CISA Warns Of Oracle E-Business Suite SSRF Vulnerability Actively Exploited In Attacks

CISA has issued an urgent alert about a critical server-side request forgery (SSRF) vulnerability in Oracle E-Business Suite, now actively exploited by threat actors.

Tracked as CVE-2025-61884, the flaw affects the Runtime component of Oracle Configurator and allows remote attackers to forge requests without authentication, potentially leading to unauthorized access and data exfiltration.

This vulnerability, rated with a high severity score under CVSS 3.1, stems from inadequate input validation that enables attackers to manipulate server requests to internal or external resources.

As organizations rely heavily on Oracle E-Business Suite for enterprise resource planning (ERP), the risks are amplified in sectors like finance, manufacturing, and government, where sensitive data flows through these systems.

Exploitation Tactics And Real-World Impact

CISA’s Known Exploited Vulnerabilities (KEV) catalog added CVE-2025-61884 after evidence emerged of active exploitation in the wild.

Attackers can leverage SSRF to scan internal networks, bypass firewalls, and interact with cloud metadata services, often as a stepping stone for broader intrusions.

While direct ties to ransomware campaigns remain unconfirmed, security researchers note similarities to tactics used in recent supply chain attacks, where SSRF flaws have facilitated lateral movement.

Oracle patched the issue in its October 2025 Critical Patch Update, but unpatched systems remain prime targets.

Early reports indicate exploitation attempts targeting outdated E-Business Suite installations in the Asia-Pacific regions, with potential for widespread compromise if organizations delay remediation.

The flaw aligns with CWE-918, a common SSRF weakness that has plagued enterprise software for years.

Mitigations

CISA urges immediate action: apply Oracle’s vendor-provided patches or mitigations, such as network segmentation and web application firewalls (WAFs) tuned to block anomalous requests.

For cloud-hosted instances, adhere to Binding Operational Directive (BOD) 22-01, which mandates vulnerability management in federal systems.

If mitigations prove infeasible, CISA advises discontinuing use of affected products to avoid exposure. Experts emphasize proactive monitoring, including logging SSRF indicators like unexpected outbound traffic.

Organizations should scan their networks for vulnerabilities using tools like Nessus or OpenVAS and review access logs for signs of exploitation.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.