Firetruck

CVE-2025-61884

KEV · Ransomware

Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability

View CVE record →
Vendor / Project
Oracle
Product
E-Business Suite
Date added
Oct 20, 2025
Due date
Nov 10, 2025
Known ransomware use
Known
CWEs
CWE-918

Description

Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes