Oracle Configurator CVE-2025-61884

No special configuration is required beyond the product being reachable over HTTP - exploitation targets the default Runtime UI component of Oracle Configurator as deployed within Oracle E-Business Suite 12.2.3-12.2.14. CVSS PR:N confirms no authentication is needed. The exploitable endpoint is the web-facing Runtime UI; if the EBS application tier is internet-exposed or reachable from an untrusted network segment, exploitation is directly possible without any user interaction (UI:N). Limiting factor: an attacker must have TCP/HTTP connectivity to the EBS application tier; deployments where EBS is strictly internal and not reachable from untrusted networks have a meaningfully reduced real-world exposure. No specific non-default feature toggle or configuration is identified in the description as a prerequisite.

All five exploitation-difficulty signals align to indicate a critical real-world priority. CVSS 3.1 rates this 7.5 (AV:N/AC:L/PR:N/UI:N), indicating unauthenticated, one-step network exploitation with no user interaction. A public exploit exists (watchTowr Labs RCE chain). The CISA KEV catalog references this CVE, confirming active exploitation in the wild. In isolation, the confidentiality-only CVSS impact of C:H/I:N/A:N might suggest a moderate response window, but the watchTowr research demonstrates this CVE is a staging step in a pre-auth RCE chain with CVE-2025-61882 - so the realistic blast radius exceeds what the standalone CVSS score implies. There is no EPSS value provided in the input, but given KEV status and a public exploit targeting a high-value enterprise ERP platform, prioritization should be immediate. The only limiting factor is that an attacker requires network-level access to the Oracle EBS application tier.

An unauthenticated attacker with HTTP access to the Oracle EBS application tier sends a crafted HTTP request to the Configurator Runtime UI containing path traversal sequences (e.g., ../../) in a URL or parameter. The server resolves the traversal and returns the contents of an out-of-bounds file - potentially including credential material, session tokens, or configuration data. As demonstrated by watchTowr Labs, this file access is then chained with CVE-2025-61882 to escalate from data disclosure to unauthenticated remote code execution on the EBS server.