PT-2025-42969 · Oracle · Oracle Marketing +1

Published 2025-10-21 · Updated 2025-10-24 · CVE-2025-53072

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Marketing versions 12.2.3 through 12.2.14

Description This issue affects the Oracle Marketing product within Oracle E-Business Suite. It allows an unauthenticated attacker with network access via HTTP to compromise Oracle Marketing, potentially leading to a complete takeover of the system. The vulnerability is easily exploitable.

Recommendations For versions 12.2.3 through 12.2.14, apply a patch as soon as possible. Restrict access to the affected component to minimize the risk of exploitation.

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-53072

Affected Products

Oracle E-Business Suite

Oracle Marketing

References · 19

• https://nvd.nist.gov/vuln/detail/CVE-2025-53072 · Security Note
• https://oracle.com/security-alerts/cpuoct2025.html · Vendor Advisory
• https://twitter.com/CVEnew/status/1980736604034723841 · Twitter Post
• https://twitter.com/ashrafzaryouh/status/1981580030921621979 · Twitter Post
• https://twitter.com/UjlakiMarci/status/1980948874215764429 · Twitter Post
• https://twitter.com/rxerium/status/1980933235589722515 · Twitter Post
• https://t.me/purp_sec/1226 · Telegram Post
• https://twitter.com/offseq/status/1980854829242106116 · Twitter Post
• https://twitter.com/DefusedCyber/status/1980937798212284692 · Twitter Post
• https://twitter.com/transilienceai/status/1980839328793199047 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1980755851217424771 · Twitter Post
• https://t.me/pentestingnews/69937 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1980836703565701234 · Twitter Post
• https://twitter.com/0dayPublishing/status/1981052777901052333 · Twitter Post
• https://twitter.com/transilienceai/status/1980839330584150466 · Twitter Post