Log in Start free

Actively exploited · Published Oct 12, 2025 · Assigned by oracle

CVE-2025-61884

High 7.5 Exploited Ransomware

In plain English

A high-severity server-side request forgery in Oracle Configurator from Oracle Corporation. Attackers are actively exploiting it in the wild (listed by CISA on October 20, 2025). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 95.9% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)95.9%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since Oct 20, 2025
Attack tooling2Nuclei, Public PoC

CISA guidance

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Nov 10, 2025.

Official description

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Affected products (as reported)

VendorProductVersions
Oracle Corporation Oracle Configurator 12.2.3 – through 12.2.14

Weakness: CWE-918, CWE-22, CWE-93, CWE-444, CWE-287, CWE-501 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References