Back to CVE Browser

CVE-2025-61884

🔥 Known Exploited (CISA KEV)HIGH

7.5

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2025-10-12

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected Platforms (CPE)

📦

Oracle

Configurator

>= 12.2.3 and <= 12.2.14

References & Advisories

🔗 https://www.oracle.com/security-alerts/alert-cve-2025-61884.html

🔗 https://blogs.oracle.com/security/post/apply-july-2025-cpu

🔗 https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61884

Related Security Intelligence Articles

Global Cyber Intel Digest: July 23, 2026

Key threat updates including CISA's KEV addition of Langflow CVE-2026-0770 remote code execution, unauthenticated path traversal in Windmill CVE-2026-29059, and ongoing incident response guidance for SonicWall SMA1000 zero-day exposures.

Global Cyber Intel Digest: July 21, 2026

Comprehensive breakdown of critical vulnerability advisories across VMware vCenter, F5 BIG-IP, and GitLab platforms, alongside threat actor reconnaissance trends and ransomware response strategies.

Related Vulnerabilities

CVE-2026-579174.8

proCertum SmartSign parses external XML entities from arbitrary crafted signature files, enabling SSRF and potentially allowing th...

The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL q...

The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields...

The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL be...