Oracle Corporation Vulnerabilities and Affected Products

Products

MySQL Server1,039 vulnerabilities
VM VirtualBox280 vulnerabilities
WebLogic Server190 vulnerabilities
PeopleSoft Enterprise PT PeopleTools187 vulnerabilities
Java179 vulnerabilities
Solaris Operating System136 vulnerabilities
MySQL Cluster133 vulnerabilities
Outside In Technology128 vulnerabilities
Oracle Coherence105 vulnerabilities
Java SE JDK and JRE102 vulnerabilities
Oracle VM VirtualBox98 vulnerabilities
JD Edwards EnterpriseOne Tools71 vulnerabilities
Oracle WebCenter Content71 vulnerabilities
Database - Enterprise Edition64 vulnerabilities
BI Publisher (formerly XML Publisher)60 vulnerabilities
FLEXCUBE Universal Banking57 vulnerabilities
Enterprise Manager Base Platform53 vulnerabilities
Oracle Database51 vulnerabilities
Oracle Java SE51 vulnerabilities
Business Intelligence Enterprise Edition47 vulnerabilities
Marketing47 vulnerabilities
CRM Technical Foundation40 vulnerabilities
Oracle WebLogic Server40 vulnerabilities
Oracle Enterprise Manager Base Platform38 vulnerabilities
Sun ZFS Storage Appliance Kit (AK) Software38 vulnerabilities

Oracle Corporation vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-47006HIGH	Generated title:Oracle Enterprise Manager Base Platform Self Update Framework Improper Access Control Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Update Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.2 (Confidentiality, Integri… CWE-284Jul 21, 2026	CVSS7.2v3.1	EPSS0.339%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-47005HIGH	Generated title:Oracle Enterprise Manager Base Platform Self Update Framework Improper Access Control Vulnerability Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Update Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.2 (Confidentiality, Integri… CWE-284Jul 21, 2026	CVSS7.2v3.1	EPSS0.339%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-47004HIGH	Generated title:Oracle Enterprise Manager Base Platform Self Update Framework Missing Authentication Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Update Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrit… CWE-306Jul 21, 2026	CVSS8.8v3.1	EPSS0.402%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-47003MEDIUM	Generated title:Oracle Enterprise Manager Base Platform Improper Access Control Vulnerability Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Supported versions that are affected are 13.5 and 24.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Enterprise Manager Base Platform acces… CWE-284Jul 21, 2026	CVSS5.9v3.1	EPSS0.317%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-47002MEDIUM	Generated title:Oracle Enterprise Manager Base Platform UI Framework Open Redirect Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Manager Base Platform, attacks … CWE-601Jul 21, 2026	CVSS6.1v3.1	EPSS0.231%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-47001MEDIUM	Generated title:Oracle Enterprise Manager Base Platform Web Services Framework Improper Access Control Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Web Services Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Manager Base Platform acces… CWE-284Jul 21, 2026	CVSS5.4v3.1	EPSS0.222%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-47000LOW	Generated title:Oracle Enterprise Manager Base Platform Security Framework Cross-Site Request Forgery Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Security Framework). The supported version that is affected is 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert o… CWE-352Jul 21, 2026	CVSS3.5v3.1	EPSS0.127%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-46999HIGH	Generated title:Oracle Enterprise Manager Base Platform Missing Authentication Vulnerability Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Discovery Framework). Supported versions that are affected are 13.5 and 24.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Mana… CWE-306Jul 21, 2026	CVSS7.0v3.1	EPSS0.224%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-46998HIGH	Generated title:Oracle Enterprise Manager Base Platform Metadata Plugin Open Redirect Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Enter… CWE-601Jul 21, 2026	CVSS8.8v3.1	EPSS0.285%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-46997MEDIUM	Generated title:Oracle Enterprise Manager Base Platform Metadata Plugin Missing Authentication Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Manager Bas… CWE-306Jul 21, 2026	CVSS6.5v3.1	EPSS0.217%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-46996HIGH	Generated title:Oracle Enterprise Manager Base Platform Metadata Plugin Improper Access Control Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Enterprise Manager Bas… CWE-284Jul 21, 2026	CVSS7.1v3.1	EPSS0.202%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-46995HIGH	Generated title:Oracle Enterprise Manager Base Platform Metadata Plugin Improper Privilege Management Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and … CWE-269Jul 21, 2026	CVSS8.8v3.1	EPSS0.402%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-46994CRITICAL	Generated title:Oracle Enterprise Manager Base Platform Agent Next Gen Improper Access Control Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and … CWE-284Jul 21, 2026	CVSS9.8v3.1	EPSS0.362%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-46993HIGH	Generated title:Oracle Enterprise Manager Base Platform Agent Next Gen Improper Access Control Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of … CWE-284Jul 21, 2026	CVSS8.2v3.1	EPSS0.27%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-46992HIGH	Generated title:Oracle Enterprise Manager Base Platform Missing Authentication for Critical Function Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, I… CWE-306Jul 21, 2026	CVSS8.8v3.1	EPSS0.402%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-46991MEDIUM	Generated title:Oracle Enterprise Manager Base Platform Improper Access Control Vulnerability Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized update, insert or delete… CWE-284Jul 21, 2026	CVSS4.4v3.1	EPSS0.106%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-46990HIGH	Generated title:Oracle Enterprise Manager Base Platform Improper Access Control Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Config Management). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Manager Base Platform… CWE-284Jul 21, 2026	CVSS7.3v3.1	EPSS0.228%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-46989CRITICAL	Generated title:Oracle Enterprise Manager Base Platform UI Framework Improper Access Control Vulnerability Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: UI Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this… CWE-284Jul 21, 2026	CVSS9.1v3.1	EPSS0.243%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-46988HIGH	Generated title:Oracle Enterprise Manager Base Platform Connector Framework Improper Access Control Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Connector Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity… CWE-284Jul 21, 2026	CVSS7.2v3.1	EPSS0.339%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-46987HIGH	Generated title:Oracle Enterprise Manager Base Platform Improper Access Control Vulnerability Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Service Level Mgmt). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successf… CWE-284Jul 21, 2026	CVSS7.7v3.1	EPSS0.261%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-46986MEDIUM	Generated title:Oracle Enterprise Manager Base Platform Agent Next Gen Information Disclosure Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Ba… CWE-284Jul 21, 2026	CVSS5.3v3.1	EPSS0.306%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-46985MEDIUM	Generated title:Oracle Enterprise Manager Base Platform Agent Next Gen Improper Access Control Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Ba… CWE-284Jul 21, 2026	CVSS5.3v3.1	EPSS0.237%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-46984MEDIUM	Generated title:Oracle Enterprise Manager Base Platform Agent Next Gen Information Disclosure Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Ba… CWE-284Jul 21, 2026	CVSS5.3v3.1	EPSS0.306%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-46875CRITICAL	Generated title:Oracle Enterprise Manager Base Platform Deployment Library Improper Access Control Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Deployment Library). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks … CWE-284Jun 16, 2026	CVSS9.1v3.1	EPSS0.462%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-46872CRITICAL	Generated title:Oracle Enterprise Manager Base Platform Install Component Improper Access Control Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Install). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vul… CWE-284Jun 16, 2026	CVSS9.0v3.1	EPSS0.282%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX