Oracle E-Business Suite Configurator (Runtime UI) Pre-Auth Information Disclosure & SSRF Vulnerability (CVE-2025-61884)
Executive & SecOps Summary
SECOPS ASSESSMENTOracle E-Business Suite versions 12.2.3 through 12.2.14, specifically the Oracle Configurator (Runtime UI) component.
Unauthenticated remote attackers can exploit this vulnerability via HTTP to gain unauthorized access to critical data or compromise the entire Oracle Configurator data.
Apply the official Oracle Critical Patch Update (CPU) immediately and restrict external HTTP/HTTPS access to the affected endpoints.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the latest Oracle Critical Patch Update (CPU) using the ADOP (Active Deployment Online Patching) utility for Oracle EBS.
# 1. Prepare the online patching session
adop phase=prepare
# 2. Apply the designated Oracle EBS security patch
adop phase=apply patches=37000000
# 3. Complete the patching cycle
adop phase=finalize,cutover,cleanup2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict external access to the Oracle Configurator endpoints using a reverse proxy or Web Application Firewall (WAF).
# Block external access to Oracle Configurator Runtime UI paths in Nginx
server {
listen 443 ssl;
server_name ebs.example.com;
# Restrict access to sensitive EBS Configurator endpoints
location ~* ^/OA_HTML/(configurator|cz) {
allow 10.0.0.0/8;
deny all;
return 403;
}
}3. Log Audit & IoC Verification Commands
Scan the EBS web server access logs for suspicious requests targeting the Configurator component containing potential SSRF or traversal payloads.
# Search for suspicious patterns in Oracle HTTP Server access logs
grep -Ei '(/OA_HTML/.*cz|configurator)' /u01/install/APPS/fs_ne/inst/log/apaches/*.log | grep -E '(http|https|localhost|127.0.0.1|\.\./)'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the Runtime UI component of Oracle Configurator within Oracle E-Business Suite (EBS). It stems from insufficient input validation and improper authentication controls, mapping to CWE-22 (Path Traversal), CWE-918 (SSRF), and CWE-287 (Improper Authentication). It allows unauthenticated network attackers to bypass security boundaries via crafted HTTP requests.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker sends a malicious HTTP request targeting the Oracle Configurator Runtime UI endpoints. Due to flawed input handling, the application processes the request parameters to perform unauthorized internal actions (SSRF) or access restricted file paths (Path Traversal). This enables the attacker to retrieve sensitive configuration files, database credentials, or business-critical data without any prior authentication.
3. Infrastructure & Business Impact
With a CVSS 3.1 Base Score of 7.5 and active exploitation confirmed by its inclusion in the CISA KEV catalog, this vulnerability poses a severe threat to enterprise infrastructure. Successful exploitation can lead to massive data breaches, exposure of proprietary ERP configurations, and potential lateral movement within the internal corporate network.
Official Vendor Advisories & References
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Frequently Asked SecOps Questions (CVE-2025-61884)
FAQQ1. How critical is CVE-2025-61884 and is it actively exploited in the wild?
CVE-2025-61884 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 95.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-61884?
Primary impacted vendors include oracle across e-business suite, oracle configurator. Scope summary: Oracle E-Business Suite versions 12.2.3 through 12.2.14
Q3. What temporary mitigations or workarounds exist for CVE-2025-61884 before patching?
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately and restrict external HTTP/HTTPS access to the affected endpoints. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-61884
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (oracle)
View Category →Oracle E-Business Suite Payments File Transmission Authentication Bypass and Remote Code Execution (CVE-2026-46817)
[Affected Scope] Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, specifically the Oracle Payments (File Transmission) component
Oracle PeopleSoft Enterprise PeopleTools Remote Code Execution and System Takeover Vulnerability (CVE-2026-35273)
[Affected Scope] Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62
Adobe ColdFusion Path Traversal Remote Code Execution Vulnerability Urgent Advisory (CVE-2026-48282)
[Affected Scope] Adobe ColdFusion versions 2025.9, 2023.20 and earlier
Cisco Catalyst SD-WAN Authentication Bypass and Admin Privilege Escalation (CVE-2026-20127) Critical Security Advisory
[Affected Scope] Cisco Catalyst SD-WAN Controller (formerly vSmart), Cisco Catalyst SD-WAN Manager (formerly vManage), and Cisco Catalyst SD-WAN Validator (formerly vBond).
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.