Full Report
CISA has confirmed that an Oracle E-Business Suite flaw tracked as CVE-2025-61884 is being exploited in attacks, adding it to its Known Exploited Vulnerabilities catalog. [...]
Analysis Summary
# Vulnerability: Oracle E-Business Suite SSRF Flaw Confirmed Exploited
## CVE Details
- CVE ID: CVE-2025-61884
- CVSS Score: 7.5 (High)
- CWE: Not specified (Related to SSRF)
## Affected Systems
- Products: Oracle E-Business Suite
- Versions: Not explicitly listed, but affects the Oracle Configurator runtime component.
- Configurations: Affects instances utilizing the Oracle Configurator runtime component.
## Vulnerability Description
CVE-2025-61884 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability residing in the Oracle Configurator runtime component. Successful exploitation could allow an attacker to gain unauthorized access to critical data or achieve complete access to all data accessible by the Oracle Configurator. The flaw was reportedly exploited in attacks dating back to July.
## Exploitation
- Status: Exploited in the wild (Confirmed by CISA and linked by researchers to earlier attacks)
- Complexity: Low (Described as "easily exploitable")
- Attack Vector: Network
## Impact
- Confidentiality: High (Unauthorized access to critical data)
- Integrity: Not explicitly detailed, but access implies potential manipulation
- Availability: Not explicitly detailed, but unauthorized access risk is present
## Remediation
### Patches
- Oracle disclosed the flaw on October 11. Specific patch version information is **not provided** in the text, but the vulnerability has been addressed by Oracle.
### Workarounds
- The patch addresses the flaw by validating an attacker-supplied "return\_url" using a regular expression; if validation fails, the request is blocked. No explicit workarounds are detailed outside of applying the vendor fix.
## Detection
- **Indicators of Compromise (IOCs):** Indicators related to CVE-2025-61884 overlap with indicators linked to CVE-2025-61882 (which targeted `/OA_HTML/SyncServlet`). The exploit path for CVE-2025-61884 targets the `/configurator/UiServlet` endpoint.
- **Detection methods and tools:** Organizations should monitor for unusual requests targeting the `UiServlet` endpoint within the Oracle Configurator runtime. Federal agencies are required by CISA to have this patched by November 10, 2025.
## References
- Vendor Advisory (Fix disclosed October 11): hXXps://www.oracle.com/security-alerts/alert-cve-2025-61884.html
- CISA KEV Addition: (Implied by confirmation)
- Related Flaw Disclosure (CVE-2025-61882): hXXps://www.oracle.com/security-alerts/alert-cve-2025-61882.html