Serial number:AV25-640
Date:October 6, 2025
Updated:October 20, 2025
On October 4, 2025, Oracle published an out-of-band security advisory to address a critical vulnerability in the following product:
- Oracle E-Business Suite – versions 12.2.3 to 12.2.14
The Oracle advisory includes indicators of compromise (IOCs) to aid in the detection of malicious activity.
Update 1
On October 11, 2025, Oracle published an out-of-band security advisory to address a critical vulnerability CVE-2025-61884.
As well, on October 20, 2025, CISA released a statement indicating that CVE-2025-61884 is being actively exploited in the wild and added it to their Known Exploited Vulnerabilities (KEV) Catalog.
The Cyber Centre encourages users and administrators to review the provided web links and perform the suggested mitigations.