This vulnerability affects the Oracle Configurator component of Oracle E-Business Suite Runtime UI in versions 12.2.3 through 12.2.14. It is remotely exploitable over HTTP without authentication, enabling attackers to access sensitive data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects network attack vector, low complexity, no privileges or user interaction required, unchanged scope, and high confidentiality impact. Oracle's advisory confirms the vulnerability and strongly recommends applying provided patches or mitigations. The vulnerability is tracked as CVE-2025-61884 and is associated with multiple CWEs including CWE-918, CWE-22, CWE-93, CWE-444, CWE-287, and CWE-501.

Successful exploitation can lead to unauthorized access to critical or all data accessible through Oracle Configurator, compromising confidentiality. There is no impact on integrity or availability reported. The vulnerability is exploitable remotely without authentication, increasing the risk of compromise in exposed environments.

Oracle has released security alerts with patches and mitigation instructions for affected versions 12.2.3 through 12.2.14. Customers are strongly advised to apply these updates as soon as possible. Oracle recommends running supported versions under Premier or Extended Support to receive patches. For unsupported versions, upgrading to a supported release is advised. No indication of 'no action required' or 'already mitigated' is present; therefore, applying the official patches or mitigations is the recommended course of action.