New Oracle E-Business Suite Bug Could Let Hackers Access Data Without Login

Oracle has warned of a new vulnerability in its E-Business Suite that could allow unauthorised access to sensitive data. The flaw, tracked as CVE-2025-61884, has a CVSS score of 7.5 and affects versions 12.2.3 through 12.2.14. According to a description of the flaw in the NIST's National Vulnerability Database (NVD), the vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Configurator, potentially granting access to all Oracle Configurator accessible data.

Oracle said the flaw is remotely exploitable without any authentication, making it crucial for users to apply the update promptly, though it does not state that it has been exploited in the wild. Oracle’s Chief Security Officer, Rob Duhart, pointed out that the vulnerability affects some deployments of E-Business Suite and could be weaponised to access sensitive resources.

The report also notes associations with ongoing activity linked to earlier CVE-2025-61882 exploitation in Oracle E-Business Suite and mentions payloads such as GOLDVEIN.JAVA, SAGEGIFT, SAGELEAF, and SAGEWAVE, with indications of a potential link to a group tied to Cl0p.