Oracle Marketing CVE-2025-53072

No special configuration is required: per the CVSS vector (AV:N/AC:L/PR:N/UI:N) and CWE-306, this is remote, unauthenticated HTTP exploitation of a Marketing Administration function that is missing an authentication check, against affected Oracle E-Business Suite versions 12.2.3 through 12.2.14. The primary limiting factor is network reachability of the Oracle Marketing HTTP interface - organizations that expose EBS only on internal networks or behind access controls substantially reduce exposure - and applicability is bounded to the 12.2.3-12.2.14 version range with the Marketing component deployed.

All severity signals point to a genuinely high-priority flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated vulnerability with full Confidentiality, Integrity, and Availability impact (9.8 Critical), and the CWE-306 (Missing Authentication for a Critical Function) classification plus the 'Authentication Bypass' tag are consistent with Oracle's own 'unauthenticated attacker with network access via HTTP' language - the signals do not conflict. However, exploitation-likelihood signals are currently modest: EPSS is only 0.65% (49th percentile), the vulnerability is NOT in CISA KEV, and no public proof-of-concept is identified in the provided data. This is the classic 'high-CVSS, not-yet-weaponized' posture: the vulnerability is architecturally severe and trivially exploitable in principle, but there is no evidence of active exploitation or available exploit code at time of analysis. No SSVC decision data was provided. Given Oracle E-Business Suite's history of being targeted after CPU disclosures, the low EPSS should be treated as a point-in-time snapshot rather than a reason to deprioritize; the absence of a patch rating gap or vendor-confirmed exploitation is the main thing limiting urgency today.

A remote, unauthenticated attacker reaches an internet-facing or network-accessible Oracle Marketing endpoint and sends crafted HTTP requests to a function that is missing an authentication check (CWE-306), bypassing login entirely. Because the flaw yields full compromise ('takeover of Oracle Marketing') with high confidentiality, integrity, and availability impact, the attacker can read, alter, or destroy marketing data and pivot within the EBS environment. No public exploit code is identified at time of analysis, so this scenario is inferred from the CVSS vector rather than a demonstrated POC.