What is the CVSS score of CVE-2025-61884?

CVE-2025-61884 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 97.8%.

Which versions of Oracle Configurator are affected by CVE-2025-61884?

Oracle E-Business Suite Configurator contains an unauthenticated path traversal vulnerability affecting versions 12.2.3-12.2.14 that exposes application data over plain HTTP to any network-connected…

Is there a public PoC exploit available for CVE-2025-61884?

Yes, a public proof-of-concept exploit is available for CVE-2025-61884. Prioritise patching immediately. EPSS: 97.8%.

How to fix or mitigate CVE-2025-61884?

Within 24 hours, identify all instances of Oracle E-Business Suite 12.2.3 through 12.2.14 and assess network exposure; restrict or isolate internet-facing Runtime UI endpoints until patching is complete. Within 7 days, apply the July 2025 Oracle Critical Patch Update (CPU) to all affected systems-prioritize assets in compliance-sensitive functions and those processing financial or personnel data. Within 30 days, conduct a complete audit of patching completion, validate that compensating controls are retired, and review application and firewall logs for evidence of prior exploitation attempts.

Oracle Configurator CVE-2025-61884

HIGH

Path Traversal (CWE-22)

2025-10-12 secalert_us@oracle.com

Authentication Bypass Path Traversal Oracle Configurator

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable unauthenticated path traversal with no interaction needed; only confidentiality is impacted, no integrity or availability effects identified.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Added to CISA KEV

Aug 04, 2026 - 05:31 CISA

Analysis Generated

Aug 04, 2026 - 05:29 vuln.today

CVE Published

Oct 12, 2025 - 03:15 cve.org

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthenticated path traversal in Oracle Configurator's Runtime UI (part of Oracle E-Business Suite 12.2.3-12.2.14) exposes the complete data accessible to the Configurator application over plain HTTP with no prerequisites. The CISA KEV catalog references this CVE, and watchTowr Labs has published a pre-authentication RCE chain combining this flaw with CVE-2025-61882 - meaning confidentiality loss is the isolated impact, but chaining enables full system compromise. A publicly available exploit exists, and the July 2025 Oracle Critical Patch Update (CPU) addresses this vulnerability.

Technical ContextAI

Oracle Configurator is a rules-based product configuration engine embedded within Oracle E-Business Suite, accessed via its Runtime UI web component over HTTP. CWE-22 (Path Traversal) identifies the root cause: the Runtime UI fails to sanitize or canonicalize user-supplied path segments before resolving file or resource references on the server, allowing an attacker to escape the intended directory tree. The CPE string cpe:2.3:a:oracle:configurator:*:*:*:*:*:*:*:* covers the full 12.2.3 through 12.2.14 version range. Tags indicate a secondary Authentication Bypass dimension, consistent with the watchTowr chain in which this path traversal is used to read credential or session material that enables privilege escalation via the companion CVE-2025-61882.

RemediationAI

Apply the Oracle July 2025 Critical Patch Update (CPU) immediately; this update addresses CVE-2025-61884 and the related CVE-2025-61882. The CPU is documented at https://www.oracle.com/security-alerts/alert-cve-2025-61884.html and https://blogs.oracle.com/security/post/apply-july-2025-cpu - consult those pages for the exact patch identifier and prerequisite patch dependencies specific to your EBS 12.2.x release level. If immediate patching is not possible, restrict network access to the Oracle Configurator Runtime UI endpoint at the network perimeter or web application firewall layer - blocking external and untrusted-network access to the EBS application tier removes the network attack vector (trade-off: this will disrupt legitimate remote users of Configurator). Additionally, enable Oracle EBS access controls to ensure the Configurator URL namespace is not reachable anonymously. Do not treat network restriction as a permanent substitute for the CPU patch given confirmed active exploitation.