CriticalCVE-2025-61884

    Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability (CVE-2025-61884)

    Published Last modified In CISA KEV since Sources: CVE.org, SingCERT, pwn.watch

    What is affected, what to do

    Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14.

    The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

    Affected
    • Oracle Configurator lte 12.2.3..12.2.14

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    7.5

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    7.5

    CVSS v3

    Severity High on the scale from 0 to 10.

    Source: CVE.org, SingCERT, pwn.watch

    95.9 %

    EPSS score

    High — model estimates ≥ 50% chance of real-world exploitation within 30 days.

    Source: FIRST EPSS, percentile 99.87

    Show all metrics
    Severity
    Critical
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    253.71 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    actively exploitedSource: VulnCheck KEV (opens in a new tab), CSA/SingCERT How we classify
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    7.5 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    7.5
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    95.9 %
    High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    99.87
    Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    Actively exploited
    Published
    In CISA KEV since

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    CISA assessment (SSVC)
    Exploitation: active · automatable · Technical impact: partial
    Source: CISA Vulnrichment, as of 17 October 2025
    CWE

    CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.

    Read in glossary
    CWE-918, CWE-22, CWE-93, CWE-444, CWE-287, CWE-501

    Response and mitigation

    Why act now?

    Prioritisation rationale

    CISA flags this CVE as actively used in ransomware campaigns and placed it on KEV because it is network-reachable without authentication and sits squarely inside the current wave against Oracle E-Business Suite — the same ecosystem that saw CVE-2025-61882 driving mass data-exfiltration and extortion activity. Its exploitation likelihood is among the highest tracked on KEV right now. For NIS2-scoped organisations running EBS for finance, procurement or HR, every internet-exposed instance should be treated as critical: patch within 24-72 hours, intranet-only instances within the next change window but with compensating network and WAF controls in place immediately. Do not be reassured by the confidentiality-only CVSS profile — in this EBS campaign, SSRF is routinely the initial foothold leading to credential theft, data staging and follow-on compromise.

    1. Runbook step 1

      Immediate response (0-24 h)

      • Deploy the Oracle Security Alert / October 2025 Critical Patch Update that addresses CVE-2025-61884 across every Oracle E-Business Suite instance running 12.2.3 through 12.2.14. Patch internet-facing EBS front-ends first, internal tiers immediately after.
      • Audit exposure now: review reverse proxy, load balancer and WAF configurations to confirm whether /OA_HTML/ Configurator paths (Runtime UI servlets, ibeCZz* entry points) are reachable from the public internet. If yes, block them at the WAF or restrict to VPN / zero-trust access until patched.
      • Tighten egress rules on the EBS application tier: restrict outbound HTTP/HTTPS from the middle tier to an allowlist (Oracle update endpoints, known integration partners) to kill SSRF pivots towards cloud metadata (169.254.169.254), internal admin consoles and lateral HTTP targets.
      • Open an IR triage window: preserve 60 days of access logs on Configurator endpoints before rotation. The October 2025 CPU and the ongoing Cl0p-linked EBS campaign (around CVE-2025-61882) mean exploitation attempts are already live; any hit should go straight into incident handling.
      • Rotate database credentials (APPS, APPLSYS), integration service accounts and any secrets reachable from the middle tier if EBS was externally exposed prior to patching and detection surfaces evidence of exploitation.

    2. Runbook step 2

      Mitigation layers

      • Network segmentation: publish EBS only via a reverse proxy with an explicit URL allowlist. Block direct internet access to WebLogic / Oracle HTTP Server ports (typically 8000, 8001, 7201/7202).
      • WAF rule: block or alert-then-block HTTP requests to Configurator paths (/OA_HTML/configurator*, /OA_HTML/ibeCZz*) that carry parameters such as url=, redirect=, xmlUrl=, return_url= with values starting with http://, https://, file://, gopher://, or IP literals (127., 10., 192.168., 169.254.).
      • Egress control: perimeter deny rule for connections from the EBS middle tier to adjacent RFC1918 ranges, to cloud metadata IP 169.254.169.254, and to loopback via proxy headers. Enforce IMDSv2 / mandatory metadata headers on AWS, Azure and OCI instances hosting EBS.
      • WebLogic / OHS hardening: enable mod_security or equivalent reverse-proxy filtering with SSRF signatures; ensure ProxyRequests Off; disable unused Configurator components in httpd.conf / plsql.conf.
      • IAM / least privilege: the application-tier OS account (typically applmgr) must not reach the internet; restrict database roles to the minimum required by Configurator; audit integration service accounts for unnecessary write permissions.
      • Compensating telemetry until patched: raise logging verbosity at the reverse proxy (full URL plus request body length) so SSRF probes reach the SIEM.

