CVE-2025-61884: Unauthenticated Data Exposure in Oracle E-Business Suite

Oracle has released an urgent Security Alert Advisory addressing a critical vulnerability in Oracle E-Business Suite, identified as CVE-2025-61884. This flaw enables remote attackers to access sensitive data or resources without requiring authentication.

CVE-2025-61884 is a highly exploitable flaw in the Oracle Configurator (Runtime UI) module of Oracle E-Business Suite. It allows attackers with HTTP network access to retrieve configuration data without authentication. The vulnerability exists in the publicly accessible Runtime UI interface, which exposes configuration models to unauthenticated requests.

The flaw has been assigned a CVSS 3.1 score of 7.5, indicating a high-severity risk that can be exploited remotely without credentials or user interaction. The underlying cause is an authentication bypass, enabling unauthorized access to sensitive Oracle Configurator data.

The vulnerability affects Oracle E-Business Suite versions 12.2.3 to 12.2.14. It originates from the Runtime interface of Oracle Configurator, a key component used for handling complex product and service configuration logic.

• Data exfiltration or exposure of sensitive business information.
• Lateral movement within enterprise networks through ERP-to-database integrations.
• Disruption of financial and supply chain operations by manipulating internal records.

• TA0001 – Initial Access: Exploiting public-facing applications to gain initial entry into the system.
• T1190 – Exploit Public-Facing Application: Leveraging vulnerabilities in applications accessible over the internet.

• Reverse shell activity.
• Unauthorized access to /OA_HTML/SyncServlet and related endpoints.
• Outbound connections over port 443 from EBS servers.
• Suspicious HTTP requests.
• Unusual template preview activity.

Oracle strongly recommends applying the updates or mitigations provided. Key steps include:

• Apply the latest security updates for Oracle E-Business Suite versions 12.2.3 to 12.2.14 immediately.
• Upgrade unsupported deployments to a currently maintained release if using older versions.
• Restrict exposure of the Configurator Runtime UI by enforcing strict network segmentation and limiting HTTP access.
• Continuously monitor for abnormal access patterns or suspicious Configurator-related activity.
• Limit external access to the Oracle Configurator service to only trusted users and networks.

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.