CVE-2025-61884 — Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability

CVE-2025-61884

HIGH · CVSS 7.5 ⚠ KEV — EXPLOITED

EPSS exploitation probability: 100%

⚠ Listed in the CISA Known Exploited Vulnerabilities catalog — actively exploited.

Published 2025-10-20 · Last modified 2026-08-04T05:16:36.407

Summary

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected products

Oracle — E-Business Suite

Does this affect you?

Add your gear to cvedb and we'll alert you only when Oracle ships something exploited.

Check my exposure →

References

This product uses data from the NVD API but is not endorsed or certified by the NVD. Informational only; not professional security advice.