PT-2025-16436 · Oracle · Oracle Database Server

Published 2025-04-15 · Updated 2025-06-26 · CVE-2025-30702

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 19.3 through 19.26

Description The issue affects the Fleet Patching and Provisioning component of Oracle Database Server, allowing an unauthenticated attacker with network access via HTTP to compromise it. Successful attacks can result in unauthorized read access to a subset of Fleet Patching and Provisioning accessible data.

Recommendations For versions 19.3 through 19.26, update to a version that includes a fix for this issue to prevent unauthorized read access. As a temporary workaround, consider restricting access to the Fleet Patching and Provisioning component until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2026-02536

CVE-2025-30702

Affected Products

Oracle Database Server

References · 7

• https://oracle.com/security-alerts/cpuapr2025.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02536 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30702 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30702 · Security Note
• https://t.me/cvenotify/126787 · Telegram Post
• https://twitter.com/CVEnew/status/1912247267962286574 · Twitter Post
• https://support.oracle.com/signin/?kmContentId=2927522 · Note