Oracle Database Server CVE-2025-53047

Exploitation requires that the target's Portable Clusterware exposes its Bonjour (mDNS/service-discovery) interface to the attacker, and the attacker must have network reachability to that Bonjour service - in typical mDNS deployments this is the local/link-local broadcast domain rather than the open internet, which is the primary practical limiter on reach. No authentication (PR:N), no user interaction (UI:N), and low complexity (AC:L) are needed once reachability exists. Impact is limited to read-only disclosure of a subset of Clusterware-accessible data (C:L, no write or denial-of-service), with a scope change that may expose data relating to additional products. Affected only on Oracle Database Server versions 19.3-19.28, 21.3-21.19, and 23.4-23.9; patched builds from the October 2025 CPU are not exploitable.

This is a genuinely moderate, not high-priority, issue and the signals are internally consistent. The CVSS 3.1 base score is 5.8 (MEDIUM) driven entirely by a low-magnitude confidentiality impact (C:L, with I:N/A:N) elevated slightly by a scope change (S:C); there is no integrity or availability impact and no code execution. EPSS is low at 0.32% (23rd percentile), the CVE is NOT on the CISA KEV list, and no public exploit code is identified in the provided data - three independent signals that all point to low real-world exploitation pressure. The vector is attractive on paper (AV:N/AC:L/PR:N/UI:N: unauthenticated, low complexity, no user interaction), but the outcome is limited to 'unauthorized read access to a subset of Portable Clusterware accessible data,' i.e. partial information disclosure rather than full compromise. One signal deserves scrutiny: Oracle rates the attack vector as Network (AV:N), yet the description explicitly states the attack is 'via Bonjour' - Bonjour/mDNS is a link-local multicast protocol that normally operates only within a single broadcast domain, which in practice implies adjacent-network (AV:A) reachability rather than routable internet exposure. Verify network exposure with Oracle; if Bonjour is indeed link-local, true remote exploitability is narrower than AV:N suggests. Net assessment: patch in a normal cycle, not an emergency.

An unauthenticated attacker positioned on a network segment reachable by the target's Bonjour/mDNS service sends crafted service-discovery traffic to the Portable Clusterware component. The flaw lets the attacker read a subset of Clusterware-accessible data without credentials or user interaction, and the scope change means the disclosed information may relate to other products in the deployment. No public proof-of-concept is identified at time of analysis, and low attack complexity (AC:L) means no special timing or race conditions are required once network reachability exists.