Oracle Marketing CVE-2025-62481

The affected product must be Oracle E-Business Suite versions 12.2.3 through 12.2.14 with the Oracle Marketing product (Marketing Administration component) deployed and its HTTP interface network-reachable by the attacker. Per the Oracle CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no credentials, and no user interaction are required, so exploitation works against affected default-reachable configurations. The primary limiting factors are therefore exposure-based rather than configuration-based: whether the EBS Marketing component is internet-facing or otherwise reachable by the attacker, and whether the October 2025 CPU patch has been applied. Deployments where EBS is fully internal/segmented or already patched are not exposed.

All authoritative signals point to a severe, high-priority flaw: the Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, low-complexity, unauthenticated vulnerability with full confidentiality, integrity and availability impact, and the CWE-306 (Missing Authentication for Critical Function) classification is fully consistent with the 'Authentication Bypass' tag and the description's 'unauthenticated attacker' language. The counter-signal is EPSS: at 0.60% (47th percentile) the modeled 30-day exploitation probability is modest, not elevated. This apparent conflict is best read as timing rather than contradiction - the CVE comes from the October 2025 Oracle Critical Patch Update, so EPSS reflects limited observed exploitation activity to date rather than low exploitability; a trivially exploitable unauthenticated RCE-class flaw in internet-facing ERP typically sees EPSS rise once exploit tooling circulates. There is no CISA KEV listing and no public POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - this is NOT a known in-the-wild case. No SSVC decision data was provided. Net: treat as a genuine high priority for any internet-exposed Oracle E-Business Suite deployment despite the currently low EPSS, which should be re-checked as the signal matures.

An attacker locates an internet-facing Oracle E-Business Suite instance exposing the Oracle Marketing / Marketing Administration component and sends crafted HTTP requests to a function that fails to enforce authentication (CWE-306). Because no credentials or user interaction are required (PR:N/UI:N) and complexity is low, the attacker bypasses access control and achieves full compromise ('takeover') of Oracle Marketing. No public proof-of-concept is identified at the time of analysis.