WaratekVRT Sign in

CVE-2025-61884 Oracle Configurator

Affected softwareOracle Configurator
Affected versions12.2.3-12.2.14
Severity7.5 High CVSS 3.1
Fixed inOracle Security Alert CVE-2025-61884
WeaknessPath traversal (CWE-22)
Published12 Oct 2025
Updated13 Nov 2026

Description

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CWE-93CWE-287 · Improper authenticationCWE-444CWE-501CWE-918 · Server-side request forgery

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2025-10-20 · remediation due 2025-11-10 · ransomware use: known
  • VulnCheck KEV listed Exploitation reported in the wild. 14 citations · honeypot sightings · 1 exploit · earliest 2025-10-20.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: partial.
  • Indexed PoC 2 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2025-10-21.
  • EPSS 96% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2025-61884 in VulnCheck (free account), which lists 9 more citations not shown here.

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 21 days 2026-09-22 to 2026-11-11
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2025-10-20
Reported exploitation app.crowdsec.net /cti/cve-explorer/CVE-2025-61884 2025-11-05
Reported exploitation socradar.io /cl0p-oracle-ebs-zeroday-campaign 2025-11-21
Reported exploitation sentinelone.com /blog/the-best-the-worst-and-the-ugliest-in-cybersecurity-2025-edition 2025-12-25
Reported exploitation guidepointsecurity.com /wp-content/uploads/2026/01/GRIT-2026-Ransomware-and-Cyber-Threat-Report.pdf 2026-01-15
Exploit reference VulnCheck XDB 0f22699b4adf Exploit type: infoleak 2025-12-01

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC CVE-2025-61884 2025-10-21
Nuclei Oracle E-Business Suite - Server-Side Request Forgery

Waratek protection

Rule in development

Waratek is working on a rule for this CVE. No rule is available yet, and it isn't certain the rule will work.

Current target: Q2 2027 (may change)

  • Protection none
  • Action in development patch rule; current target Q2 2027, may change
  • Review human Researcher
  • Record active
Decided by A researcher's recorded decision for this specific CVE
Finding A researcher set this CVE's status to Rule in development.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Pre-auth SSRF in Oracle Configurator's UiServlet: the return_url value inside the getUiType XML parameter becomes an outbound HttpURLConnection POST, and encoded CR/LF in it survives into that request, so an attacker can smuggle a second request to EBS's internal interface (the first step of the CVE-2025-61882 chain). No generic rule sees it: the agent does not carry taint through the XML parse that extracts return_url, so a taint-based rule would not fire, and the Socket and DNS rules cannot tell the smuggled request from EBS calling itself. The rule in development is a patch on the Configurator's outbound connection, meant to refuse a return_url that is not the expected EBS URL or that contains CR/LF. Nothing blocks this CVE until that patch ships.

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Security Alert CVE-2025-61884 ↗ Alert 2025-Q4 Oracle E-Business Suite / Runtime UI (12.2.3-12.2.14)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle E-Business Suite Runtime UI 12.2.3-12.2.14

Products and versions

1 product, 1 version entry
SourceVendorProductSchemeAffected versions
nvd oracle configurator generic ≥ 12.2.3 and ≤ 12.2.14

References

URLTags
https://www.oracle.com/security-alerts/alert-cve-2025-61884.html
https://blogs.oracle.com/security/post/apply-july-2025-cpu Vendor Advisory
https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/ Exploit, Press/Media Coverage
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61884 US Government Resource

Timeline
Published2025-10-12By the CVE Program.
Added to CISA KEV2025-10-20Listed in CISA's Known Exploited Vulnerabilities catalog.
VulnCheck KEV: earliest evidence2025-10-20Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
NVD record modified2026-10-08NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-11Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.