Oracle Applications Framework CVE-2025-53064

Requires a valid low-privileged authenticated Oracle E-Business Suite account with network/HTTP access to the Oracle Applications Framework Personalization component, on affected versions 12.2.3 through 12.2.14. Exploitation is limited by the authentication requirement (PR:L) and by the bounded impact - only unauthorized insert/update/delete to SOME OAF-accessible data (I:L), with no confidentiality or availability consequence. No special non-default configuration or user interaction is required beyond holding an account.

This is a low-severity, low-real-risk issue despite affecting a major enterprise product. The CVSS 3.1 base score is 4.3 (MEDIUM) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - network-reachable and low-complexity, but requiring an existing low-privileged authenticated account (PR:L) and yielding only a limited integrity impact (I:L: unauthorized update/insert/delete to SOME accessible data), with no confidentiality or availability impact. EPSS is low at 0.24% (14th percentile), there is no CISA KEV listing, and no public exploit was identified, so all exploitation signals are consistent and point to low probability. No SSVC decision data was provided. There are no conflicting signals here: the CVSS vector, EPSS, and absence of KEV/POC all agree this is a bounded, authenticated integrity flaw rather than a priority emergency. The CWE (CWE-284 Improper Access Control) is consistent with an authenticated privilege/authorization weakness rather than a remote takeover.

An attacker who already holds a low-privileged Oracle E-Business Suite account (e.g. a self-service or internal user) sends crafted HTTP requests to the Oracle Applications Framework Personalization component to make unauthorized update, insert, or delete changes to a subset of OAF-accessible data. No public exploit code was identified, and the impact is limited to partial data integrity (no data disclosure, no service disruption).