DaystoPatch

OracleExploited incident

Oracle E-Business Suite Configurator SSRF used by the leaked ShinyHunters exploit (CVE-2025-61884)

CVE-2025-61884High, CVSS 7.5In CISA's Known Exploited Vulnerabilities catalog since 20 Oct 2025

  • Exploited before a fix
  • Known ransomware use
FixedFixed for every supported version 7 days after the first public report.

Response

Silence
7d
First public report to first vendor statement
Exposure
7d
First public report to first fix
Follow-through
7d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Oracle Security Alert CVE-2025-61882, Rev 1 of 2025-10-04 (Wayback capture 2025-10-05)CuratedQuote verified

    oracle_ebs_nday_exploit_poc_scattered_lapsus_retard_cl0p_hunters.zip

    Oracle's CVE-2025-61882 alert (Rev 1, 2025-10-04) listed the exploit archive leaked on Telegram by 'Scattered Lapsus$ Hunters' as an indicator of compromise. BleepingComputer (2025-10-14) later established that this leaked exploit's UiServlet SSRF is the bug fixed as CVE-2025-61884, not CVE-2025-61882. The leak itself happened about a day earlier on Telegram (BleepingComputer: 'on Friday', i.e. 2025-10-03); no citable dated copy of the leak was used.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:eb5eeea7bc75f227…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    watchTowr Labs: Oracle E-Business Suite Pre-Auth RCE Chain analysisCuratedQuote verified6 Oct 2025, 17:41 UTC

    we can see a servlet definition for the URL pattern /configurator/UiServlet

    Public technical analysis of the leaked PoC; stage 1 is the UiServlet SSRF. Page shows 'Published 6 Oct 2025'; article:published_time meta is 2025-10-06T17:41:51.000Z.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5ca4914be26a04dc…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-61884ClaimedQuote verified12 Oct 2025, 02:34 UTC

    Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5d8c0598f656f06e…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet12 Oct 2025, 03:03 UTC

    Oracle Configurator (12.2.3–12.2.14) HIGH severity flaw (CVE-2025-61884): Unauthenticated HTTP attackers can access all config data. Patch ASAP & restrict network exposure. https://radar.offseq.com/threat/cve-2025-61884-easily-exploitable-vulnerability-al-08dc9c67

    Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet12 Oct 2025, 03:08 UTC

    Oracle Security Alert CVE-2025-61884 for E-Business Suite

    Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet13 Oct 2025, 15:15 UTC

    the emergency patch could be your only defense. https:// thedefendopsdiaries.com/oracle -e-business-suite-faces-critical-cve-2025-61884-vulnerability-immediate-action-required/ # oracle # cve202561884 # cybersecurity # databreach # patchmanagement

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-61884)ClaimedQuote verified20 Oct 2025

    Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability

    Added to CISA's KEV catalog on 2025-10-20.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date only+7d

    Oracle Security Alert Advisory - CVE-2025-61884 (Wayback snapshot)CuratedQuote verified

    2025-October-11 Rev 1. Initial Release.

    Out-of-band alert released on a Saturday. It does not say the bug was exploited or that a public exploit existed (BleepingComputer: 'Oracle did not disclose that the flaw was actively exploited').

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7f8d46ec63285318…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date only+7d

    Oracle Security Alert Advisory - CVE-2025-61884 (Wayback snapshot)CuratedQuote verified

    Oracle strongly recommends that customers apply the updates or mitigations provided by this Security Alert as soon as possible.

    Alert Rev 1 dated 2025-10-11 ('2025-October-11 Rev 1. Initial Release.'), covering E-Business Suite 12.2.3-12.2.14.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7f8d46ec63285318…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date only+7d

    Oracle Security Alert Advisory - CVE-2025-61884 (Wayback snapshot)CuratedQuote verified

    Oracle E-Business Suite, versions 12.2.3-12.2.14

    All supported affected versions listed in the one alert (Rev 1, 2025-10-11); patch documents are behind My Oracle Support login.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7f8d46ec63285318…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Oracle E-Business Suite (Oracle Configurator, Runtime UI) 12.2.3-12.2.14
How we built this timeline

Related to, but kept separate from, oracle-cve-2025-61882: different Oracle advisory, different exploit chain (UiServlet SSRF from the exploit leaked by Scattered Lapsus$ Hunters vs the SyncServlet chain attributed to Clop), different fix date. BleepingComputer (14 Oct 2025): 'Oracle has silently fixed an Oracle E-Business Suite vulnerability (CVE-2025-61884) that was actively exploited to breach servers' and 'Researchers at Mandiant also stated they saw exploitation activity similar to Scattered Lapsus$ Hunter's leaked PoC exploit targeting UiServlet in July 2025.' Hence exploited before a fix=true; the exploit was public from about 3 Oct 2025 and the fix came 11 Oct 2025.

Researchers told BleepingComputer the SSRF still worked after the CVE-2025-61882 patch and was fixed only by this alert. CVSS 7.5 from Oracle's risk matrix. ransomware=true follows KEV ('Known').

Wayback snapshots cited because oracle.com blocks non-browser user agents.

Related

Oracle report card