Oracle E-Business Suite Flaw Enables Remote Code Execution and Data Theft

Oracle has flagged a critical flaw in its E-Business Suite that could allow remote code execution and data theft without authentication, identified as CVE-2025-61884. The vulnerability is in the Oracle Configurator Runtime UI and affects Oracle E-Business Suite versions 12.2.3 through 12.2.14, with a CVSS 3.1 score of 7.5.

Exploitation can be performed remotely over a network via HTTP, making it possible for attackers to access sensitive data directly from internet-facing systems, according to Oracle’s risk assessment. Oracle has released emergency patches and urges customers to apply the updates promptly, noting that exploitation could provide unauthorized access to confidential resources.

System administrators are directed to Oracle’s support documentation for patch information and installation steps, with guidance tailored to affected versions. Organisations should consider compensating controls such as network segmentation and enhanced monitoring while preparing for emergency patch deployment, as the disclosure timing underscores the need for swift action to prevent data compromise.