PT-2025-42998 · Oracle · Oracle Marketing +1

Published 2025-10-21 · Updated 2025-10-24 · CVE-2025-62481

Positive Technologies · (AI Summary)

CVSS v3.1

9.8

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle Marketing versions 12.2.3 through 12.2.14

Description An easily exploitable issue exists in the Oracle Marketing component of Oracle E-Business Suite. An unauthenticated attacker with network access via HTTP can compromise Oracle Marketing, potentially leading to a full system takeover. Successful exploitation can result in high impact to confidentiality, integrity, and availability.

Recommendations For versions 12.2.3 through 12.2.14, restrict network access to the affected component.

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-62481

Affected Products

Oracle E-Business Suite

Oracle Marketing

References · 15

• https://oracle.com/security-alerts/cpuoct2025.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62481 · Security Note
• https://twitter.com/ashrafzaryouh/status/1981580030921621979 · Twitter Post
• https://t.me/pentestingnews/69937 · Telegram Post
• https://t.me/CVEtracker/35436 · Telegram Post
• https://twitter.com/CVEnew/status/1980736577321201684 · Twitter Post
• https://twitter.com/UjlakiMarci/status/1980948874215764429 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1980760192292716689 · Twitter Post
• https://twitter.com/Fisjkars/status/1980964507527622659 · Twitter Post
• https://twitter.com/rxerium/status/1980933235589722515 · Twitter Post
• https://t.me/purp_sec/1226 · Telegram Post
• https://twitter.com/zoomeye_team/status/1981306609239544089 · Twitter Post
• https://twitter.com/DefusedCyber/status/1980937798212284692 · Twitter Post
• https://twitter.com/offseq/status/1980809505039327394 · Twitter Post
• https://twitter.com/CveFindCom/status/1980728278668247372 · Twitter Post