CVE-2025-53072
Published: 21 October 2025
Summary
CVE-2025-53072 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Oracle Marketing. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-53072 is a vulnerability in the Oracle Marketing product of Oracle E-Business Suite, specifically affecting the Marketing Administration component. Supported versions impacted include 12.2.3 through 12.2.14. The issue, associated with CWE-306 (Missing Authentication for Critical Function), carries a CVSS 3.1 Base Score of 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating critical impacts to confidentiality, integrity, and availability.
An unauthenticated attacker with network access via HTTP can easily exploit this vulnerability to compromise the Oracle Marketing component. Successful exploitation enables a full takeover of Oracle Marketing, allowing the attacker to potentially read, modify, or delete sensitive data and disrupt service availability.
Oracle's Critical Patch Update for October 2025, detailed at https://www.oracle.com/security-alerts/cpuoct2025.html, provides information on applicable patches and mitigation steps for addressing this vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-35262
Vulnerability details
Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing. Successful attacks of this vulnerability…
more
can result in takeover of Oracle Marketing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote exploitation over HTTP of a public-facing Oracle Marketing Administration component, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CWE-306 by limiting permitted actions without identification or authentication, preventing unauthenticated takeover of the Marketing Administration component.
Requires timely flaw remediation via patching the vulnerability in Oracle Marketing as detailed in the Critical Patch Update.
Enforces access control policies to block unauthenticated network access via HTTP from compromising confidentiality, integrity, and availability of Oracle Marketing.