    3. Runbook step 3

      Detection rules

      • Reverse proxy / Oracle HTTP Server access logs: requests to /OA_HTML/ with query parameters containing URL schemes. Sigma shape: selection: cs-uri-query|contains: ['=http%3A', '=https%3A', '=file%3A', '=gopher%3A', '=169.254.169.254'] combined with cs-uri-stem|contains: 'configurator'.
      • Outbound connections from the EBS middle tier (Zeek conn.log / firewall flow): new destinations outside the allowlist, specifically 169.254.169.254, internal admin ports (8080, 9090, 7001), or external interaction services. KQL shape: DeviceNetworkEvents | where InitiatingProcessAccountName in ('applmgr','oracle') and (RemoteIP == '169.254.169.254' or RemoteUrl has_any ('burpcollaborator','oast.','interact.sh')).
      • WebLogic / OHS access patterns: unusual rate of HTTP 302 and 500 responses on Configurator endpoints, oversized query strings (>512 chars), suspicious user agents (curl, python-requests, empty or generic UA) sourced from WAN ranges.
      • Linux auditd on the application tier: unexpected connect() syscalls from the WebLogic managed-server JVM to RFC1918 targets outside the known integration perimeter; correlate with execve of shell utilities (sh, curl, wget) as children of the JVM.
      • EDR process ancestry: java (WebLogic) → sh/bash → curl/wget/nc. Any occurrence on a production EBS middle tier is a high-severity signal and must be triaged manually.

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

    Source: cvelistv5, CSA/SingCERT, pwn.watch, NVD (NIST), CISA KEV Catalog, CVE.org (MITRE)

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    Oracle CorporationOracle Configurator
    • 12.2.3 – ≤ 12.2.14
    • —
    oracleconfigurator
    • 12.2.3 – ≤ 12.2.14
    • —

    Vendors and products

    Weakness classes (CWE)

    • CWE-918Server-Side Request Forgery (SSRF)

      Base

      The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

      Entry at MITRE CWE-918

    • CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

      Base

      The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

      Entry at MITRE CWE-22

    • CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')

      Base

      The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

      Entry at MITRE CWE-93

    • CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

      Base

      The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

      Entry at MITRE CWE-444

    • CWE-287Improper Authentication

      Class

      When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

      Entry at MITRE CWE-287

    • CWE-501Trust Boundary Violation

      Base

      The product mixes trusted and untrusted data in the same data structure or structured message.

      Entry at MITRE CWE-501

    Public exploit references

    Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

    Public exploit references
    CISA KEV CatalogCISA Known Exploited Vulnerability (opens in a new tab)cisa.govactively exploited
    CSA/SingCERTActive Exploitation of High Severity Vulnerability in Oracle E-Business Suite (opens in a new tab)CSA/SingCERTactively exploited
    Reference tagged as exploitlabs.watchtowr.com (opens in a new tab)PoC (publicly reported)reported, not verified—

    References & sources

    • oracle.comOracle AdvisoryVendor advisory, pwn-watch
    • labs.watchtowr.comwell-well-well-its-another-day-oracle-e-business-suite-pre-auth…Exploit, Technical description, Third-party advisory
    • blogs.oracle.comsecurity/post/apply-july-2025-cpuVendor advisory
    • cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61884government-resource
    • pwn.watchpwn.watch: Oracle E-Business Suite: E-Business Suite Server-Side Request Forgery (SSRF) Vulnerabilitypwn-watch
    • NVD (NIST)NVD: CVE-2025-61884pwn-watch
    • cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

    Changes to this CVE

    Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

    One NVD translation into another language is hidden.

    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2025-61884
    <a href="https://intel.neosec.eu/en/cve/CVE-2025-61884"><img src="https://intel.neosec.eu/badge/cve/CVE-2025-61884.svg?lang=en" alt="CVE-2025-61884 – NEOSEC Intel" height="20"></a>