Vulnerabilities

CVSS

7.5 High

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Risk score

100.0

Known exploited

CISA KEV

Published

2025-10-12

Status

Published

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Weaknesses

Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data.CWE-918CWE-22CWE-93CWE-444CWE-287CWE-501

Coverage 1

vulnerability

CISA flags two-year-old Oracle flaw as actively exploited in attacks

CISA has identified a two-year-old Oracle WebLogic Server vulnerability (CVE-2024-21182) as actively being exploited in attacks, prompting a directive for federal agencies to immediately patch their systems. The vulnerab…

BleepingComputer · Jun 2, 2026 High

CVE-2024-21182CVE-2025-61884CVE-2026-21992oracleweblogicvulnerability

All articles mentioning it

Advisories and references

• oracle.com/security-alerts/alert-cve-2025-61884.html
• labs.watchtowr.com/well-well-well-its-another-day-oracle-e-business-...
• blogs.oracle.com/security/post/apply-july-2025-cpu
• cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-...