CVE-2025-53037
Published: 21 October 2025
Summary
CVE-2025-53037 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Oracle Financial Services Analytical Applications Infrastructure. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-53037 is a critical vulnerability in the Platform component of Oracle Financial Services Analytical Applications Infrastructure, part of the Oracle Financial Services Applications product suite. The affected versions are 8.0.7.9, 8.0.8.7, and 8.1.2.5. This easily exploitable issue, associated with CWE-306 (Missing Authentication for Critical Function), carries a CVSS 3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting high impacts to confidentiality, integrity, and availability.
An unauthenticated attacker with network access via HTTP can exploit this vulnerability to fully compromise the Oracle Financial Services Analytical Applications Infrastructure, enabling takeover of the affected component.
The official mitigation guidance is detailed in Oracle's Critical Patch Update advisory for October 2025, available at https://www.oracle.com/security-alerts/cpuoct2025.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-35295
Vulnerability details
Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise…
more
Oracle Financial Services Analytical Applications Infrastructure. Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote exploitation over HTTP of a public-facing application component, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly identifies and restricts critical platform functions accessible without authentication, addressing the CWE-306 missing authentication for critical function in this CVE.
Requires timely remediation of the specific vulnerability through application of Oracle's Critical Patch Update, preventing unauthenticated exploitation.
Enforces access control policies to require authentication for network-accessible HTTP functions, blocking unauthorized takeover of the platform.