Oracle Patches EBS Vulnerability Allowing Access to Sensitive Data

Oracle has released a patch for a severe E-Business Suite vulnerability that could allow access to sensitive data, tracked as CVE-2025-61884 and rated high severity, affecting the Runtime UI component of Oracle Configurator and exploitable remotely without authentication. According to Oracle’s advisory, the flaw may be exploited without user interaction.

The vulnerability disclosure comes about two weeks after executives at dozens of organisations received extortion emails claiming that sensitive information had been stolen from their EBS instances, and follows Oracle’s earlier statements about vulnerabilities exploited in July 2025 and a zero-day tracked as CVE-2025-61882 that was also likely exploited. Over the weekend, Oracle informed customers about CVE-2025-61884 but has not said whether it has been exploited.

Rob Duhart, the CSO of Oracle, commented that CVE-2025-61884 “affects some deployments of Oracle E-Business Suite” and that, if exploited, it may allow access to sensitive resources. Security researchers note that the attackers used sophisticated malware in related EBS zero-day campaigns and that victims’ data were reportedly stolen in prior campaigns linked to FIN11 and Cl0p.