CVE-2025-61884

Oracle E-Business Suite's unpatched SSRF vulnerability in Oracle Configurator was actively exploited in the wild without authentication, enabling remote code execution and ransomware attacks.

Oracle E-Business Suite's unpatched SSRF vulnerability in Oracle Configurator was actively exploited in the wild without authentication, enabling remote code execution and ransomware attacks. DIB organizations must ensure all Oracle E-Business Suite instances are patched and monitored for exploitation, as this vulnerability allows attackers to execute arbitrary code without needing credentials. The failure highlights the severe risks of relying on unpatched software, especially in critical business environments.

Shame score — The vulnerability was actively exploited in the wild without authentication, enabling ransomware attacks and remote code execution, which is a severe and avoidable failure.