tag

Oracle-Ebs

CVE-2025-61882 web CRITICAL 9.8 KEV Ransomware EPSS 100%

Oracle E-Business Suite Pre-Authentication RCE Chain (CVE-2025-61882)

CVE-2025-61882 is an unauthenticated remote code execution chain in Oracle E-Business Suite 12.2.3 through 12.2.14. An attacker POSTs an XML document to the unauthenticated /OAHTML/configurator/UiServlet endpoint; the servlet extracts a returnurl element from…

Patched 2026-08-09