Oracle E-Business Suite vulnerabilities

CVE-2022-21587 [CRITICAL] CWE-306 CVE-2022-21587: Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite ( Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks o

CVE-2026-46817 [CRITICAL] CWE-269 CVE-2026-46817: Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmissio Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover

CVE-2021-45105 [MEDIUM] CWE-20 CVE-2021-45105: Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from u Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

CVE-2022-21500 [HIGH] CVE-2022-21500: Vulnerability in Oracle E-Business Suite (component: Manage Proxies). The supported version that is Vulnerability in Oracle E-Business Suite (component: Manage Proxies). The supported version that is affected is 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access

CVE-2016-0457 [MEDIUM] CVE-2016-0457: Unspecified vulnerability in the Application Mgmt Pack for E-Business Suite component in Oracle E-Bu Unspecified vulnerability in the Application Mgmt Pack for E-Business Suite component in Oracle E-Business Suite 12.1 and 12.2 allows remote attackers to affect confidentiality via vectors related to REST Framework, a different vulnerability than CVE-2016-0456. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-part

CVE-2004-1364 [HIGH] CWE-22 CVE-2004-1364: Directory traversal vulnerability in extproc in Oracle 9i and 10g allows remote attackers to access Directory traversal vulnerability in extproc in Oracle 9i and 10g allows remote attackers to access arbitrary libraries outside of the $ORACLE_HOME\bin directory.

CVE-2026-46819 [CRITICAL] CWE-284 CVE-2026-46819: Vulnerability in the Oracle Internet Procurement Connector product of Oracle E-Business Suite (compo Vulnerability in the Oracle Internet Procurement Connector product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Internet Procurement Connector. Successful attack

CVE-2025-30727 [CRITICAL] CWE-306 CVE-2025-30727: Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: iSurvey Module) Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: iSurvey Module). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in takeover

CVE-2018-2656 [CRITICAL] CVE-2018-2656: Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Data Vulnerability in the Oracle General Ledger component of Oracle E-Business Suite (subcomponent: Data Manager Server). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle General Ledger. Succ

CVE-2019-2489 [CRITICAL] CVE-2019-2489: Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponen Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite (subcomponent: OCM Query). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment. Succe

CVE-2019-2453 [CRITICAL] CVE-2019-2453: Vulnerability in the Oracle Performance Management component of Oracle E-Business Suite (subcomponen Vulnerability in the Oracle Performance Management component of Oracle E-Business Suite (subcomponent: Performance Management Plan). Supported versions that are affected are 12.1.1, 12.1.2 and 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Performance Management. Successful attacks

CVE-2013-0397 [MEDIUM] CVE-2013-0397: Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Diagnostics.

CVE-2026-60924 [HIGH] CWE-269 CVE-2026-60924: Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Int Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Payroll. Successful attacks of this vulnerability

CVE-2026-83479 [HIGH] CWE-269 CVE-2026-83479: Vulnerability in the Oracle Contracts product of Oracle E-Business Suite (component: Internal Operat Vulnerability in the Oracle Contracts product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.14-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contracts. Successful attacks of this vulnerability can result in takeover

CVE-2026-61319 [HIGH] CWE-284 CVE-2026-61319: Vulnerability in the Oracle U.S. Federal Financials product of Oracle E-Business Suite (component: I Vulnerability in the Oracle U.S. Federal Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle U.S. Federal Financials. Successful attacks of this vulnerabi

CVE-2026-60678 [HIGH] CWE-269 CVE-2026-60678: Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal O Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle General Ledger. Successful attacks of this vulnerability can result in

CVE-2026-60932 [HIGH] CWE-269 CVE-2026-60932: Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: Intern Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Labor Distribution. Successful attacks of this vulnerability can r

CVE-2026-60952 [HIGH] CWE-269 CVE-2026-60952: Vulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: Vulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Execution. Successful attacks of this vulnerab

CVE-2026-61320 [HIGH] CWE-269 CVE-2026-61320: Vulnerability in the Oracle Payables product of Oracle E-Business Suite (component: Internal Operati Vulnerability in the Oracle Payables product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.8-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payables. Successful attacks of this vulnerability can result in takeover of

CVE-2026-46837 [HIGH] CWE-269 CVE-2026-46837: Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Securi Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Security). Supported versions that are affected are 12.2.9-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Flow Manufacturing. Successful attacks of this vulnerability can result in tak