Security readout for executives and security teams
Plain-English summary
This flaw can let an unauthenticated network attacker read critical or complete Oracle Configurator-accessible data through HTTP. It affects Oracle E-Business Suite Configurator Runtime UI versions 12.2.3 through 12.2.14. No data modification or service disruption is described.
Executive priority
Treat this as an immediate remediation and investigation priority because exploitation is documented through CISA KEV and authentication is unnecessary. Focus first on internet-accessible systems and environments holding sensitive configuration or business data. Determine whether unauthorized access occurred, not merely whether patching succeeded.
Technical view
CVE-2025-61884 is an unauthenticated, network-reachable Oracle Configurator Runtime UI vulnerability. Its CVSS 3.1 score is 7.5 with high confidentiality impact, low complexity, and no required privileges or user interaction. The supplied CWE list indicates several potential weakness classes, but the bundle does not establish one definitive root cause.
Likely exposure
Affected Oracle E-Business Suite deployments running Configurator 12.2.3–12.2.14 are exposed when attackers can reach the Runtime UI over HTTP. Internet-facing systems present the clearest risk, although reachable internal systems may also be vulnerable. The bundle provides no configuration-specific exclusions.
Exploitation context
CISA KEV inclusion supports active exploitation in the wild. The vulnerability is described as easily exploitable and unauthenticated. A linked WatchTowr article concerns a broader Oracle E-Business Suite chain titled for CVE-2025-61882, so this bundle alone does not establish that CVE-2025-61884 provides code execution.
Researcher notes
The published vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Evidence supports confidentiality compromise, not integrity or availability impact. The supplied sources do not provide enough technical detail to assign one CWE as the confirmed root cause or to attribute code execution specifically to this CVE.
Mitigation direction
- Follow Oracle's CVE-2025-61884 advisory and applicable Critical Patch Update instructions immediately.
- Restrict HTTP access to Oracle Configurator until Oracle-prescribed remediation is verified.
- Prioritize externally reachable and business-critical E-Business Suite environments.
- Preserve relevant application and HTTP logs before remediation for incident review.
Validation and detection
- Inventory Oracle Configurator versions and identify systems running 12.2.3 through 12.2.14.
- Map which affected Runtime UI endpoints are reachable externally or from untrusted networks.
- Verify Oracle-prescribed updates using approved patch and version records.
- Review application and HTTP logs for anomalous unauthenticated access or suspected data retrieval.
- Confirm access restrictions remain effective after patching and service restarts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-287: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-444: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-501: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-918: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-93: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6oracleVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2025-61884 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2025-10-20T00:00:00.000Z: CVE-2025-61884 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- Oracle AdvisoryCVE reference, oracle · vendor-advisory
- https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/CVE reference, CISA-ADP · exploit, technical-description
- https://blogs.oracle.com/security/post/apply-july-2025-cpuCVE reference, CISA-ADP · vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61884CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.