{"id":"CVE-2025-61884","published":"2025-10-12T03:15:34Z","modified":"2026-10-08T13:10:00Z","title":"Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability","vendor":"Oracle","product":"E-Business Suite","tier":"core","eol":null,"description":{"text":"Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","provenance":"source","from":"NVD"},"summary":{"text":"Oracle E-Business Suite's Oracle Configurator component (Runtime UI) contains a server-side request forgery flaw. An unauthenticated attacker with network access over HTTP, requiring no user interaction, can exploit it to gain unauthorized access to critical data or potentially all data accessible to Oracle Configurator.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:16Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.95891,"percentile":0.99873,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-10-20","dueDate":"2025-11-10","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.oracle.com/security-alerts/alert-cve-2025-61884.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-61884","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-10-20","exploitedFirstSeen":"2025-10-20","ransomware":true,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-10-20"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-61884","date":"2025-11-05"},{"url":"https://socradar.io/cl0p-oracle-ebs-zeroday-campaign/","date":"2025-11-21"},{"url":"https://www.sentinelone.com/blog/the-best-the-worst-and-the-ugliest-in-cybersecurity-2025-edition/","date":"2025-12-25"},{"url":"https://www.guidepointsecurity.com/wp-content/uploads/2026/01/GRIT-2026-Ransomware-and-Cyber-Threat-Report.pdf","date":"2026-01-15"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"},{"url":"https://www.trellix.com/assets/reports/trellix-healthcare-cybersecurity-threat-intelligence-report.pdf","date":"2026-01-27"},{"url":"https://www.checkpoint.com/security-report/?flz-category=items&flz-item=report-cyber-security-report-2026","date":"2026-01-28"},{"url":"https://b9866c47-b467-4bc0-b154-6afa06da0ab5.usrfiles.com/ugd/b9866c_2578eb8c8ffe4257b30efef3ad0f953e.pdf","date":"2026-02-12"},{"url":"https://slcyber.io/whitepapers-reports/the-ransomware-landscape-in-h2-2025","date":"2026-02-17"}],"evidenceTotal":29,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"},{"id":"CWE-93","name":"Improper Neutralization of CRLF Sequences"},{"id":"CWE-287","name":"Improper Authentication"},{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests"},{"id":"CWE-501","name":"Trust Boundary Violation"},{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://www.oracle.com/security-alerts/alert-cve-2025-61884.html","tags":["Vendor Advisory"]},{"url":"https://blogs.oracle.com/security/post/apply-july-2025-cpu","tags":["Vendor Advisory"]},{"url":"https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/","tags":["Exploit","Press/Media Coverage"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61884","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated HTTP attack against public-facing app","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP","start":159,"end":252}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthorized access to data stored locally","mappingType":"primary_impact","evidence":[{"from":"description","quote":"can result in  unauthorized access to critical data","start":330,"end":381}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-33878","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-33878","exploited":true,"exploitedSince":"2025-10-20","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2025-10-21","earliestUrl":"https://github.com/JrExploit/Blackash-CVE-2025-61884","repos":[{"name":"JrExploit/Blackash-CVE-2025-61884","url":"https://github.com/JrExploit/Blackash-CVE-2025-61884","stars":0,"created":"2025-10-21"}]},"nuclei":[{"id":"CVE-2025-61884","name":"Oracle E-Business Suite - Server-Side Request Forgery","severity":"high","path":"http/cves/2025/CVE-2025-61884.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-61884.yaml"}],"first":{"date":"2025-10-21","source":"PoC-in-GitHub","url":"https://github.com/JrExploit/Blackash-CVE-2025-61884"},"provenance":"source"},"exploitRefs":["https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1005"],"provenance":"ai"}],"timeline":[{"date":"2025-10-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61884","provenance":"source"},{"date":"2025-10-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2025-10-20","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-10-20","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-33878","provenance":"source"},{"date":"2025-10-21","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/JrExploit/Blackash-CVE-2025-61884","provenance":"source"}],"speed":{"daysToPublicExploit":9,"firstExploitFrom":"PoC-in-GitHub","daysToKev":8},"priority":{"score":78.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 376 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9987"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}