CVE-2025-61884

This vulnerability lets someone reach Oracle Configurator through regular web connections (HTTP) without needing an account. Once reached, they can read sensitive files/data that normally should be protected—like configuration information, credentials, and keys—similar to stealing the keys to your office by walking up to a door that isn’t locked.

This matters if your small business uses Oracle E-Business Suite and specifically Oracle Configurator (Runtime UI) on supported affected versions 12.2.3 through 12.2.14. Because the issue does not require login, any environment where the affected HTTP-facing parts are reachable is at risk.

This is only a real-world risk if the vulnerable component is reachable from the network over HTTP (for example, exposed by your web server, proxy, or firewall).

This is RED because CISA lists CVE-2025-61884 in KEV as being used in ransomware campaigns, meaning attackers are already taking advantage of it. The predicted exploit likelihood is very high and exploitation reporting indicates attacks are actively targeting the affected ecosystem.

Act now to block exposure and apply Oracle’s mitigations/upgrade guidance without waiting for further alerts.

1. Identify exposure and affected versions

   • Determine whether you run Oracle E-Business Suite with Oracle Configurator (Runtime UI).
   • Confirm your installed version is within 12.2.3–12.2.14.
   • Verify whether the Configurator Runtime UI endpoints are reachable from outside your network over HTTP.

2. Check current reachability (gate)

   • From outside the network (or via your security team’s scanning tools), verify whether HTTP access to the Configurator Runtime UI is possible.
   • Check your network controls (firewall rules, load balancer/reverse proxy routing, WAF rules) for any path that forwards HTTP traffic to the vulnerable component.

3. Apply Oracle mitigation guidance immediately

   • Follow Oracle’s security alert for CVE-2025-61884 and implement the mitigations described there.
   • If Oracle’s guidance includes disabling or restricting the Runtime UI paths, implement that right away.
   • If you can’t fully mitigate, you should discontinue use of the product/component until you can.

4. Upgrade to the fixed version (best long-term step)

   • Oracle provides remediation/upgrade guidance in its security alert and related CPU posts.
   • Upgrade to the first fixed version for your branch as specified by Oracle.
   • After upgrade, re-test that the vulnerable HTTP access pattern is no longer possible.

5. Hunt for signs of exploitation

   • Review web/proxy/reverse-proxy logs for unauthenticated HTTP requests to Configurator endpoints.
   • Look for anomalous request patterns consistent with attempts to read server files/data.
   • If you find indicators, prioritize incident response and expand the search across application and system logs.

6. CISA timing and monitoring

   • CISA remediation due date is 2025-11-10.
   • Continue monitoring HTTP access attempts and Configurator-related logs until patch/mitigation is confirmed and network exposure is removed.

Severity is HIGH (CVSS 7.5) with confidentiality impact. The weakness category includes CWE-22 (path traversal), CWE-93 (improper protection of data), CWE-287 (improper authentication), CWE-444 (inconsistent execution control), CWE-501 (suspicious placement of logic), and CWE-918 (server-side request forgery class behavior) as reflected by the reported vulnerability categories.

Mechanism (from findings + backstop): an unauthenticated attacker with network access over HTTP can access sensitive data through Oracle Configurator’s Runtime UI. Real-world exploitation is confirmed: CISA KEV lists the issue as used in ransomware campaigns, and KEV was added on 2025-10-20 with a remediation due date of 2025-11-10. Public exploitation/weaponization exists.

Exploit maturity: public exploit availability is reported, and exploitation reporting indicates active attempts are occurring (though not described as broad mass scanning). EPSS prediction is extremely high and rising, but public-facing urgency is driven primarily by KEV-confirmed real-world use.