PT-2025-42986 · Oracle · Oracle Database Server

Published 2025-10-21 · Updated 2025-10-21 · CVE-2025-61881

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 19.3 through 19.28 Oracle Database Server versions 21.3 through 21.19 Oracle Database Server versions 23.4 through 23.9

Description A difficult to exploit issue exists within the Java VM component of Oracle Database Server. An unauthenticated attacker with network access via Oracle Net can compromise the Java VM. Successful exploitation may lead to unauthorized creation, deletion, or modification of critical data, or all Java VM accessible data.

Recommendations Update Oracle Database Server to a version later than 19.28. Update Oracle Database Server to a version later than 21.19. Update Oracle Database Server to a version later than 23.9.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2025-15861

CVE-2025-61881

Affected Products

Oracle Database Server

References · 6

• https://oracle.com/security-alerts/cpuoct2025.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61881 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61881 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-15861 · Security Note
• https://t.me/CVEtracker/35424 · Telegram Post
• https://twitter.com/CVEnew/status/1980736588767498576 · Twitter Post