Security readout for executives and security teams
Plain-English summary
Oracle E-Business Suite's Configurator module has a flaw that lets an unauthenticated attacker reach it over the internet and read sensitive business data without a password. CISA has added it to the Known Exploited Vulnerabilities list, meaning attackers are already using it. Any organization running affected EBS versions should treat this as urgent.
Executive priority
Treat as urgent. KEV-listed, unauthenticated, network-exploitable data disclosure in a core ERP platform. Prioritize patching above routine change windows and brief incident response leadership in case prior compromise surfaces during log review.
Technical view
Oracle Configurator Runtime UI in E-Business Suite versions 12.2.3 through 12.2.14 is exploitable by a remote, unauthenticated attacker over HTTP. CVSS 3.1 score is 7.5 with high confidentiality impact (C:H/I:N/A:N). Associated CWEs include path traversal (CWE-22), authentication bypass (CWE-287), HTTP request smuggling (CWE-444), and SSRF (CWE-918), suggesting a multi-weakness chain disclosed alongside CVE-2025-61882.
Likely exposure
Internet-facing Oracle E-Business Suite deployments running Configurator on versions 12.2.3–12.2.14 are exposed. Organizations with EBS portals reachable from untrusted networks face the greatest risk; internal-only deployments still face risk from any attacker with network reach to the Configurator HTTP endpoints.
Exploitation context
CISA KEV lists this CVE as actively exploited. Public watchTowr Labs research describes a related pre-auth exploit chain in the same EBS attack surface (CVE-2025-61882), indicating attacker familiarity with this component. Exploitation requires no authentication, no user interaction, and low complexity per the CVSS vector.
Researcher notes
CWE set (CWE-22, 287, 444, 501, 918, 93) suggests this CVE was disclosed in the same cluster as CVE-2025-61882's pre-auth RCE chain. Confidentiality-only CVSS impact indicates this specific issue yields data access rather than code execution, but the shared attack surface warrants chained-exploit hypothesis testing during validation. No public PoC for 61884 specifically cited in the bundle.
Mitigation direction
- Apply Oracle's out-of-band security alert patch for CVE-2025-61884 to all affected EBS environments immediately.
- Restrict network access to Oracle Configurator endpoints from untrusted networks via WAF or firewall rules.
- Confirm the October 2025 Critical Patch Update and the cited Oracle alert advisory are fully deployed, not just staged.
- Hunt for prior compromise in EBS logs given KEV listing and active exploitation.
- If patching is delayed, isolate Configurator URLs behind VPN or IP allow-listing as a temporary control.
Validation and detection
- Inventory all EBS instances and confirm version is at or above the Oracle-fixed release named in the CVE-2025-61884 alert.
- Verify Configurator Runtime UI URLs return patched behavior and are not exposed unnecessarily to the internet.
- Review web server and EBS access logs for anomalous requests to Configurator paths since October 2025.
- Cross-check CISA KEV catalog entry and Oracle advisory for any updated guidance or indicators.
- Confirm WAF and reverse-proxy rules block known exploitation patterns referenced in vendor advisories.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-287: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-444: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-501: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-918: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-93: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- Oracle AdvisoryCVE reference · vendor-advisory
- https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/CVE reference · exploit, technical-description
- https://blogs.oracle.com/security/post/apply-july-2025-cpuCVE reference · vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61884CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.