← Vulnerability Intelligence

CVE-2025-61884

High 7.5 Exploited in the wild (KEV) Used in ransomware campaigns

Confirmed active exploitation — CISA KEV catalog

Name
Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Metrics

CVSS 3.1
7.5 (HIGH) Score source: CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS — exploit probability
96% (percentile: 100) as of 1 November 2026
CWE
CWE-22, CWE-93, CWE-287, CWE-444, CWE-501, CWE-918

Affected products

oracle: configurator

References