Introduction
A single unauthenticated HTTP request is all it takes for an attacker to seize control of Oracle Marketing in affected Oracle E-Business Suite deployments. Any organization that runs an unpatched version from 12.2.3 through 12.2.14 for business-critical marketing, customer engagement, and analytics is at immediate risk.
About Oracle E-Business Suite and Oracle Marketing: Oracle is a global leader in enterprise software, and Oracle E-Business Suite (EBS) is its ERP platform, in use at thousands of organizations worldwide. Large enterprises use the Marketing Administration component to manage campaigns, customer data, and analytics. A compromise here can expose sensitive business intelligence and disrupt core operations.
Technical information
CVE-2025-62481 is a critical vulnerability in the Marketing Administration component of Oracle E-Business Suite, present in versions 12.2.3 through 12.2.14. An attacker can exploit it remotely over HTTP, with no authentication and no user interaction. Successful exploitation gives a complete compromise of the Oracle Marketing system, with high impact on confidentiality, integrity, and availability. The CVSS v3.1 base score is 9.8, with this vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
As of the October 2025 advisory, neither Oracle nor third-party researchers have published code snippets, root cause details, or exploitation mechanics. Oracle disclosed the vulnerability in its coordinated quarterly patch release and kept the technical detail limited to prevent exploitation before customers patch.
Patch information
Oracle's October 2025 Critical Patch Update (CPU) contains 374 new security patches across its products. They cover issues in Oracle's own code and in third-party components built into its products.
Highlights from the October 2025 CPU:
| Product | New security patches | Remotely exploitable without authentication | Highest CVSS v3.1 Base Score |
|---|---|---|---|
| Oracle Database Server | 6 | 2 | 7.3 |
| Oracle Essbase | 4 | 2 | 8.1 |
| Oracle Hyperion | 7 | 4 | 8.8 |
| Oracle Insurance Applications | 8 | 5 | 8.8 |
| Oracle Java SE | 5 | All 5 | 7.5 |
Applying the patches:
Oracle strongly advises customers to apply these patches promptly. The patches are cumulative, so each one includes the fixes from previous updates. The official advisory lists the affected products and versions in detail.
Customers with valid support contracts can access the patches through My Oracle Support. Read the advisory for the specific instructions, and confirm that every relevant patch is applied.
Patch source: Oracle October 2025 Critical Patch Update
Affected systems and versions
- Oracle E-Business Suite Marketing Administration component
- Affected versions: 12.2.3 through 12.2.14
- All configurations of these versions are vulnerable if they are reachable over the network via HTTP
Vendor security history
E-Business Suite has had several critical vulnerabilities in 2025, including unauthenticated remote code execution flaws that ransomware groups such as CL0P actively exploited. Oracle issues Critical Patch Updates quarterly and has released out-of-band patches for zero-day threats. Its advisories usually give high-level vulnerability and patch information with little technical detail. The recent incidents show that Oracle environments need fast patching and close monitoring.
