CVE-2025-61884: Oracle E-Business Suite unauthenticated SSRF, in CISA KEV
The short version: CVE-2025-61884 is a server-side request forgery (SSRF) flaw in the Oracle Configurator (Runtime UI) component of Oracle E-Business Suite. An unauthenticated attacker with HTTP access can abuse it to reach resources they shouldn't, exposing sensitive data. Oracle shipped an out-of-band Security Alert, and CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline. If you run internet-facing EBS, this is patch-and-verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice (see below) |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | ~97.79% · 99.90th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediate by 2025-11-10 |
| Known exploited? | Yes — CISA confirmed active exploitation (added to KEV) |
| Vulnerability type | CWE-918 server-side request forgery → unauthenticated access to sensitive resources |
| Requires authenticated session? | No — pre-authentication |
| Affected | Oracle E-Business Suite (Oracle Configurator, Runtime UI) versions 12.2.3 through 12.2.14 |
| Fixed in | Apply the fixes in Oracle's out-of-band Security Alert for CVE-2025-61884 |
What you need to know
Oracle E-Business Suite is a large, widely deployed ERP platform. CVE-2025-61884 lives in the Oracle Configurator product (Runtime UI component). It's a server-side request forgery: an unauthenticated attacker sends a crafted HTTP request that causes the EBS server itself to make requests to resources the attacker cannot reach directly — enabling access to sensitive information.
The reasons to prioritize it:
- It's pre-authentication and network-reachable. No credential, no chain — just HTTP access to the affected component.
- It's already being exploited. CISA added it to the KEV catalog, meaning there is reliable evidence of in-the-wild use. It arrived close on the heels of a separate, more severe EBS flaw (CVE-2025-61882) tied to mass data-theft activity, so EBS environments were already under active attacker attention.
How serious we see it
High — in practice.
The base CVSS is 7.5 because the mechanical impact is confidentiality only (an information-exposure bug, no integrity or availability loss). But the practical picture is worse than a mid-range score suggests: it's unauthenticated, it sits on a business-critical ERP that often holds financial and personal data, and it is confirmed exploited and KEV-listed with a firm federal deadline. The bounded, reassuring part is that it affects specific EBS versions, Oracle has published fixes, and you can determine quickly whether you run an exposed instance.
Recommendations
Straight from Oracle's Security Alert and CISA:
- Patch now. Apply the fixes from Oracle's out-of-band Security Alert for CVE-2025-61884 across all EBS instances — including test, staging, and DR copies.
- Reduce exposure. Restrict HTTP access to Oracle EBS from untrusted networks; EBS front-ends should not be openly reachable from the internet.
- Hunt. Review access and application logs for anomalous requests to the Configurator / UiServlet endpoints and unexpected outbound requests from the EBS host.
- If compromised, respond. Rotate credentials and secrets reachable from the environment, and investigate for follow-on access.
- Confirm your exposure first. Verify whether you run an internet-facing EBS deployment on an affected version (12.2.3–12.2.14).
How BreachRisk sees it
BreachRisk starts from the outside, the way an attacker does. From little more than your domain it discovers internet-facing Oracle E-Business Suite front-ends, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — pushed to the top of your results because it's in KEV and unauthenticated.
That continuous, outside-in view is the point: when an ERP flaw lands in KEV with a two-week deadline, your exposed instance is already mapped, so you can go straight to patch-and-verify instead of starting with an inventory.