Oracle Security Patch Update – 16 April 2025

By /
  • 84/2025
  • Critical

Oracle released its critical patch updates for April 2025, containing (378) new security patches for multiple affected products in Oracle code and third-party components.

The addressed vulnerabilities could allow the attacker to perform various attacks such as obtaining sensitive information, conducting denial of service attacks, performing data manipulation (update, insert, or delete access), or executing arbitrary commands and gaining access to the affected product.

Sample of the addressed vulnerabilities:

1. Oracle Scripting Product of Oracle E-Business Suite Takeover Vulnerability (CVE-2025-30727):

  • CVSS: 9.8
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Consequences: Gain Access

2. Oracle iStore Product of Oracle E-Business Suite Information Disclosure Vulnerability (CVE-2025-30707):

  • CVSS: 7.5
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Consequences: Obtain Information

Sample of The Affected Products:

  • Oracle Database Server.
  • Oracle Application Express.
  • Oracle Communications.
  • Oracle Enterprise Manager.
  • Oracle MySQL.

The complete list of the affected products: Oracle Advisory – April 2025

Vulnerabilities

Oracle Map of CVE to Advisory/Alert

Mitigations

The enterprise should deploy this patch as soon as the testing phase is completed. 

Oracle Advisory – April 2025

References