Two Critical Oracle Marketing Flaws (CVE-2025-53072, CVE-2025-62481) — Patch Immediately or Risk Full Takeover

According to Oracle, it released its October 2025 Critical Patch Update (CPU), which fixes 374 vulnerabilities and urgently addresses two flaws that could allow unauthenticated attackers to completely compromise and take over the Oracle Marketing application within the E-Business Suite. The affected product, Oracle Marketing, is part of the broader Oracle E-Business Suite (EBS).

The two vulnerabilities, CVE-2025-53072 and CVE-2025-62481, are rated 9.8 (Critical) on the CVSS scale and stem from unauthenticated access to the Marketing Administration component, potentially granting high‑level access to data and functionality across the marketing arm of an organisation. The article notes that these flaws were patched as part of the October 2025 CPU, which is a substantial quarterly update containing over 230 fixes for vulnerabilities that are remotely exploitable without authentication.

Organisations running the affected Oracle Marketing versions 12.2.3-12.2.14 are urged to apply the update promptly to mitigate the risk of a full system takeover.