# CVE-2025-61884: Oracle Configurator - Authentication Bypass

> Live exploitation tracking for CVE-2025-61884 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-61884

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** Oracle Configurator
- **Weaknesses:** CWE-93 (Improper Neutralization of CRLF Sequences ('CRLF Injection')); CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')); CWE-287 (Improper Authentication); CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')); CWE-918 (Server-Side Request Forgery (SSRF)); CWE-501 (Trust Boundary Violation)
- **Tags:** enterprise_software

## Description

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

## CrowdSec analysis

[CVE-2025-61884](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-61884) is a vulnerability in Oracle Configurator within Oracle E-Business Suite (versions 12.2.3 to 12.2.14) that allows unauthenticated attackers with network access to compromise the system via HTTP. Exploiting this flaw could grant unauthorized access to sensitive or critical data managed by Oracle Configurator, posing a significant confidentiality risk.

CrowdSec has been tracking this vulnerability and its exploits since 5th of November 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2025-61884 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
In addition, according to the CrowdSec network, attack volume against CVE-2025-61884 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit this vulnerability by sending crafted POST requests to the `/OA_HTML/configurator/UiServlet` endpoint, embedding external URLs in the `return_url` parameter to trigger server-side request forgery (SSRF) in Oracle E-Business Suite.

## Timeline

- 2025-10-12: CVE Published. CVE-2025-61884 is published to NVD.
- 2025-10-20: CISA KEV. CVE-2025-61884 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2025-11-05: Rule Released. CrowdSec releases a rule to detect CVE-2025-61884 exploitation attempts against the CrowdSec Network.
- 2025-11-05: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-61884 for the first time.
- 2025-11-10: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882well-well-well-its-another-day-oracle-e-business-suite-pre-auth-rce-chain-cve-2025-61882/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61884
- https://www.oracle.com/security-alerts/alert-cve-2025-61884.html
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-61884.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-61884) follows observed exploitation activity for CVE-2025-61884. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.