CVE-2025-50066: oracle corporation oracle database server Improper Privilege Management

Vulnerability summary

CVE-2025-50066 is a low (CVSS 2.7) Improper Privilege Management vulnerability in oracle corporation oracle database server. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.3% of scored vulnerabilities.

Timeline

1. 15-07-2025
   PublishedVulnerability first disclosed.
2. 16-07-2025
   Last modifiedVulnerability information updated.

Description

Vulnerability in the Oracle Database Materialized View component of Oracle Database Server. Supported versions that are affected are 19.3-19.27, 21.3-21.18 and 23.4-23.8. Easily exploitable vulnerability allows high privileged attacker having Execute on DBMS_REDEFINITION privilege with network access via Oracle Net to compromise Oracle Database Materialized View. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Database Materialized View accessible data. CVSS 3.1 Base Score 2.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N).

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.