Flawed Vendor Guidance Exposes Enterprises to Avoidable Risk

Oracle’s latest guidance around its Web Application Firewall guidance is criticised as flawed, with a zero-day vulnerability in Oracle E-Business Suite prompting warnings that many enterprises misconfigured their exposure. The incident has been linked to CVE-2025-61882, described as easily exploitable with a CVSS of 9.8, enabling unauthenticated remote code execution.

An unauthenticated attacker reportedly gained network access to an exposed Oracle E-Business Suite instance, executed attacker-controlled code, and then obtained a reverse shell to interact with the system, compromising Oracle Concurrent Processing. The analysis stresses that Oracle E-Business Suite should not be exposed to the Internet and that deployment documents warn instead to use separate subnets or a bastion host for access, contrary to Oracle’s claim that WAFs provide protection against such attacks.

The saga also notes that the zero-day was reportedly under active exploitation for over eight weeks, with threat actors allegedly stealing data before victims were alerted, and cites concerns from UK authorities and other industry voices regarding inconsistent vendor guidance. Dan Andrew argues that proper documentation is essential to prevent these avoidable risks.