Oracle Database Server CVE-2025-61881

Exploitation requires network access to the Oracle Database Server's Java VM component via the Oracle Net protocol (the database listener), against affected versions 19.3-19.28, 21.3-21.19, or 23.4-23.9. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the high attack complexity (AC:H) - Oracle explicitly labels it 'difficult to exploit' - means exploitation depends on specific unstated conditions such as timing, environmental state, or configuration that limit reliable attacks. Impact is confined to integrity: data can be created, deleted, or modified, but there is no confidentiality or availability impact. The primary limiting factor is that the database listener/Oracle Net must be network-reachable to the attacker and the Java VM option must be in use.

This is a moderate, not top-tier, priority. The CVSS 3.1 base score of 5.9 reflects a network-reachable (AV:N) but high-complexity (AC:H) flaw requiring no privileges (PR:N) or user interaction (UI:N), with impact limited strictly to integrity (C:N/I:H/A:N) - attackers can create, delete, or modify critical Java VM data but cannot read it or deny service. The signals are internally consistent and point away from mass exploitation: EPSS is just 0.23% (13th percentile), the vulnerability is NOT on CISA KEV, and no public exploit code was identified. The AC:H rating (Oracle describes it as 'difficult to exploit') is the key limiting factor - successful attacks likely require specific conditions or race timing that resist commodity weaponization. There is no conflict between the data sources here; low EPSS, absence of KEV, and high attack complexity all reinforce that this is a real-but-not-urgent integrity flaw rather than a high-CVSS issue masking low real risk. The main caveat is sourcing: all details derive from a single Oracle Critical Patch Update advisory with no independent vendor-external corroboration.

An unauthenticated attacker with network reachability to the Oracle Database listener sends crafted traffic over the Oracle Net protocol to the Java VM component. By exploiting the flaw under the specific conditions the high attack complexity implies, the attacker modifies or deletes integrity-critical data accessible to the Java VM. No public proof-of-concept exists, and the high complexity makes reliable exploitation non-trivial.