CVE-2025-61884
Published: 12 October 2025
Summary
CVE-2025-61884 is a high-severity Path Traversal (CWE-22) vulnerability in Oracle Configurator. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 2.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-61884 is a vulnerability in the Oracle Configurator product of Oracle E-Business Suite, specifically affecting the Runtime UI component. Supported versions 12.2.3 through 12.2.14 are impacted. It carries a CVSS 3.1 Base Score of 7.5 (vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), with Confidentiality impacts rated High. The issue is associated with multiple CWE identifiers, including CWE-22 (Path Traversal), CWE-93 (Improper Neutralization of CRLF Sequences), CWE-287 (Improper Authentication), CWE-444 (Inconsistent Interpretation of HTTP Requests), CWE-501 (Trust Boundary Violation), and CWE-918 (Server-Side Request Forgery).
The vulnerability is easily exploitable by an unauthenticated attacker with network access via HTTP, allowing them to compromise the Oracle Configurator. Successful exploitation results in unauthorized access to critical data or complete access to all data accessible by Oracle Configurator.
Oracle advisories, including the security alert for CVE-2025-61884 and the July 2025 Critical Patch Update blog post, recommend applying the latest patches to mitigate the issue. Additional references include analysis from Watchtowr Labs on related Oracle E-Business Suite vulnerabilities and listing in the CISA Known Exploited Vulnerabilities catalog.
This vulnerability appears in the context of broader Oracle E-Business Suite issues, with CISA confirming active exploitation in the wild.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-33878
Vulnerability details
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability…
more
can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
- CWE(s)
- KEV Date Added
- 20 October 2025
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote exploitation of a public-facing HTTP web application (Oracle Configurator Runtime UI) via multiple CWEs including path traversal and SSRF, enabling unauthorized data access, directly maps to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2025-61884 by requiring timely remediation through patching of the vulnerable Oracle Configurator Runtime UI component as recommended by Oracle and CISA KEV.
Addresses core CWEs (CWE-22 Path Traversal, CWE-93 CRLF Injection, CWE-444 HTTP Smuggling, CWE-918 SSRF) by validating and sanitizing HTTP inputs to the Runtime UI, preventing exploitation.
Enforces boundary protection at HTTP interfaces using firewalls or WAFs to monitor, filter, and block unauthenticated network attacks exploiting the vulnerability.