Oracle Security Updates - October 2026

This roundup covers 123 Oracle security vulnerabilities. CVSS base scores range from 7.0 to 10.0. None are reported as actively exploited at the time of release. The issues affect APEX, Agile PLM, Agile Product Lifecycle Management for Process, Application Testing Suite, Autonomous Health Framework, Business Process Management Suite, Communications Billing and Revenue Management, Data Integrator, E-Business Suite, Enterprise Manager for Oracle Database, Essbase, Fusion Middleware, Helidon, Identity Manager Connector, JD Edwards EnterpriseOne Orchestrator, JD Edwards EnterpriseOne Tools, Oracle Access Manager, Oracle Business Intelligence Enterprise Edition, Oracle Business Process Management Suite, Oracle Communications BRM - Elastic Charging Engine, Oracle Data Integrator, Oracle E-Business Suite, Oracle Enterprise Manager Base Platform, Oracle Enterprise Manager for Siebel, Oracle HTTP Server, Oracle Identity Manager, Oracle Identity Manager Connector, Oracle SOA Suite, Outside In Technology, Product Lifecycle Analytics, REST Data Services, SOA Suite, Secure Backup, Siebel CRM, Siebel CRM Cloud Applications, Siebel CRM Deployment, Siebel CRM Development, Solaris, Trusted Answer Search, WebCenter Content, WebCenter Sites, WebLogic Server.

Summary

CVE-2026-101446

CVE-2026-101446 is a critical vulnerability in Oracle Siebel CRM Cloud Applications (specifically the Siebel Cloud Manager component) affecting versions 17.0 through 26.9. The flaw allows a low-privileged, network-adjacent attacker to achieve full system takeover via HTTP requests. Due to the high CVSS score of 9.9 and the potential for scope change, this vulnerability poses a severe risk of compromising the confidentiality, integrity, and availability of the application.

Affected products:

• Siebel CRM Cloud Applications (17.0-26.9)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101446

Related in this roundup: CVE-2026-101438.

CVE-2026-101484

CVE-2026-101484 is a critical vulnerability in Oracle Secure Backup's Backup and Restore component affecting versions 19.1.0.0.0 and 19.1.0.1.0. An unauthenticated attacker with network access via TCP can exploit this flaw to achieve full system takeover, resulting in a CVSS score of 9.8.

Affected products:

• Secure Backup (19.1.0.0.0, 19.1.0.1.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101484

Related in this roundup: CVE-2026-101479, CVE-2026-101481, CVE-2026-101482.

CVE-2026-101499

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability allowing unauthenticated remote attackers to achieve full system takeover via HTTP requests. The vulnerability is highly exploitable with low attack complexity, requiring no user interaction and having high impact on confidentiality, integrity, and availability.

Affected products:

• WebCenter Sites (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101499

CVE-2026-101501

CVE-2026-101501 is a critical vulnerability in the PLSQL package of Oracle Trusted Answer Search version 26.1. A low-privileged attacker with network access via Oracle Net can exploit this vulnerability to achieve unauthorized read, write, and deletion of data, as well as cause a denial-of-service (hang or crash). The vulnerability involves a scope change, meaning it can impact other products in the environment.

Affected products:

• Trusted Answer Search (26.1)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101501

Related in this roundup: CVE-2026-101503, CVE-2026-101498, CVE-2026-101504, CVE-2026-101505, CVE-2026-101506.

CVE-2026-101503

CVE-2026-101503 is a critical, easily exploitable vulnerability in the PLSQL package of Oracle Trusted Answer Search version 26.1. A low-privileged attacker with network access via Oracle Net can compromise the application, potentially resulting in full system takeover and impacting the confidentiality, integrity, and availability of the target environment. The vulnerability includes a scope change, meaning exploitation can affect additional products beyond the primary target.

Affected products:

• Trusted Answer Search (26.1)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101503

Related in this roundup: CVE-2026-101501, CVE-2026-101498, CVE-2026-101504, CVE-2026-101505, CVE-2026-101506.

