CVE-2025-61753: Oracle Scripting Auth Bypass Vulnerability

CVE-2025-61753 Overview

CVE-2025-61753 is a vulnerability in the Oracle Scripting component of Oracle E-Business Suite. The flaw affects supported versions 12.2.3 through 12.2.14 and can be exploited by an unauthenticated attacker with network access via HTTP. Successful exploitation requires user interaction from a victim other than the attacker.

The vulnerability is classified under [CWE-601] (URL Redirection to Untrusted Site, also known as Open Redirect). Because the scope changes on exploitation, attacks originating in Oracle Scripting can impact additional Oracle E-Business Suite components. Attackers can achieve unauthorized read access to a subset of data and unauthorized update, insert, or delete access to some Oracle Scripting data.

Critical Impact
Unauthenticated network-based exploitation that leads to cross-scope impact on additional Oracle E-Business Suite products, with confidentiality and integrity effects on Oracle Scripting data.

Affected Products

Oracle E-Business Suite - Oracle Scripting 12.2.3
Oracle E-Business Suite - Oracle Scripting versions 12.2.4 through 12.2.13
Oracle E-Business Suite - Oracle Scripting 12.2.14

Discovery Timeline

2025-10-21 - CVE-2025-61753 published to NVD as part of the Oracle Critical Patch Update (October 2025)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61753

Vulnerability Analysis

CVE-2025-61753 resides in the Miscellaneous component of Oracle Scripting within Oracle E-Business Suite. The vulnerability is exploitable over HTTP without authentication, but requires a victim to interact with attacker-supplied content, typically by clicking a crafted URL. The scope changes when exploited, meaning impact extends beyond the vulnerable component into additional Oracle E-Business Suite products.

Successful exploitation yields limited confidentiality and integrity impact. Attackers can read a subset of accessible Oracle Scripting data and perform unauthorized update, insert, or delete operations on some Scripting data. Availability is not impacted. The EPSS probability at the time of writing is 0.213%.

Root Cause

The underlying weakness maps to [CWE-601], URL Redirection to Untrusted Site. Oracle Scripting accepts a URL or navigation parameter without sufficient validation against an allowlist of trusted destinations. The application then forwards or redirects the authenticated user to the attacker-controlled destination.

Attack Vector

An attacker crafts a malicious URL that references a vulnerable Oracle Scripting endpoint and encodes an attacker-controlled destination in a redirect parameter. The attacker delivers the URL through phishing, chat, or a compromised web page. When a legitimate user clicks the link, Oracle Scripting redirects the browser to the untrusted destination.

Because the initial request originates from the trusted Oracle E-Business Suite host, the redirect can be used to harvest credentials, deliver malware, or chain into cross-scope actions against related Oracle E-Business Suite modules. No verified public exploit code is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-61753

Indicators of Compromise

HTTP requests to Oracle Scripting endpoints containing URL or redirect parameters that reference external, non-Oracle hosts.
Web proxy or web application firewall logs showing outbound redirects from Oracle E-Business Suite hosts to newly registered or uncategorized external domains.
Increased user reports of unexpected redirects originating from Oracle E-Business Suite login flows or Scripting-related workflows.

Detection Strategies

Inspect Oracle E-Business Suite HTTP access logs for query strings containing fully qualified external URLs in redirect-related parameters.
Correlate email gateway telemetry with web proxy logs to identify inbound phishing links pointing to internal Oracle Scripting URLs.
Deploy signatures on web application firewalls to flag Oracle Scripting requests where redirect parameters do not match approved internal hostnames.

Monitoring Recommendations

Enable verbose HTTP logging on Oracle HTTP Server tiers fronting Oracle E-Business Suite and forward logs to a centralized SIEM.
Baseline typical Scripting URL patterns and alert on deviations, particularly parameters carrying http:// or https:// values.
Monitor authenticated Oracle E-Business Suite sessions that generate redirects to external domains within a short window of user login.

How to Mitigate CVE-2025-61753

Immediate Actions Required

Apply the fix included in the Oracle Critical Patch Update - October 2025 to all Oracle E-Business Suite environments running Oracle Scripting 12.2.3 through 12.2.14.
Inventory all Oracle E-Business Suite instances and confirm patch level, prioritizing internet-exposed deployments.
Brief users on phishing risk that leverages trusted Oracle E-Business Suite URLs and reinforce link-verification practices.

Patch Information

Oracle addressed CVE-2025-61753 in the October 2025 Critical Patch Update. Administrators should review the Oracle Critical Patch Update Advisory for the specific patch identifiers, prerequisites, and application instructions covering Oracle E-Business Suite versions 12.2.3 through 12.2.14.

Workarounds

Restrict network access to Oracle E-Business Suite Scripting endpoints using perimeter controls, VPN, or IP allowlisting until patches are applied.
Configure a web application firewall rule to block Oracle Scripting requests where redirect parameters contain external hostnames.
Enable warning banners or interstitial redirect confirmation pages on the reverse proxy fronting Oracle E-Business Suite.

bash

# Example WAF rule concept: block Oracle Scripting requests with external redirect targets
# ModSecurity example - adapt paths and hostnames to your environment
SecRule REQUEST_URI "@beginsWith /OA_HTML/" \
    "chain,phase:2,deny,status:403,id:1006175,\
     msg:'CVE-2025-61753 - Oracle Scripting open redirect attempt'"
    SecRule ARGS "@rx ^https?://(?!(.*\.example\.com))" \
        "t:none,t:urlDecodeUni,t:lowercase"