Introduction
Unauthorized access to critical business configuration data in Oracle E-Business Suite can have direct operational and competitive consequences. CVE-2025-61884, which Oracle disclosed on October 11, 2025, exposes a significant share of the world's ERP deployments to unauthenticated data exposure through the Configurator Runtime UI.
Oracle E-Business Suite (EBS) is an enterprise resource planning platform that thousands of organizations worldwide use to run finance, HR, supply chain, and customer operations. Organizations depend on the Configurator module to manage complex product and service configurations, so a vulnerability in this component hits especially hard at companies that rely on EBS for core business processes.
Technical Information
CVE-2025-61884 is an easily exploitable vulnerability in the Oracle Configurator component (Runtime UI) of Oracle E-Business Suite. An attacker with network access over HTTP can read sensitive configuration data without authenticating. The Runtime UI is the web interface for working with configuration models and data. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, which means the vulnerability can be exploited remotely, needs no authentication or user interaction, and has a high confidentiality impact (data exposure).
The root cause is an authentication bypass in the Runtime UI that lets unauthenticated requests retrieve or enumerate sensitive data managed by Oracle Configurator. As of this writing, there is no public exploit code and no detailed technical breakdown of the vulnerable code path. No information is available about the specific HTTP endpoints or request structures involved.
Patch Information
Oracle has released a security patch for CVE-2025-61884 in Oracle E-Business Suite versions 12.2.3 through 12.2.14. The vulnerability allows unauthorized remote access to sensitive resources without authentication, and Oracle strongly recommends that customers apply the updates promptly. Instructions for obtaining and applying the patch are in the Patch Availability Document linked below.
Affected Systems and Versions
- Oracle E-Business Suite (EBS) Configurator component (Runtime UI)
- Affected versions: 12.2.3 through 12.2.14
- All configurations of these versions are vulnerable unless patched
Vendor Security History
Oracle E-Business Suite has had several high-impact vulnerabilities in recent years, including unauthenticated remote code execution and data exposure issues. CVE-2025-61882, disclosed one week earlier, targeted a different EBS component and was actively exploited in the wild. Oracle publishes Critical Patch Updates on a quarterly schedule and typically issues out-of-cycle security alerts and patches for vulnerabilities like these. Its response to critical EBS vulnerabilities is generally prompt, especially when active exploitation is detected.