CVE-2026-101521

Oracle APEX is vulnerable to an unauthenticated, remotely exploitable issue that allows a network-based attacker to fully compromise the application. The vulnerability has a CVSS 3.1 base score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

Affected products:

• APEX (24.1.0-24.1.21, 24.2.0-24.2.20, 26.1.0-26.1.4)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101521

CVE-2026-101528

CVE-2026-101528 is a critical vulnerability in the Data Guard Management component of Oracle Enterprise Manager for Oracle Database. The vulnerability is network-exploitable via HTTP by a low-privileged attacker, potentially leading to a full system takeover and impacting other products due to a scope change (CVSS 9.9).

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101528

CVE-2026-101529

CVE-2026-101529 is a critical vulnerability in the Data Guard Management component of Oracle Enterprise Manager for Oracle Database (versions 13.5 and 24.1). An attacker with low-level privileges can exploit this vulnerability over HTTP to achieve a full system compromise. The vulnerability is characterized by a scope change, allowing the attack to impact additional products, and holds a CVSS 3.1 base score of 9.9.

Affected products:

• Enterprise Manager for Oracle Database (13.5, 24.1)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101529

CVE-2026-101537

Oracle Solaris 11.4 contains a critical vulnerability in the Utility component that allows an unauthenticated, remote attacker to gain full control of the system via network-based TCP exploitation. The vulnerability is easily exploitable and results in complete compromise of confidentiality, integrity, and availability.

Affected products:

• Solaris (11.4)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101537

Related in this roundup: CVE-2026-60432.

CVE-2026-101590

CVE-2026-101590 is a critical vulnerability in the helidon-microprofile-security component of Oracle Fusion Middleware's Helidon product. The flaw allows an unauthenticated, network-adjacent attacker to perform unauthorized operations, including the creation, deletion, or modification of critical data. The vulnerability is characterized by high confidentiality and integrity impact scores.

Affected products:

• Helidon (4.0.0-4.5.5)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101590

CVE-2026-101634

Oracle Mobile Field Service, a component of Oracle E-Business Suite, contains a vulnerability that allows an unauthenticated, network-adjacent attacker to exploit the system via HTTP. Successful exploitation can lead to unauthorized access to critical data and a denial-of-service condition due to application crashes or hangs. The vulnerability is considered easily exploitable and carries a CVSS 3.1 base score of 9.1.

Affected products:

• Oracle E-Business Suite (12.2.3-12.2.15)
• Oracle Mobile Field Service (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101634

Related in this roundup: CVE-2026-101767, CVE-2026-101398, CVE-2026-101466, CVE-2026-101519, CVE-2026-101532, CVE-2026-101534, CVE-2026-101535, CVE-2026-101541, CVE-2026-101542, CVE-2026-101543, CVE-2026-101544, CVE-2026-101554, CVE-2026-101556, CVE-2026-101567.

CVE-2026-101763

A critical, unauthenticated remote code execution vulnerability exists in the Oracle Communications BRM - Elastic Charging Engine, specifically within its cloud-native deployment component. An attacker with network access can leverage RMI to gain complete control over the system, impacting confidentiality, integrity, and availability.

Affected products:

• Oracle Communications BRM - Elastic Charging Engine (15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, 15.2.0.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101763

CVE-2026-101765

CVE-2026-101765 is a critical vulnerability in the Oracle Communications Billing and Revenue Management (BRM) server that allows an unauthenticated, network-adjacent attacker to perform unauthorized data creation, deletion, or modification. The flaw is easily exploitable via HTTP and impacts both data confidentiality and integrity with a CVSS base score of 9.1.

Affected products:

• Communications Billing and Revenue Management (15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, 15.2.0.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101765

CVE-2026-101767

CVE-2026-101767 is a critical vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15. The flaw is remotely exploitable without authentication via HTTP, potentially allowing a complete takeover of the Application Object Library component with impacts to confidentiality, integrity, and availability.

