Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue.

Maximum severity flaw (CVSS 10.0) disclosed. Exploitation requires an attacker to trick a vulnerable system into reading a specially crafted file. Monitoring for PoC exploits.

The version of Oracle Business Intelligence Enterprise Edition (OAS) 7.6.0.0 and 8.2.0.0 installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2025 CPU advisory.

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Analytics Server (Apache Parquet Java)). Supported versions that are affected are 7.6.0.0.0     and 8.2.0.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via     HTTP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle     Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope     change). Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence     Enterprise Edition. (CVE-2025-30065)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Platform Security). Supported versions that are affected are 7.6.0.0.0, 8.2.0.0.0 and     12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction     from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence     Enterprise Edition, attacks may significantly impact additional products (scope change). Successful     attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle     Business Intelligence Enterprise Edition accessible data as well as unauthorized read access to a subset     of Oracle Business Intelligence Enterprise Edition accessible data. (CVE-2025-30759)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics     (component: Core (Apache Commons BeanUtils)). Supported versions that are affected are 7.6.0.0.0 and     8.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP     to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability     can result in takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2025-48734)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by multiple vulnerabilities:

  - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate     (component: Java Delivery (Netty)). Supported versions that are affected are 23.4-23.7. Difficult to     exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle     GoldenGate Big Data and Application Adapters. Successful attacks of this vulnerability can result in     unauthorized ability to cause a partial denial of service (partial DOS) of Oracle GoldenGate Big Data     and Application Adapters. (CVE-2025-24970)

  - Vulnerability in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Stream     Analytics (Netty)). Difficult to exploit vulnerability allows low privileged attacker with access to     the physical communication segment attached to the hardware where the Oracle GoldenGate Stream Analytics     executes to compromise Oracle GoldenGate Stream Analytics. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle     GoldenGate Stream Analytics. (CVE-2025-25193)

  - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate     (component: Java Delivery (Apache HttpClient)). Supported versions that are affected are 23.4-23.6. Easily     exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise     Oracle GoldenGate Big Data and Application Adapters. Successful attacks of this vulnerability can result     in unauthorized creation, deletion or modification access to critical data or all Oracle GoldenGate Big     Data and Application Adapters accessible data. (CVE-2025-27820)

  - Security-in-Depth issue in the Oracle GoldenGate Big Data and Application Adapters product of Oracle     GoldenGate (component: GoldenGate Big Data and Application Adapters (Apache Parquet Java)). This     vulnerability cannot be exploited in the context of this product. (CVE-2025-30065)

  - Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors     to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default     setting of trusted packages still allows malicious classes from these packages to be executed. The     exploit is only applicable if the client code of parquet-avro uses the 'specific' or the 'reflect'     models deliberately for reading Parquet files. ('generic' model is not impacted). (CVE-2025-46762)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by multiple vulnerabilities:

  - Security-in-Depth issue in the Oracle GoldenGate Big Data and Application Adapters product of Oracle     GoldenGate (component: GoldenGate Big Data and Application Adapters (Apache Parquet Java)). This     vulnerability cannot be exploited in the context of this product. (CVE-2025-30065)

  - Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors     to execute arbitrary code. While 1.15.1 introduced a fix to restrict untrusted packages, the default     setting of trusted packages still allows malicious classes from these packages to be executed. The     exploit is only applicable if the client code of parquet-avro uses the 'specific' or the 'reflect'     models deliberately for reading Parquet files. ('generic' model is not impacted). (CVE-2025-46762)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Parquet on the remote host is prior to 1.15.1. It is, therefore, affected by a remote code execution vulnerability:

  - Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to     execute arbitrary code Users are recommended to upgrade to version 1.15.1, which fixes the issue. (CVE-2025-30065)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
242982	Oracle Business Intelligence Enterprise Edition (OAS) (July 2025 CPU)	Nessus	Misc.	critical
242270	Oracle GoldenGate for Big Data Multiple Vulnerabilities 23.x < 23.9.0.25.07 (July 2025 CPU)	Nessus	Misc.	critical
242269	Oracle GoldenGate for Big Data Multiple Vulnerabilities 21.x < 21.19.0.0.0 (July 2025 CPU)	Nessus	Misc.	critical
234234	Apache Parquet < 1.15.1 Remote Code Execution (CVE-2025-30065)	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-30065

critical

Tenable Plugins

critical

critical

critical

critical