CVE-2025-61884: Oracle Issues Urgent Security Alert for New E-Business Suite Vulnerability

CVE-2025-61884 is a high-severity flaw affecting the Runtime UI component of the Oracle Configurator in Oracle E-Business Suite, which could be exploited remotely by attackers without credentials. According to Oracle’s official advisory, the vulnerability allows remote, unauthenticated attackers to exploit EBS systems over HTTP, potentially exposing sensitive data. Affected versions are 12.2.3 through 12.2.14, all of which are still under Oracle’s active support, and the CVSS is 7.5.

The issue is notable for being easy to exploit and for its data exposure potential, with attackers potentially bypassing authentication controls to access confidential enterprise resources. Oracle strongly recommends immediate patching or applying mitigations, ensuring updates are applied across all instances including backup and test environments.

The article notes that CVE-2025-61882, linked to data theft campaigns involving the Clop ransomware group, was disclosed just weeks earlier, and it claims that researchers warn attackers may attempt to chain or reuse methods against unpatched EBS systems.