PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-61884 Oracle CVE debrief

CVE-2025-61884 is a server-side request forgery (SSRF) vulnerability in Oracle E-Business Suite. CISA added it to the Known Exploited Vulnerabilities catalog on 2025-10-20, which means the issue is confirmed to be under active exploitation. CISA also marks it as having known ransomware campaign use, making this a high-priority issue for defenders running Oracle E-Business Suite.

Vendor
Oracle
Product
E-Business Suite
CVSS
HIGH 7.5
CISA KEV
Listed
Original CVE published
2025-10-20
Original CVE updated
2025-10-20
Advisory published
2025-10-20
Advisory updated
2025-10-20

Who should care

Oracle E-Business Suite administrators, application owners, incident response teams, vulnerability management teams, and cloud/security operations staff responsible for systems that use or expose Oracle E-Business Suite.

Technical summary

The vulnerability is identified as an SSRF issue in Oracle E-Business Suite. The supplied official sources do not provide additional technical details beyond the vulnerability class, but CISA's KEV listing confirms known exploitation and references Oracle's security alert for vendor guidance.

Defensive priority

Urgent. This CVE is on CISA's Known Exploited Vulnerabilities catalog, was added on 2025-10-20, and has a mitigation due date of 2025-11-10 in the supplied KEV metadata.

Recommended defensive actions

  • Review Oracle's security alert for CVE-2025-61884 and apply the vendor-recommended mitigations.
  • Meet the CISA KEV mitigation due date of 2025-11-10.
  • If mitigations are unavailable, discontinue use of the product as directed in the CISA KEV guidance.
  • If the product is used in cloud services, follow applicable BOD 22-01 guidance.
  • Verify which Oracle E-Business Suite instances are in scope and prioritize remediation for any exposed or business-critical deployments.

Evidence notes

The supplied CISA KEV metadata identifies CVE-2025-61884 as an Oracle E-Business Suite SSRF vulnerability, with dateAdded 2025-10-20, dueDate 2025-11-10, and knownRansomwareCampaignUse set to Known. The KEV notes reference Oracle's security alert for this CVE and the NVD entry as official reference points.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-61884 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-61884

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-61884 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-61884

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.