Critical Oracle EBS Flaw Could Expose Sensitive Data

Oracle published a patch for CVE-2025-61884, a CVSS 7.5 authentication-bypass in the Oracle E-Business Suite Configurator Runtime UI that can be exploited remotely without credentials to access sensitive configuration and system data; the advisory urges immediate patching, access restriction, logging, and other hardening measures and notes prior exploitation of a related CVE (CVE-2025-61882) in data-theft/extortion campaigns.