CVE-2025-61884

CVE-2025-61884 is a critical unauthenticated access vulnerability in Oracle Configurator's Runtime UI component, present across EBS versions 12.2.3 through 12.2.14. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms what matters most: this is a network-exploitable flaw requiring no credentials and no user interaction. An attacker anywhere on the network can send crafted HTTP requests directly to the Runtime UI endpoint and access configuration data without authentication. The 7.5 severity score understates the operational exposure. Oracle Configurator drives product configuration in sales and ordering workflows, meaning it typically accesses pricing structures, customer-specific product rules, and integration points with ERP backends. This isn't a static data leak — it's unauthorized access to the runtime execution of business logic. An attacker querying this layer is effectively querying a slice of the ERP's business rules database. The EPSS score exceeding 0.97 and the CISA KEV listing confirm this is being exploited at scale. Unlike sophisticated vulnerabilities requiring target research, this is trivially scriptable — mass-scanners are likely already sweeping for it. Enterprise EBS patching cycles typically span weeks to months, creating a durable window where exploitation outpaces remediation. Prioritize these steps immediately: First, apply Oracle's CPU patch for this CVE without delay — the patch addresses the authentication bypass in the Runtime UI layer. Second, if immediate patching isn't feasible, restrict network access to Configurator Runtime UI endpoints at the load balancer or WAF layer, permitting only traffic from trusted sales portal IPs. Third, verify whether the Runtime UI is exposed to the internet — if so, treat this as an emergency priority, as the attack surface is literally anyone with a browser. The architectural question worth examining: Runtime UI components were designed for unauthenticated external access to support sales partner workflows. This design choice is now the vulnerability's attack surface.短期 mitigations buy time, but the long-term question is whether this component should ever be network-exposable without authentication — and whether Oracle's patch process adequately reviews authentication logic in UI layers historically classified as 'presentation tier.'

Reviewed through automated stages and approved by a human before publication.