CISA Warns of Oracle E-Business Suite SSRF Vulnerability Actively Exploited in Attacks

According to CISA, a critical Oracle E-Business Suite vulnerability has been added to its Known Exploited Vulnerabilities catalog after active exploitation was detected in the wild. The flaw, CVE-2025-61884, targets the Runtime component of Oracle Configurator within Oracle E-Business Suite and enables server-side request forgery without requiring authentication. Security researchers warn that exploitation could allow attackers to bypass network access controls and exfiltrate data from backend systems.

CISA added CVE-2025-61884 to the Known Exploited Vulnerabilities catalog on 20 October 2025, signalling confirmed active exploitation attempts. Federal agencies must apply patches or vendor mitigations by 10 November 2025 under Binding Operational Directive 22-01. Organisations should review installations for exposure, implement vendor-provided patches, adopt network segmentation, and monitor for suspicious outbound requests as part of a defence-in-depth response.