Oracle Vulnerabilities and Affected Products
Vulnerabilities associated with E-Business Suite.
Products
Clear product- Advanced Outbound Telephony38 vulnerabilities
- Marketing23 vulnerabilities
- Java SE21 vulnerabilities
- WebLogic Server21 vulnerabilities
- One-to-One Fulfillment19 vulnerabilities
- weblogic_server19 vulnerabilities
- MySQL Server17 vulnerabilities
- communications_diameter_signaling_router13 vulnerabilities
- enterprise_manager_base_platform13 vulnerabilities
- FLEXCUBE Universal Banking13 vulnerabilities
- agile_plm12 vulnerabilities
- autovue_for_agile_product_lifecycle_management12 vulnerabilities
- banking_digital_experience12 vulnerabilities
- communications_calendar_server12 vulnerabilities
- communications_element_manager12 vulnerabilities
- communications_evolved_communications_application_server12 vulnerabilities
- communications_instant_messaging_server12 vulnerabilities
- communications_network_charging_and_control12 vulnerabilities
- communications_session_route_manager12 vulnerabilities
- financial_services_analytical_applications_infrastructure12 vulnerabilities
- financial_services_institutional_performance_analytics12 vulnerabilities
- financial_services_price_creation_and_discovery12 vulnerabilities
- financial_services_retail_customer_analytics12 vulnerabilities
- global_lifecycle_management_opatch12 vulnerabilities
- insurance_policy_administration_j2ee12 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-46817CRITICAL | Oracle E-Business Suite Improper Privilege Management VulnerabilityVulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C… | CVSS9.8v3.1 | EPSS13.3% | PoCs2 | SignalsListed in CISA KEVKnown ransomware useNo Nuclei templates | STIX |
CVE-2025-61884HIGH | Oracle E-Business Suite Server-Side Request Forgery (SSRF) VulnerabilityVulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVS… | CVSS7.5v3.1 | EPSS97.8% | PoCs4 | SignalsListed in CISA KEVKnown ransomware use1 Nuclei template | STIX |
CVE-2025-61882CRITICAL | Oracle E-Business Suite Unspecified VulnerabilityVulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CV… | CVSS9.8v3.1 | EPSS99.7% | PoCs14 | SignalsListed in CISA KEVKnown ransomware use1 Nuclei template | STIX |
CVE-2022-21587CRITICAL | Oracle E-Business Suite Unspecified VulnerabilityVulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Avai… | CVSS9.8v3.1 | EPSS98.3% | PoCs5 | SignalsListed in CISA KEVKnown ransomware use1 Nuclei template | STIX |
CVE-2022-21500HIGH | Oracle E-Business Suite Manage Proxies Information DisclosureVulnerability in Oracle E-Business Suite (component: Manage Proxies). The supported version that is affected is 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle E-Business Suite accessible data. Note: Authentication is required for successful attack, however the user may be self-regis… May 19, 20221 related artifact | CVSS7.5v3.1 | EPSS71.7% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
Oracle E-Business Suite Application Mgmt Pack for E-Business Suite VulnerabilityUnspecified vulnerability in the Application Mgmt Pack for E-Business Suite component in Oracle E-Business Suite 12.1 and 12.2 allows remote attackers to affect confidentiality via vectors related to REST Framework, a different vulnerability than CVE-2016-0456. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to read arbitrary files, cause a den… Jan 21, 2016 | CVSS5.0v2.0 | EPSS3.92% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |