CVE Feed

    Dashboard / CVE / CVE-2025-61884

    CVE-2025-61884

    Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

    Published:Oct 12, 2025
    Last Modified:Feb 26, 2026
    EPS:Oct 12, 2025
    EPSS Score:0.41637
    CVSS Score:7.5

    CISA Notification

    Description

    Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

    Required Action:

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

    Notes:

    No extra notes provided.

    Due Date
    Nov 10, 2025
    305 days ago
    Alert Date
    Oct 20, 2025
    326 days ago

    Affected Products

    Vendor
    Oracle
    Product
    Configurator

    Exploits

    https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/https://github.com/AshrafZaryouh/CVE-2025-61884-At-a-Glancehttps://github.com/Ashwesker/Blackash-CVE-2025-61884https://github.com/B1ack4sh/Blackash-CVE-2025-61884https://github.com/JrExploit/Blackash-CVE-2025-61884

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-114 Authentication Abuse
    CAPEC-115 Authentication Bypass
    CAPEC-126 Path Traversal
    CAPEC-15 Command Delimiters
    CAPEC-151 Identity Spoofing
    CAPEC-194 Fake the Source of Data
    CAPEC-22 Exploiting Trust in Client
    CAPEC-273 HTTP Response Smuggling
    CAPEC-33 HTTP Request Smuggling
    CAPEC-57 Utilizing REST's Trust in the System Resource to Obtain Sensitive Data
    CAPEC-593 Session Hijacking
    CAPEC-633 Token Impersonation
    CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic
    CAPEC-650 Upload a Web Shell to a Web Server
    CAPEC-664 Server Side Request Forgery
    CAPEC-76 Manipulating Web Input to File System Calls
    CAPEC-78 Using Escaped Slashes in Alternate Encoding
    CAPEC-79 Using Slashes in Alternate Encoding
    CAPEC-81 Web Server Logs Tampering
    CAPEC-94 Adversary in the Middle (AiTM)

    Related CVEs

    CVE-2026-34274 (CVSS 6.1) — Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: User Interface). Supp…
    CVE-2026-21972 (CVSS 5.3) — Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: User Interface). Supp…
    CVE-2025-30728 (CVSS 7.5) — Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Core). Supported vers…
    CVE-2025-30720 (CVSS 6.1) — Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Orders). Supported ve…
    CVE-2022-21255 (CVSS 8.1) — Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: UI Servlet). Supported…
    CVE-2021-2079 (CVSS 8.2) — Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Supported ver…
    CVE-2021-2078 (CVSS 8.2) — Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Supported ver…
    CVE-2021-2080 (CVSS 8.2) — Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Supported ver…
    CVE-2020-14669 (CVSS 8.2) — Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Supported ver…
    CVE-2020-2865 (CVSS 5.3) — Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: Installation). Supported v…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High