CISA confirms hackers exploited Oracle E-Business Suite SSRF flaw

CISA has confirmed that an Oracle E-Business Suite flaw tracked as CVE-2025-61884 is being exploited in attacks, adding it to its Known Exploited Vulnerabilities catalog. BleepingComputer previously reported that CVE-2025-61884 is an unauthenticated server-side request forgery (SSRF) vulnerability in the Oracle Configurator runtime component, which was linked to a leaked exploit used in July attacks. The US cybersecurity agency is now requiring federal agencies to patch the security vulnerability by November 10, 2025. Oracle disclosed the flaw on October 11, giving it a 7.5 severity rating and warning that it was easily exploitable and could be used to gain "unauthorized access to critical data or complete access to all Oracle Configurator accessible data." However, Oracle has not disclosed that the vulnerability was previously exploited, despite BleepingComputer confirming that the update blocks the exploit leaked by ShinyHunters and the Scattered Lapsus$ extortion group. In early October, Mandiant revealed that the Clop ransomware gang had begun sending extortion emails to companies, claiming that they had stolen data from Oracle E-Business Suite instances using zero-day flaws. Oracle responded to this news by stating that the threat actors had exploited previously patched flaws disclosed in July. On October 3, ShinyHunters leaked an Oracle exploit on Telegram, indicating it was used by Clop. The next day, Oracle disclosed CVE-2025-61882, listing the leaked proof-of-concep...