Oracle issued an emergency security update to fix new E-Business Suite flaw CVE-2025-61884

Oracle issued an emergency security update to address a new E-Business Suite vulnerability tracked as CVE-2025-61884, which Oracle says is an information disclosure flaw affecting the Runtime UI component in E-Business Suite versions 12.2.3–12.2.14. The advisory assigns a CVSS Base Score of 7.5 and notes that the vulnerability is remotely exploitable by unauthenticated attackers, potentially allowing access to sensitive resources.

According to Rob Duhart, Oracle’s Chief Security Officer, the vulnerability “affects some deployments of Oracle E-Business Suite” and customers are urged to apply the out-of-band patch as soon as possible, with Oracle emphasising that organisations should stay current on supported versions and apply security patches without delay. Australian?

(Ignore) The piece also references related activity around CVE-2025-61882 and an extortion campaign linked to Cl0p, but Oracle confirms only the CVE-61884 patch and its guidance to mitigate potential exploitation. Admins are urged to deploy the emergency update promptly to guard against potential data theft, as the firm did not disclose whether the flaw had been exploited in the wild.