Loading story…
Oracle has disclosed a critical security vulnerability, CVE-2025-61884, affecting the Oracle Configurator component within Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.14. This vulnerability resides in the Runtime user interface of Oracle Configurator and allows unauthenticated attackers with network access via HTTP to remotely exploit the system. Successful exploitation can result in unauthorized access to sensitive configuration data or potentially complete access to all data accessible through Oracle Configurator. The flaw is classified as easily exploitable, requiring no user interaction or authentication, which significantly increases the risk profile for organizations relying on Oracle EBS for critical business operations. The National Vulnerability Database has assigned a CVSS 3.1 base score of 7.5 to CVE-2025-61884, indicating its high severity and the potential for significant impact on enterprise confidentiality and integrity. Oracle Security’s CIS Rob Duhart has emphasized that the vulnerability may allow access to sensitive resources and could affect a wide range of EBS deployments. While Oracle has not confirmed whether this vulnerability is currently being exploited in the wild, there is heightened concern due to recent incidents involving similar vulnerabilities, such as CVE-2025-61882, which was exploited to steal data from Oracle EBS customers. Security researchers warn that the public availability of exploit scripts for related vulnerabilities increases the likelihood of imminent attacks targeting CVE-2025-61884. Oracle has issued patches and strongly recommends that all affected customers apply the updates or mitigations immediately to protect their systems. There are also reports that earlier versions, such as 12.1.3, may be vulnerable, and Oracle may update its patch documentation as more information becomes available. The vulnerability’s ability to bypass authentication controls and grant attackers access to critical business configuration data poses a direct threat to organizations’ operational security. Oracle EBS is integral to business workflows in sectors such as manufacturing, finance, and supply chain management, making the potential impact of this vulnerability especially severe. Organizations are advised to review Oracle’s security advisories, apply the recommended patches without delay, and monitor for further updates as the situation evolves. The exposure of sensitive configuration data could lead to broader compromises, including data theft, business disruption, and regulatory consequences. Security teams should also assess their current EBS deployments for signs of compromise and ensure that all network access to Oracle Configurator is tightly controlled. The urgency of this vulnerability is underscored by the potential for attackers to exploit it with minimal effort, making rapid remediation essential for all Oracle EBS customers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Coverage of Oracle's emergency response said the latest E-Business Suite patch came as fallout tied to Clop-related activity widened, indicating broader concern around exploitation pressure and impact. This represented an escalation in the narrative beyond the initial disclosure of the flaw alone.
Oracle issued an out-of-band emergency patch for CVE-2025-61884 in Oracle E-Business Suite. Reports characterized it as Oracle's second emergency E-Business Suite patch within two weeks.
Oracle warned of a critical remotely exploitable vulnerability in Oracle E-Business Suite, tracked as CVE-2025-61884, that could allow unauthenticated access to sensitive data. Multiple reports describe the flaw as affecting internet-exposed EBS environments and requiring urgent attention.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcecsoonline.com
Open sourcesecurityonline.info
Open sourcetechrepublic.com
Open sourcethehackernews.com
Open sourcethecyberthrone.in
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Oracle has issued a security alert regarding a newly discovered high-severity vulnerability in its E-Business Suite (EBS), tracked as CVE-2025-61884, which allows remote, unauthenticated attackers to gain access to sensitive resources. The flaw affects Oracle Configurator, a component used for automating product and service configuration, and impacts versions 12.2.3 through 12.2.14 of EBS. According to Oracle’s chief security officer, the vulnerability is easily exploitable via HTTP and could result in unauthorized access to critical or all data accessible through Oracle Configurator. The National Institute of Standards and Technology (NIST) has classified this as a high-risk issue, emphasizing the potential for attackers to compromise entire EBS environments without credentials. This vulnerability follows closely on the heels of another zero-day (CVE-2025-61882) disclosed by Oracle the previous week, indicating a concerning trend of critical flaws in the EBS platform. Security researchers have noted that the Cl0p ransomware group previously exploited EBS vulnerabilities to gain unauthorized access to corporate accounts, raising the risk that this new flaw could be weaponized by similar threat actors. Concurrently, dark web monitoring teams have observed the sale of an alleged 0-day exploit for Oracle E-Business Suite on underground forums, suggesting that cybercriminals are actively seeking to monetize this vulnerability. The dark web activity includes discussions and advertisements for the Oracle EBS 0-day, alongside other high-profile data leaks and exploit sales, highlighting the immediate interest from the cybercriminal community. Organizations using affected versions of Oracle EBS are urged to apply patches or mitigations as soon as they become available and to monitor for signs of exploitation. The exposure of such a critical business application to unauthenticated remote attacks significantly increases the risk of data breaches, ransomware, and business disruption. Security teams should prioritize reviewing access logs, implementing network segmentation, and restricting external access to Oracle EBS interfaces. The rapid appearance of exploit sales on the dark web underscores the urgency of the threat and the likelihood of imminent exploitation in the wild. Oracle customers are advised to stay informed through official security advisories and to coordinate with their IT and security vendors for timely remediation. The incident demonstrates the ongoing targeting of enterprise software by both sophisticated ransomware groups and opportunistic cybercriminals. Proactive defense and rapid response are essential to mitigate the risks posed by this and similar vulnerabilities in widely deployed business platforms.