Affected products:

• Oracle E-Business Suite (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101767

Related in this roundup: CVE-2026-101634, CVE-2026-101398, CVE-2026-101466, CVE-2026-101519, CVE-2026-101532, CVE-2026-101534, CVE-2026-101535, CVE-2026-101541, CVE-2026-101542, CVE-2026-101543, CVE-2026-101544, CVE-2026-101554, CVE-2026-101556, CVE-2026-101567.

CVE-2026-101808

Oracle Product Workbench within E-Business Suite contains a vulnerability in the WebUI component that allows unauthenticated, network-adjacent attackers to achieve unauthorized access to, or modification of, critical data. The vulnerability is easily exploitable via HTTP and carries a CVSS 3.1 base score of 9.1.

Affected products:

• E-Business Suite (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101808

Related in this roundup: CVE-2026-101809, CVE-2026-101387, CVE-2026-101536, CVE-2026-101540, CVE-2026-101545, CVE-2026-101546, CVE-2026-101551, CVE-2026-101552, CVE-2026-101555, CVE-2026-101557, CVE-2026-101566.

CVE-2026-101809

CVE-2026-101809 is a critical vulnerability in the Workflow Notification Mailer component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The vulnerability is remotely exploitable without authentication via HTTP, allowing an attacker to achieve a complete system takeover of the Workflow component. The vulnerability carries a CVSS base score of 10.0 and involves a scope change, potentially impacting the wider environment.

Affected products:

• E-Business Suite (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101809

Related in this roundup: CVE-2026-101808, CVE-2026-101387, CVE-2026-101536, CVE-2026-101540, CVE-2026-101545, CVE-2026-101546, CVE-2026-101551, CVE-2026-101552, CVE-2026-101555, CVE-2026-101557, CVE-2026-101566.

CVE-2026-60432

CVE-2026-60432 is a critical vulnerability in the Image Packaging System component of Oracle Solaris versions 11.3 and 11.4. The flaw allows an unauthenticated, network-adjacent attacker to achieve full system takeover via HTTP requests. Due to the lack of required authentication or user interaction, this vulnerability presents a high risk for remote compromise of affected Solaris installations.

Affected products:

• Solaris (11.3, 11.4)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-60432

Related in this roundup: CVE-2026-101537.

CVE-2026-83396

CVE-2026-83396 is a critical vulnerability in the Oracle Data Integrator component of Oracle Fusion Middleware. An unauthenticated attacker can exploit this flaw via RMI over the network to achieve a full takeover of the application. The vulnerability carries a CVSS 3.1 base score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

Affected products:

• Oracle Data Integrator (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-83396

CVE-2026-83397

CVE-2026-83397 is a critical vulnerability in the Console and Repository Explorer components of Oracle Data Integrator. The flaw allows an unauthenticated, network-adjacent attacker to achieve full system takeover via HTTP requests, resulting in complete compromise of confidentiality, integrity, and availability.

Affected products:

• Data Integrator (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-83397

CVE-2026-83399

Oracle WebLogic Server contains a critical vulnerability in its Core component, reachable via T3 or IIOP protocols. An unauthenticated attacker with network access can exploit this flaw to achieve full system takeover. The vulnerability has a CVSS base score of 9.8, indicating high severity across confidentiality, integrity, and availability.

Affected products:

• WebLogic Server (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-83399

Related in this roundup: CVE-2026-87302, CVE-2026-91323.

CVE-2026-87251

Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 contain a critical vulnerability in the Authentication Engine that allows an unauthenticated, network-adjacent attacker to achieve full system takeover via specially crafted SAML requests.

Affected products:

• Oracle Access Manager (12.2.1.4.0, 14.1.2.1.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-87251

Related in this roundup: CVE-2026-87337.

CVE-2026-87302

CVE-2026-87302 is a critical vulnerability in the Core component of Oracle WebLogic Server. It is remotely exploitable without authentication via HTTP by an attacker with network access. Successful exploitation allows an attacker to gain unauthorized access to or perform unauthorized modification/deletion of critical data stored within the WebLogic Server environment. The vulnerability is rated with a CVSS 3.1 base score of 9.1.

