Introduction
In affected deployments, a single unauthenticated HTTP request can lead to a complete compromise of Oracle E-Business Suite Marketing Administration. Organizations that run critical business operations on Oracle EBS face full system takeover if they leave this flaw unpatched.
About Oracle and Oracle E-Business Suite: Oracle is one of the world's largest enterprise software vendors, with thousands of customer organizations worldwide. Oracle E-Business Suite (EBS) is its flagship ERP platform, used for financials, supply chain, CRM, and more. EBS is modular and deeply integrated into business processes, so it sits at the center of enterprise IT for many companies. The same integration makes it a high-value target for attackers.
Technical information
CVE-2025-53072 is a critical vulnerability in the Marketing Administration component of Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.14. The flaw is reachable over HTTP, and an attacker can exploit it remotely without authentication or user interaction. According to Oracle's advisory, successful exploitation lets a remote attacker take full control of the Oracle Marketing system. Oracle rates the attack complexity as low (no special conditions required). The CVSS 3.1 base score is 9.8, with this vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The vector breaks down as follows:
- Attack Vector: Network (HTTP)
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
As of the October 2025 Critical Patch Update, neither Oracle nor any public source has disclosed further technical details, vulnerable code, or exploit specifics. No public proof of concept or exploit code is available.
Affected systems and versions
- Oracle E-Business Suite Marketing Administration component
- Affected versions: 12.2.3 through 12.2.14
- All supported configurations of these versions are vulnerable
Vendor security history
Oracle E-Business Suite has had several critical vulnerabilities in recent years, including:
- CVE-2025-61882: Pre-auth RCE exploited in the wild
- CVE-2025-61884: Pre-auth RCE exploited in the wild
Oracle issues quarterly Critical Patch Updates and has answered recent EBS threats with timely advisories and patches. EBS is complex and widely deployed, though, so delayed patching remains a recurring risk for customers.
