CVE-2025-61884: Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability

CVE-2025-61884 is a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator within Oracle E-Business Suite. It is remotely exploitable without authentication, allowing an unauthenticated attacker to induce the server to make requests to unintended destinations. This matters because Oracle E-Business Suite often sits at the center of enterprise finance, supply-chain, and HR processes; successful abuse can give an attacker a foothold for internal reconnaissance or further compromise. The vulnerability has been associated with known ransomware activity, elevating the urgency for defenders.

How it works

The flaw is classified as CWE-918 (Server-Side Request Forgery). In an SSRF weakness of this class, the application accepts attacker-controlled input that influences the destination of an outbound request made by the server itself. Because the request originates from a trusted internal host, network controls that would block external scanners often do not apply. An attacker who can reach the vulnerable Runtime component of Oracle Configurator can therefore coerce the E-Business Suite server into contacting internal services, cloud metadata endpoints, or other systems that would otherwise be unreachable. Exact request formats, parameters, and reachable targets must be confirmed against the vendor advisory; public technical detail beyond the CISA summary is limited.

Am I affected? How to find it in your systems

Oracle E-Business Suite is typically deployed on-premises or in private cloud environments supporting ERP workloads. Inventory every instance of Oracle E-Business Suite and specifically identify whether the Oracle Configurator product and its Runtime component are installed and reachable. Check configuration management databases, software asset inventories, and application server inventories for E-Business Suite installations. Because no fixed version list is provided here, compare the installed release and patch level against the official Oracle security advisory for CVE-2025-61884 to determine exposure.

• Review network diagrams and firewall rules for any external or semi-trusted access to Configurator-related endpoints.
• Examine application and web-server access logs for unusual outbound connection patterns, unexpected internal IP ranges, or repeated requests that could indicate probing of the Runtime component.
• If the environment is cloud-hosted, also follow applicable BOD 22-01 guidance for cloud services as noted by CISA.

Telemetry that shows the E-Business Suite host initiating connections to internal services it does not normally contact should be treated as a high-priority investigation lead.

How to remediate

The primary remediation is to apply the vendor-supplied update or mitigation instructions published by Oracle for CVE-2025-61884. Confirm the exact patch, bundle, or configuration change against the official advisory before deployment. After patching, verify that the Runtime component of Oracle Configurator no longer accepts the previously vulnerable request patterns.

• Apply the Oracle-provided fix in a controlled change window and re-test Configurator functionality.
• Harden the surrounding environment by restricting the E-Business Suite host’s ability to initiate outbound connections to only the destinations required for legitimate business operations.
• Ensure that any compensating network controls (firewall rules, proxy allow-lists) remain in place after the patch is applied.

If mitigations are unavailable, CISA guidance states that organizations should discontinue use of the product.

If you can't patch immediately

Until the vendor update can be installed, reduce the attack surface with layered compensating controls. Segment the Oracle E-Business Suite servers so that only authorized management and application tiers can reach the Configurator Runtime interfaces. Deploy or tune a web application firewall or reverse-proxy rules capable of detecting and blocking SSRF-style request patterns directed at the affected component; treat these as virtual patches and validate them carefully to avoid breaking legitimate traffic. Where operationally feasible, temporarily disable or restrict access to the Oracle Configurator Runtime feature until it can be patched. Increase monitoring of outbound connections from the E-Business Suite hosts and alert on any traffic to unexpected internal addresses or cloud metadata services. For cloud deployments, also follow BOD 22-01 guidance. These measures lower risk but do not replace the vendor fix.

If your data may have been exposed

Because this vulnerability is known to have been used in ransomware campaigns and is remotely exploitable without authentication, any unpatched instance should be treated as potentially compromised. Conduct a thorough incident review of the affected systems, looking for evidence of unauthorized internal requests, lateral movement, or data staging. Organizations that suspect exposure can also run a free exposure scan of their email addresses against known breach data sets to determine whether credentials or personal information have already appeared in public breach collections. Preserve logs and engage incident-response procedures promptly if indicators of compromise are found.