw/

https://securityaffairs.com/183659/uncategorized/u-s-cisa-adds-oracle-windows-kentico-apple-flaws-to-its-known-exploited-vulnerabilities-catalog.html

https://www.cisa.gov/news-events/alerts/2025/10/20/cisa-adds-five-known-exploited-vulnerabilities-catalog

https://thehackernews.com/2025/10/five-new-exploited-bugs-land-in-cisas.html

https://www.bleepingcomputer.com/news/security/oracles-silently-fixes-zero-day-exploit-leaked-by-shinyhunters/

https://www.theregister.com/2025/10/14/oracle_rushes_out_another_emergency/

https://securityaffairs.com/183362/security/oracle-issued-an-emergency-security-update-to-fix-new-e-business-suite-flaw-cve-2025-61884.html

https://www.securityweek.com/oracle-patches-ebs-vulnerability-allowing-access-to-sensitive-data/

https://www.bleepingcomputer.com/news/security/oracle-releases-emergency-patch-for-new-e-business-suite-flaw/

https://www.helpnetsecurity.com/2025/10/12/another-remotely-exploitable-oracle-ebs-vulnerability-requires-your-attention-cve-2025-61884/

https://thehackernews.com/2025/10/new-oracle-e-business-suite-bug-could.html

https://blogs.oracle.com/security/post/alert-cve-2025-61884

https://www.tenable.com/blog/oracle-october-2025-critical-patch-update-addresses-170-cves

https://www.tenable.com/blog/cve-2025-61882-faq-oracle-e-business-suite-zero-day-cl0p-and-july-2025-cpu

https://github.com/32BitZ-Studio/Total-POC-CVE

https://github.com/Zhert-lab/CVE-2025-61882-CVE-2025-61884

https://github.com/AshrafZaryouh/CVE-2025-61884-At-a-Glance

https://github.com/shinyhunt/CVE-2025-61884

https://github.com/pakagronglb/oracle-security-breaches-analysis-case-study

https://github.com/rxerium/CVE-2025-61882-CVE-2025-61884

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61884

https://blogs.oracle.com/security/post/apply-july-2025-cpu

Details

Source: Mitre, NVD

Published: 2025-10-12

Updated: 2026-08-04

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Severity: High

EPSS

EPSS: 0.95891

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Interest