New Oracle E-Business Suite Bug Lets Attackers Bypass Login to Steal Data

A Flaw With No Authentication Required

Oracle has issued an urgent security alert about a newly discovered vulnerability in its E-Business Suite (EBS) software that could allow attackers to access sensitive data without needing to log in. The flaw, tracked as CVE-2025-61884, carries a CVSS 7.5 (high severity) rating and is present in EBS versions 12.2.3 through 12.2.14.

In its advisory, Oracle warned that the vulnerability is remotely exploitable over HTTP and does not require any authentication. In effect, an attacker with network access could compromise the Oracle Configurator component and gain unauthorized access to critical or even all accessible data in the impacted installation.

Oracle emphasized that while the flaw is serious, there is no current evidence of in-the-wild exploitation. The company said it is “crucial” that impacted customers apply the patch as soon as possible.

What This Means — And Why It’s Alarming

This vulnerability stands out for two reasons:

1. No login required — Most enterprise software vulnerabilities still require at least some form of user interaction or credentials. This flaw bypasses that.
2. Access to sensitive data — The attacker could gain access to any data handled by Oracle Configurator in affected EBS deployments, potentially exposing business-critical information.

Oracle’s Chief Security Officer, Rob Duhart, noted that the issue affects “some deployments” of EBS and that it “could be weaponized to allow access to sensitive resources.”

The disclosure comes on the heels of another widely publicized vulnerability in Oracle EBS, CVE-2025-61882, that has reportedly been actively exploited. That earlier flaw has been linked to attacks dropping malware families such as GOLDVEIN.JAVA, SAGEGIFT, SAGELEAF, and SAGEWAVE.

Security researchers also noted possible associations with threat actors tied to the Cl0p ransomware group, although Oracle has not publicly confirmed attribution.

Background: EBS, Patching Challenges, and Enterprise Exposure

Oracle E-Business Suite is a comprehensive suite of enterprise resource planning (ERP) applications used by many large organizations globally to manage finance, supply chain, manufacturing, and more. Because of its central role, any vulnerability within EBS can have cascading consequences.

In recent years, enterprise software providers like Oracle have come under increasing pressure to rapidly patch vulnerabilities before they’re weaponized. The discovery of successive zero-day flaws (like CVE-2025-61882 and now CVE-2025-61884) underlines that even well-resourced companies remain exposed.

Complicating matters, critical patches in enterprise systems often require downtime, careful regression testing, and coordination across multiple interdependent environments. As a result, organizations may delay applying fixes — a window attackers could exploit.

Furthermore, attackers targeting ERP systems gain high-value payoffs: proprietary business intelligence, financial data, customer records, or intellectual property. The fact that this newly discovered bug requires no authentication raises the stakes even higher.

Expert Insight: What to Do Now

While Oracle has not publicly released detailed exploit code, experts advise the following actions for EBS users:

• Apply patches immediately — Confirm your version and install the update provided by Oracle.
• Isolate exposure — Restrict access to EBS management endpoints from untrusted networks whenever possible.
• Monitor logs and network traffic — Look for anomalous HTTP access to Oracle Configurator components or data exfiltration signals.
• Review compensating controls — If patching is delayed, enforce stronger network segmentation, firewalls, or Web Application Firewall (WAF) rules to limit reachability.
• Check for signs of prior compromise — Given ongoing exploits of related EBS flaws, conduct forensic review of system activity, file integrity, and malware presence.

Some security practitioners note that this bug exemplifies the broader shift toward zero-interaction vulnerabilities in enterprise systems, which require defenders to move faster and adopt more proactive detection strategies.

Conclusion: Urgency in the Face of Risk

Oracle’s disclosure of CVE-2025-61884 marks yet another serious vulnerability in a widely deployed enterprise platform — and one that allows attackers to breach systems without any login path. For organizations running affected versions of Oracle E-Business Suite, the window for action is narrow. Immediate patching, diagnostic review, and compensating controls are essential to prevent potential data breaches. Given the recent history of attacks on Oracle EBS, security teams must remain vigilant and treat this as a high-priority issue.