CVE-2025-53064: Oracle Applications Framework Auth Bypass

CVE-2025-53064 Overview

CVE-2025-53064 is an access control vulnerability in the Personalization component of Oracle Applications Framework, part of Oracle E-Business Suite. The flaw affects supported versions 12.2.3 through 12.2.14. A low-privileged attacker with network access over HTTP can exploit this weakness without user interaction. Successful exploitation allows unauthorized update, insert, or delete operations against a subset of data accessible to Oracle Applications Framework. Oracle addressed the issue in the October 2025 Critical Patch Update. The CWE classification is [CWE-284] Improper Access Control.

Critical Impact
Authenticated attackers can modify, insert, or delete data within Oracle Applications Framework over HTTP without elevated privileges.

Affected Products

Oracle E-Business Suite — Oracle Applications Framework 12.2.3
Oracle E-Business Suite — Oracle Applications Framework versions 12.2.4 through 12.2.13
Oracle E-Business Suite — Oracle Applications Framework 12.2.14

Discovery Timeline

2025-10-21 - CVE-2025-53064 published to the National Vulnerability Database
2025-10-21 - Oracle publishes the October 2025 Critical Patch Update advisory
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53064

Vulnerability Analysis

The vulnerability resides in the Personalization component of Oracle Applications Framework (OAF), the UI and metadata layer that renders Oracle E-Business Suite pages. Personalization allows administrators and users to alter page layout, fields, and behavior at runtime. Insufficient access control in this component permits a low-privileged authenticated user to perform integrity-affecting operations they should not be able to execute. The scope is unchanged, meaning the impact is confined to the vulnerable component, and confidentiality and availability are not affected. Only integrity is impacted, limited to a subset of OAF-accessible data.

Root Cause

The root cause is improper access control ([CWE-284]) in the handling of Personalization requests. Authorization checks do not adequately restrict which authenticated users may issue update, insert, or delete operations against Personalization-managed data. Because the checks are missing or incomplete, session context alone is sufficient to reach protected operations.

Attack Vector

Exploitation requires network reachability to the E-Business Suite HTTP endpoints and a valid low-privileged account. No user interaction is needed. An attacker crafts HTTP requests against the Personalization interface to trigger write operations on OAF data. Oracle rates the attack complexity as low and the vulnerability as easily exploitable. No public proof-of-concept or in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is approximately 0.22%.

No verified proof-of-concept code is publicly available. Refer to the Oracle Critical Patch Update - October 2025 for vendor-provided technical details.

Detection Methods for CVE-2025-53064

Indicators of Compromise

Unexpected creation, modification, or deletion of Personalization records (FND_LOBS, JDR_* metadata tables) attributable to low-privileged accounts.
HTTP requests to OAF Personalization endpoints (URIs containing OA.jsp with Personalization-related parameters) from user sessions that lack an administrative role.
Audit trail entries in FND_LOG_MESSAGES showing Personalization changes outside approved change windows.

Detection Strategies

Correlate application audit logs with the authenticated user's assigned responsibilities to flag Personalization writes by non-privileged users.
Baseline normal Personalization activity per role and alert on deviations, including high-volume metadata writes from a single session.
Ingest E-Business Suite web tier and database audit logs into a SIEM for behavioral correlation across HTTP requests and backing table modifications.

Monitoring Recommendations

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking to capture Personalization interactions.
Monitor database changes to JDR_COMPONENTS, JDR_ATTRIBUTES, and related Personalization repository tables.
Alert on HTTP 200 responses to Personalization write endpoints originating from IPs or accounts not associated with functional administrators.

How to Mitigate CVE-2025-53064

Immediate Actions Required

Apply the October 2025 Critical Patch Update for Oracle E-Business Suite 12.2 as documented in the Oracle advisory.
Inventory all E-Business Suite environments running Oracle Applications Framework versions 12.2.3 through 12.2.14 and prioritize internet-exposed instances.
Review recent Personalization changes for unauthorized modifications introduced before patching.

Patch Information

Oracle released fixes for CVE-2025-53064 in the Oracle Critical Patch Update - October 2025. Administrators should follow the E-Business Suite patch readme, apply prerequisite technology stack patches, and run AutoConfig plus any post-install steps required for OAF metadata updates.

Workarounds

Restrict network access to E-Business Suite HTTP endpoints using a reverse proxy or web application firewall until patches are deployed.
Limit responsibilities and menus that expose Personalization functionality to only trusted administrative roles.
Disable end-user Personalization by setting the FND: Personalization Region Link Enabled profile option to No where operationally acceptable.

bash

# Example: query the current Personalization profile setting via SQL*Plus
sqlplus apps/<password> <<EOF
SELECT profile_option_name, profile_option_value
  FROM fnd_profile_option_values v
  JOIN fnd_profile_options o
    ON o.profile_option_id = v.profile_option_id
 WHERE profile_option_name = 'FND_PERSONALIZATION_REGION_LINK_ENABLED';
EOF