Oracle Applications Framework CVE-2025-53071

Exploitation requires an authenticated session as a low-privileged Oracle E-Business Suite user (PR:L) with network HTTP access to the Oracle Applications Framework 'Upload Attachments' component on an affected version (12.2.3 through 12.2.14). No user interaction is needed and attack complexity is low, but the mandatory valid low-privilege credential is the key limiting factor that prevents anonymous/unauthenticated exploitation. Impact is confined to unauthorized insert/update/delete of some Applications Framework data - there is no confidentiality or availability effect - which further limits realistic severity. Organizations that have applied the October 2025 Oracle Critical Patch Update are not exposed.

This is a moderate, not high-priority, issue. The CVSS 3.1 base score of 4.3 (MEDIUM) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N reflects a genuinely limited flaw: network-reachable over HTTP with low attack complexity and no user interaction, but it requires an authenticated low-privileged account (PR:L) and yields only a LOW integrity impact (C:N/I:L/A:N) - unauthorized insert/update/delete to SOME accessible data, with no confidentiality or availability loss. The EPSS score of 0.24% (14th percentile) is low and consistent with the limited impact and authentication requirement, indicating no significant mass-exploitation pressure. There is no CISA KEV listing and no public exploit identified in the provided data, so exploitation is not confirmed. The signals are mutually consistent - nothing here is conflicting - and all point to a low-to-moderate real-world risk: a bounded integrity flaw requiring valid credentials, reported responsibly by the vendor (secalert_us@oracle.com) and fixed in the Oracle October 2025 Critical Patch Update. One caveat: the input Tag 'Authentication Bypass' contradicts the CVSS vector and description, both of which state an authenticated low-privileged attacker is required (PR:L); treat the authentication-bypass label as unreliable.

An attacker who already holds a valid low-privileged Oracle E-Business Suite account sends crafted HTTP requests to the Upload Attachments component of Oracle Applications Framework, abusing improper access control (CWE-284) to insert, modify, or delete application data they should not be able to touch. No user interaction or elevated privileges are needed, but a working authenticated session is a prerequisite. No public exploit code was identified at the time of analysis.