Jun 29, 2026
Oracle released an emergency patch on October 11, 2025, to address a high-severity information disclosure vulnerability in Oracle E-Business Suite (EBS), identified as CVE-2025-61884. The vulnerability resides in the Runtime UI component of Oracle Configurator and allows remote, unauthenticated attackers to access sensitive resources within affected EBS installations. The flaw impacts Oracle EBS versions 12.2.3 through 12.2.14, and Oracle has provided a fixed version to mitigate the risk. Security researchers have noted that, as of the time of the patch release, there is no public proof-of-concept exploit available for CVE-2025-61884, and Oracle has not reported any evidence of exploitation in the wild. Despite this, the context of recent extortion emails sent to Oracle EBS customers by the Cl0p ransomware group has heightened concern about potential targeting of this vulnerability. Arctic Wolf recommends that all organizations using affected versions of Oracle EBS apply the emergency patch as soon as possible and follow their internal patching and testing protocols to minimize operational disruption. The vulnerability’s nature as an information disclosure issue means that sensitive business data could be exposed if left unpatched, increasing the risk of data theft or further compromise. Oracle has not confirmed any direct link between CVE-2025-61884 and the Cl0p ransomware activity, but the timing of the patch and the extortion attempts has led to increased vigilance among security teams. The advisory stresses the importance of prompt remediation, given the historical interest of threat actors in Oracle EBS vulnerabilities. Organizations are urged to consult Oracle’s official advisory for detailed patching instructions and to review their exposure to the affected EBS versions. The emergency nature of the patch underscores the seriousness with which Oracle and the security community are treating this vulnerability. Security bulletins from multiple sources reiterate the need for immediate action to prevent potential exploitation. The lack of a public exploit does not preclude the possibility of targeted attacks, especially given the sophistication of groups like Cl0p. The incident highlights the ongoing risks associated with complex enterprise software suites and the need for rapid response to critical vulnerabilities. Security teams should monitor for any signs of attempted exploitation and ensure that all relevant systems are updated. The release of this patch is part of Oracle’s broader efforts to address emerging threats and protect its customers from evolving cyber risks. Organizations that delay patching may face increased scrutiny from regulators and partners, especially if a breach occurs as a result of this vulnerability. The situation remains dynamic, and further updates may be issued if exploitation is detected or additional technical details emerge.
Jun 29, 2026
Oracle E-Business Suite customers are facing urgent risk from multiple critical vulnerabilities affecting versions `12.2.3` through `12.2.15`, including **CVE-2026-46817** in the Oracle Payments File Transmission component and **CVE-2026-46933** in Oracle Applications Manager. **CVE-2026-46817**, rated `CVSS 9.8`, can be exploited by an unauthenticated remote attacker over HTTP via the `/OA_HTML/ibytransmit` endpoint and may allow takeover of Oracle Payments and broader EBS environments. Oracle addressed the flaw in its May 2026 Critical Security Patch Update, while **CVE-2026-46933**, rated `CVSS 9.9`, was fixed in the June 2026 update as part of a broader set of 245 patched vulnerabilities. Security researchers reported that **CVE-2026-46817** is already being exploited in the wild, with honeypots capturing crafted XML payloads attempting to read `/etc/passwd`, indicating private exploit tooling was in use before any public proof of concept emerged. The exposure is amplified by the number of internet-facing deployments, with Shadowserver identifying more than 450 reachable EBS instances, and government and industry defenders warning organizations to patch immediately and restrict HTTP access to trusted network segments where possible.
Jul 17, 2026