{"id":"CVE-2025-53072","published":"2025-10-21T20:03:07Z","modified":"2026-02-26T16:57:19Z","title":"Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration)","vendor":"Oracle Corporation","product":"Oracle Marketing","tier":"core","eol":null,"affectedVersions":[{"vendor":"Oracle Corporation","product":"Oracle Marketing","versions":[">= 12.2.3, <= 12.2.14"]}],"description":{"text":"Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing.  Successful attacks of this vulnerability can result in takeover of Oracle Marketing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is in the Marketing Administration component of Oracle Marketing, a product within Oracle E-Business Suite. An unauthenticated attacker with network access over HTTP can compromise Oracle Marketing and take it over, with no user interaction or special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:51Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00645,"percentile":0.50819,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-05-19","exploitedFirstSeen":"2026-05-19","ransomware":true,"evidence":[{"url":"https://insights.bridewell.com/hubfs/Reports/Bridewell%202026%20Cyber%20Threat%20Intelligence%20Report.pdf","date":"2026-05-19"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2025.html","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-35262","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-35262","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2025-10-22","earliestUrl":"https://github.com/rxerium/CVE-2025-53072-CVE-2025-62481","repos":[{"name":"rxerium/CVE-2025-53072-CVE-2025-62481","url":"https://github.com/rxerium/CVE-2025-53072-CVE-2025-62481","stars":3,"created":"2025-10-22"}]},"first":{"date":"2025-10-22","source":"PoC-in-GitHub","url":"https://github.com/rxerium/CVE-2025-53072-CVE-2025-62481"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-10-21","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-53072","provenance":"source"},{"date":"2025-10-22","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/rxerium/CVE-2025-53072-CVE-2025-62481","provenance":"source"},{"date":"2026-05-19","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://insights.bridewell.com/hubfs/Reports/Bridewell%202026%20Cyber%20Threat%20Intelligence%20Report.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":72.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 164 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":10.16,"detail":"percentile 0.5082"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}