CVE-2025-30726: Oracle E-Business Suite Info Disclosure

CVE-2025-30726 Overview

CVE-2025-30726 affects the Oracle Application Object Library (AOL) component of Oracle E-Business Suite. The flaw allows an unauthenticated remote attacker to access a subset of AOL data through HTTP requests. Supported versions 12.2.3 through 12.2.14 are affected.

The vulnerability is classified under [CWE-284] (Improper Access Control) and results in confidentiality impact only. No authentication or user interaction is required to exploit the issue, and the attack complexity is low.

Critical Impact
Unauthenticated network-based attackers can obtain unauthorized read access to a subset of Oracle Application Object Library data via HTTP.

Affected Products

Oracle E-Business Suite 12.2.3
Oracle E-Business Suite versions 12.2.4 through 12.2.13
Oracle E-Business Suite 12.2.14

Discovery Timeline

2025-04-15 - Oracle published the vulnerability as part of the April 2025 Critical Patch Update
2025-04-15 - CVE-2025-30726 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30726

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle Application Object Library, a foundational framework that provides shared services across Oracle E-Business Suite modules. AOL manages user profiles, concurrent processing, flexfields, and application security functions.

An unauthenticated attacker with network access via HTTP can query the affected component and retrieve data that should be restricted. The disclosed data is limited to a subset of AOL-accessible information, which explains the confidentiality-only impact profile.

Because AOL is the shared foundation of the E-Business Suite, exposed data can include configuration and application metadata that supports further reconnaissance against the platform. The EPSS score is 0.309% (percentile 22.993), indicating limited observed exploitation interest at present.

Root Cause

The root cause is improper access control [CWE-284] within the Core module of Oracle Application Object Library. HTTP-reachable endpoints do not enforce authentication or authorization checks on specific data-retrieval paths.

Oracle has not published the exact code-level details of the flaw. Refer to the Oracle Security Alert April 2025 for vendor-provided context.

Attack Vector

Exploitation requires only HTTP network access to the Oracle E-Business Suite front end. The attacker sends crafted HTTP requests to the exposed AOL endpoint without needing credentials or user interaction.

No verified proof-of-concept exploit is publicly available at the time of writing. The vulnerability describes read-only disclosure and does not permit modification or denial of service on its own.

Detection Methods for CVE-2025-30726

Indicators of Compromise

Unauthenticated HTTP requests to Oracle E-Business Suite AOL endpoints originating from external IP addresses.
Anomalous request volumes against /OA_HTML/ and related AOL URIs without preceding authentication events.
HTTP 200 responses returned to unauthenticated sessions targeting AOL data-retrieval paths.

Detection Strategies

Review Oracle HTTP Server (OHS) and application-tier access logs for unauthenticated requests reaching AOL Core endpoints.
Correlate web-tier logs with database audit logs to identify data reads that lack a corresponding authenticated session.
Deploy web application firewall (WAF) rules that flag requests to AOL paths without a valid session cookie or authentication header.

Monitoring Recommendations

Enable verbose logging on the Oracle E-Business Suite application tier and forward logs to a centralized analytics platform.
Baseline normal request patterns for AOL endpoints and alert on statistical deviations in source IP diversity and request frequency.
Monitor egress traffic from the E-Business Suite host for unexpected data volumes indicative of bulk enumeration.

How to Mitigate CVE-2025-30726

Immediate Actions Required

Apply the Oracle Critical Patch Update from April 2025 to all Oracle E-Business Suite deployments running versions 12.2.3 through 12.2.14.
Restrict external HTTP access to the E-Business Suite application tier where business requirements allow.
Audit application and database logs for prior unauthenticated access to AOL endpoints.

Patch Information

Oracle addressed CVE-2025-30726 in the April 2025 Critical Patch Update. Administrators should follow the guidance in the Oracle Security Alert April 2025 and apply patches to all affected versions in the 12.2.3–12.2.14 range.

Workarounds

Place the Oracle E-Business Suite front end behind a reverse proxy or WAF that enforces authentication before requests reach AOL endpoints.
Use network segmentation and IP allow-listing to limit HTTP reachability to trusted networks until patches are deployed.
Disable or block internet-facing exposure of non-essential E-Business Suite modules pending remediation.

bash

# Example: restrict inbound HTTP access to the E-Business Suite app tier
# using iptables to allow only trusted subnets
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP