Oracle Warns of Unauthenticated Vulnerability in E-Business Suite (CVE-2025-61884)

Oracle has issued an emergency Security Alert Advisory for CVE-2025-61884 affecting Oracle E-Business Suite versions 12.2.3 through 12.2.14, a widely deployed ERP platform. The flaw is remotely exploitable without authentication, meaning attackers can exploit it over a network without a username and password, according to Oracle. The company warns that if exploited, it may allow access to sensitive resources and could enable data theft or unauthorized access to internal systems.

Security experts describe the vulnerability as remotely exploitable without authentication (RCE-UA), placing it among the most severe categories in Oracle’s risk framework. Given the unauthenticated nature of the flaw, attackers could target exposed Oracle E-Business Suite web interfaces accessible over the internet, with organisations running unpatched environments particularly at risk. Oracle strongly urges customers to apply available updates immediately.