Oracle Database Server
CVE-2025-61749
LOW
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain DBA credentials on target DB
-
DeliveryConnect via Oracle Net
-
ExploitAbuse Unified Audit component
-
ExecutionModify/delete audit records
-
ImpactConceal prior activity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already hold DBA privilege on an affected Oracle Database Server instance (versions 23.4 through 23.9) and network reachability to the database via Oracle Net. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the DBA-level privilege requirement (PR:H) is the dominant limiting factor - this is realistically an insider-abuse or post-compromise scenario, not a remotely-reachable unauthenticated attack. Impact is confined to unauthorized modification of some Unified Audit data (integrity only); there is no confidentiality or availability impact. |
| Impact | This is a genuinely low-priority issue despite being in a ubiquitous product. The CVSS 3.1 base score of 2.7 is accurate and the vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) tells the whole story: exploitation requires a pre-existing high-privileged DBA account, and the only impact is limited integrity (I:L) - unauthorized update/insert/delete to SOME Unified Audit data, with no confidentiality or availability impact. An attacker who already holds DBA is already the most trusted principal in the database; the marginal risk is that such an actor could tamper with audit records (anti-forensics / covering tracks), not gain new access. EPSS is 0.27% (18th percentile), there is no CISA KEV listing, and no public exploit code was identified - all signals align with the low CVSS. There is no conflict among the signals here; every source points to low real-world urgency. One metadata problem worth noting: the 'Authentication Bypass' tag contradicts the vulnerability, which explicitly REQUIRES authentication at the DBA level (PR:H) - this is an access-control/audit-integrity flaw, not an authentication bypass. |
| Exploit ScenarioDerived | An attacker who has already obtained DBA privileges on an Oracle Database 23.4-23.9 instance connects over Oracle Net and abuses the Unified Audit component to make unauthorized modifications (insert/update/delete) to a subset of audit data - for example, to tamper with or remove audit trail entries and conceal prior malicious activity. No user interaction is required, but the DBA-level privilege prerequisite makes this a post-compromise / insider-abuse scenario rather than an external attack. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Oracle Database Server 23.4 through 23.9 (Oracle Database 23ai) allows an attacker who already holds DBA privileges and network access via Oracle Net to improperly modify some Unified Audit data through the Unified Audit component. The weakness is an access-control flaw (CWE-284) with low attack complexity and no user interaction, but the high-privilege prerequisite (PR:H) makes this an insider-abuse or post-compromise scenario rather than a remotely reachable unauthenticated attack, and impact is limited to integrity with no confidentiality or availability effect. At time of analysis there is no public exploit identified, EPSS is negligible at 0.27% (18th percentile), and Oracle has shipped a fix in its October 2025 Critical Patch Update, so this is a genuinely low-priority maintenance item despite the ubiquitous product.
RemediationAI
Apply the Oracle October 2025 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2025.html), which is the vendor-released remediation for CVE-2025-61749; Oracle publishes CPU patch numbers per platform and version, so confirm the appropriate patch for the exact 23.4-23.9 build in use and follow the standard CPU application procedure including the datapatch step and post-patch verification of the AUDSYS audit trail. Because the flaw is only exploitable by a DBA with Oracle Net access, the meaningful compensating controls target privilege and network exposure: restrict listener reachability with firewall rules or Oracle's own valid-node checking and TCP.INVITED_NODES, accept the trade-off that tightening listener access may break legitimate remote administration or application connectivity; enforce least privilege by minimizing the number of DBA and SYSDBA accounts and separating audit administration duties, which reduces insider-abuse paths but requires role redesign; and enable a second, independent audit sink such as OS-level or centralized audit logging to external syslog or SIEM with restricted write access, so tampering with the database-resident audit trail does not erase the evidence, accepting the added storage and pipeline overhead. Until patching is complete, monitor DBA account activity, prefer OS-authenticated administrative access, and treat any unexplained change to unified audit policies or the UNIFIED_AUDIT_TRAIL as an incident.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected technology is Oracle Database Server's Unified Audit facility, the consolidated auditing framework introduced in 12c that stores audit records in the AUDSYS schema and exposes them through views such as UNIFIED_AUDIT_TRAIL and routines like DBMS_AUDIT_MGMT. Because audit records underpin forensic reconstruction and compliance attestation, their integrity is security-relevant even when confidentiality and availability are unaffected. The reported CWE is CWE-284 (Improper Access Control), meaning the component does not adequately restrict what a highly privileged session can do to audit metadata or records - permitting unauthorized update, insert, or delete operations - rather than an authentication bypass in the classic sense. The attack surface is Oracle Net (AV:N), the standard SQL*Net listener protocol, so an attacker needs both valid DBA-level credentials and network reachability to the listener. Oracle's own published vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) matches the independent assessment exactly: low complexity, high privilege, no user interaction, unchanged scope, integrity-only impact scored at 2.7. The single CPE entry cpe:2.3:a:oracle:database_server:*:*:*:*:*:*:*:* is version-range agnostic, so the authoritative scope comes from the advisory text designating versions 23.4 through 23.9.
Know when Database Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Network via Oracle Net (AV:N), low complexity (AC:L), requires DBA so PR:H, no user interaction; impact is limited integrity to audit data only (I:L), no C or A.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Unified Audit component of Oracle Database Server. Supported versions that are affected are 23.4-23.9. Easily exploitable vulnerability allows high privileged attacker having DBA privilege with network access via Oracle Net to compromise Unified Audit. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Unified Audit accessible data. CVSS 3.1 Base Score 2.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)CVE.org
More in Database Server
View allThe TNS Listener, as used in Oracle Database 11g 11.1.0.7, 11.2.0.2, and 11.2.0.3, and 10g 10.2.0.3, 10.2.0.4, and 10.2.
The authentication protocol in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 all
An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Serv
An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Serv
An exploitable out-of-bounds indexing vulnerability exists within the RW fabric message particle type of Aerospike Datab
An exploitable out-of-bounds write vulnerability exists in the batch transaction field parsing functionality of Aerospik
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointe
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via v
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper point
Unspecified vulnerability in the XML Developer's Kit for C component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.
An exploitable out-of-bounds read vulnerability exists in the client message-parsing functionality of Aerospike Database
GitHub PoC
Exploit-DB