VulnRadar

Data against noise.

Built with NaN
Page generated: 09 Nov 2026, 06:56 UTC
← Dashboard

CVE-2025-61884

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configu…

Read full description
Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVSS 7.5 (HIGH) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
8.6/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 7.5: +1.12
  • Fresh EPSS: 95.89%: +0.48

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 18 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

Rescana
Press · 24 Nov 2025, 08:00 · Cox Enterprises Data Breach: Cl0p Ransomware Exploits Oracle E-Business Suite Zero-Day Vulnerability (CVE-2025-61882) - Rescana
The Register
Press · 11 Nov 2025, 08:00 · Hitachi-owned GlobalLogic admits data stolen by Clop - The Register
Recorded Future
Press · 06 Nov 2025, 08:00 · October 2025 CVE Landscape: 32 High-Impact Vulnerabilities Demand Immediate Attention - Recorded Future
Cyber Daily
Press · 22 Oct 2025, 07:00 · US cyber agency adds 5 known exploited vulnerabilities to KEV listing - Cyber Daily
Help Net Security
Press · 21 Oct 2025, 07:00 · CISA warns of Windows SMB flaw under active exploitation (CVE-2025-33073) - Help Net Security
See all 18 source documents
SecurityWeek
Press · 21 Oct 2025, 07:00 · CISA Confirms Exploitation of Latest Oracle EBS Vulnerability - SecurityWeek
The Hacker News
Press · 20 Oct 2025, 07:00 · Five New Exploited Bugs Land in CISA's Catalog — Oracle and Microsoft Among Targets - The Hacker News
Dark Reading
Press · 15 Oct 2025, 07:00 · Harvard University Breached in Oracle Zero-Day Attack - Dark Reading
csoonline.com
Press · 14 Oct 2025, 07:00 · Oracle issues second emergency patch for E-Business Suite in two weeks - csoonline.com
Security Affairs
Press · 14 Oct 2025, 07:00 · Oracle issued an emergency security update to fix new E-Business Suite flaw CVE-2025-61884 - Security Affairs
Field Effect
Press · 14 Oct 2025, 07:00 · Oracle issues second emergency patch amid active EBS exploitation - Field Effect
BleepingComputer
Press · 14 Oct 2025, 07:00 · Oracle silently fixes zero-day exploit leaked by ShinyHunters - BleepingComputer
SOC Prime
Press · 13 Oct 2025, 07:00 · CVE-2025-61884: Novel Oracle E-Business Suite Vulnerability Enables Remote Theft of Sensitive Data Without Login - SOC Prime
SecurityWeek
Press · 13 Oct 2025, 07:00 · Oracle Patches EBS Vulnerability Allowing Access to Sensitive Data - SecurityWeek
BleepingComputer
Press · 13 Oct 2025, 07:00 · Oracle releases emergency patch for new E-Business Suite flaw - BleepingComputer
Help Net Security
Press · 12 Oct 2025, 07:00 · Another remotely exploitable Oracle EBS vulnerability requires your attention (CVE-2025-61884) - Help Net Security
Oracle Blogs
Press · 12 Oct 2025, 07:00 · Security Alert CVE-2025-61884 Released - Oracle Blogs
Google Cloud
Press · 09 Oct 2025, 07:00 · Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign - Google Cloud

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 8.6 (2026-11-02 15:14). The curve appears once the score changes.

Public exploit evidence

0

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 7.5; EPSS 95.9%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:43.394995+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
09 Oct 2025, 07:00
Published
12 Oct 2025, 02:34
Added to the CISA KEV catalog
20 Oct 2025, 00:00
Latest press mention
24 Nov 2025, 08:00
Score calculated
05 Nov 2026, 13:59
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar