Critical Patch Update Announcement in April for All Oracle Products

Overview

On April 16, 2025, NSFOCUS CERT detected that Oracle officially released the Critical Patch Update (CPU) for April. A total of 390 vulnerabilities with different degrees were fixed this time. This security update involves Oracle MySQL Connectors, Oracle MySQL Server, Oracle Java SE, Oracle Fusion Middleware, Oracle Financial Services Applications, Oracle Communications Applications and many other commonly used products. Oracle strongly recommends that customers apply critical patch update fixes to fix vulnerabilities as soon as possible.

Reference link: https://www.oracle.com/security-alerts/cpuapr2025.html

Key Vulnerabilities

Oracle MySQL Connectors Memory Corruption Vulnerability (CVE-2025-30706):

A memory corruption vulnerability exists in Oracle MySQL Connectors. An attacker with ordinary user rights can take over MySQL Connectors by gaining network access through multiple protocols. The CVSS score is 7.5.

Oracle VM VirtualBox Authentication Bypass Vulnerability (CVE-2025-30712):

An authentication bypass vulnerability exists in Oracle VM VirtualBox. An unauthenticated attacker can log into the infrastructure of Oracle VM VirtualBox, thereby adding, deleting, modifying and checking all data accessible to Oracle VM VirtualBox and causing a partial denial of service. The CVSS score is 8.1.

Oracle Common Applications Authentication Bypass Vulnerability (CVE-2025-30716):

An authentication bypass vulnerability exists in Oracle Common Applications. An unauthenticated attacker can bypass Oracle Common Applications authentication by constructing an HTTP request to query all data accessible to Oracle Common Applications. The CVSS score is 7.5.

Oracle’s official April critical patch update vulnerability summary is as follows:

Mitigation

Patch update

Please refer to the appendix “Affected Products and Patch Information” of this article to download the affected product update patch in time, and refer to the readme file in the patch installation package for installation and update to ensure long-term effective protection.

Note: Oracle official patches require users to hold a license account for genuine software. After logging into https://support.oracle.com with this account, you can download the latest patches.

WebLogic temporary protection measures

1. Restrict T3 protocol access

If the relevant users are temporarily unable to install patches or do not communicate with JVM through the T3 protocol, the following measures can be used to block attacks that exploit T3 protocol vulnerabilities:

WebLogic Server provides a default connection filter named weblogic.security.net.ConnectionFilterImpl, which accepts all incoming connections and can be used to configure rules for access control of T3 and T3s protocols. The detailed steps are as follows:

1. Enter the WebLogic console, in the configuration page of base_domain, enter the “Security” tab page, click “Filter”, and enter the connection filter configuration.
2. Enter: weblogic.security.net.ConnectionFilterImpl in the connection filter, refer to the following writing method, and configure rules that meet the actual situation of the enterprise in the connection filter rules:

3. If the rule does not take effect after saving, it is recommended to restart the WebLogic service (restarting the WebLogic service will cause business interruption. It is recommended that relevant personnel assess the risk before operating). Taking the Windows environment as an example, the steps to restart the service are as follows:

Enter the bin directory under the domain directory, run the stopWebLogic.cmd file in the Windows system to terminate the weblogic service, and run the stopWebLogic.sh file in the Linux system.

4. After the termination script is executed, run the startWebLogic.cmd or startWebLogic.sh file to start WebLogic to complete the restart of the WebLogic service. Reference link: https://docs.oracle.com/cd/E24329_01/web.1211/e24485/con_filtr.htm#SCPRG377

2. Disable IIOP protocol

Users can block attacks that exploit IIOP protocol vulnerabilities by disabling the IIOP protocol. The operations are as follows:

In the WebLogic console, select “Service” -> “AdminServer” -> “Protocol”, and uncheck “Enable IIOP”. And restart the WebLogic project to make the configuration effective.

Appendix: Affected Products and Patch Information

Statement

This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.

About NSFOCUS

NSFOCUS, a pioneering leader in cybersecurity, is dedicated to safeguarding telecommunications, Internet service providers, hosting providers, and enterprises from sophisticated cyberattacks.

Founded in 2000, NSFOCUS operates globally with over 4000 employees at two headquarters in Beijing, China, and Santa Clara, CA, USA, and over 50 offices worldwide. It has a proven track record of protecting over 25% of the Fortune Global 500 companies, including four of the five largest banks and six of the world’s top ten telecommunications companies.

Leveraging technical prowess and innovation, NSFOCUS delivers a comprehensive suite of security solutions, including the Intelligent Security Operations Platform (ISOP) for modern SOC, DDoS Protection, Continuous Threat Exposure Management (CTEM) Service and Web Application and API Protection (WAAP). All the solutions and services are augmented by the Security Large Language Model (SecLLM), ML, patented algorithms and other cutting-edge research achievements developed by NSFOCUS.