{"id":"CVE-2025-62481","published":"2025-10-21T20:03:18Z","modified":"2026-02-26T16:57:17Z","title":"Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration)","vendor":"Oracle Corporation","product":"Oracle Marketing","tier":"core","eol":null,"affectedVersions":[{"vendor":"Oracle Corporation","product":"Oracle Marketing","versions":[">= 12.2.3, <= 12.2.14"]}],"description":{"text":"Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration).  Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing.  Successful attacks of this vulnerability can result in takeover of Oracle Marketing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is in the Marketing Administration component of Oracle Marketing, which is part of Oracle E-Business Suite. An unauthenticated attacker with network access over HTTP can exploit it with low complexity and no user interaction, allowing them to take over Oracle Marketing.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:28Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00599,"percentile":0.48671,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-05-19","exploitedFirstSeen":"2026-05-19","ransomware":true,"evidence":[{"url":"https://insights.bridewell.com/hubfs/Reports/Bridewell%202026%20Cyber%20Threat%20Intelligence%20Report.pdf","date":"2026-05-19"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuoct2025.html","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-35230","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-35230","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-10-21","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-62481","provenance":"source"},{"date":"2026-05-19","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://insights.bridewell.com/hubfs/Reports/Bridewell%202026%20Cyber%20Threat%20Intelligence%20Report.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":66.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 166 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":9.73,"detail":"percentile 0.4867"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}