Affected products:

• WebLogic Server (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-87302

Related in this roundup: CVE-2026-83399, CVE-2026-91323.

CVE-2026-87337

CVE-2026-87337 is a critical vulnerability in the Authentication Engine component of Oracle Access Manager, allowing an unauthenticated remote attacker to compromise the system via HTTP. The vulnerability has a CVSS score of 10.0 and allows for unauthorized access, creation, deletion, or modification of critical data, with a scope change impact potentially affecting additional integrated products.

Affected products:

• Oracle Access Manager (12.2.1.4.0, 14.1.2.1.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-87337

Related in this roundup: CVE-2026-87251.

CVE-2026-87347

A vulnerability in the OSSL Module of Oracle HTTP Server allows a low-privileged attacker with network access to perform unauthorized creation, deletion, or modification of critical data. The vulnerability supports scope change and carries a CVSS 3.1 base score of 9.6, indicating significant impact on confidentiality and integrity.

Affected products:

• Oracle HTTP Server (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-87347

CVE-2026-91214

CVE-2026-91214 is a critical vulnerability in the Fabric Layer of Oracle SOA Suite affecting versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is network-exploitable by an unauthenticated attacker via HTTP, allowing for a full takeover of the affected product with significant impacts on confidentiality, integrity, and availability.

Affected products:

• SOA Suite (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91214

Related in this roundup: CVE-2026-91216, CVE-2026-91224, CVE-2026-91225, CVE-2026-91230, CVE-2026-91231, CVE-2026-91232, CVE-2026-91234, CVE-2026-91235, CVE-2026-91236, CVE-2026-91250.

CVE-2026-91216

CVE-2026-91216 is a critical remote code execution vulnerability in the Fabric Layer of Oracle SOA Suite. An unauthenticated attacker with network access via T3 or IIOP protocols can compromise the service, leading to full system takeover with impacts on confidentiality, integrity, and availability. The vulnerability has a CVSS base score of 10.0 and allows for scope change, potentially affecting auxiliary products.

Affected products:

• SOA Suite (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91216

Related in this roundup: CVE-2026-91214, CVE-2026-91224, CVE-2026-91225, CVE-2026-91230, CVE-2026-91231, CVE-2026-91232, CVE-2026-91234, CVE-2026-91235, CVE-2026-91236, CVE-2026-91250.

CVE-2026-91218

Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 contain a vulnerability in the Fabric Layer that allows a low-privileged attacker with network access to compromise the product. The flaw permits unauthorized creation, deletion, or modification of critical data and enables unauthorized access to sensitive information. Due to its scope change characteristics, successful exploitation can result in significant impacts beyond the Oracle SOA Suite instance itself.

Affected products:

• Oracle SOA Suite (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91218

Related in this roundup: CVE-2026-91221, CVE-2026-91251.

CVE-2026-91220

CVE-2026-91220 is a critical vulnerability in the Human Workflow component of Oracle Business Process Management Suite, allowing an unauthenticated remote attacker to gain full control of the application via HTTP. With a CVSS base score of 9.8, this flaw impacts confidentiality, integrity, and availability, and is considered easily exploitable.

Affected products:

• Oracle Business Process Management Suite (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91220

Related in this roundup: CVE-2026-91243.

CVE-2026-91221

CVE-2026-91221 is a critical vulnerability in the Fabric Layer of Oracle SOA Suite that allows an unauthenticated, network-adjacent attacker to achieve full system takeover. The vulnerability is exploitable via T3 and IIOP protocols and carries a CVSS base score of 10.0 due to its potential for full confidentiality, integrity, and availability impact, as well as the ability to affect other products via a scope change.

Affected products:

• Oracle SOA Suite (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91221

Related in this roundup: CVE-2026-91218, CVE-2026-91251.

CVE-2026-91222

CVE-2026-91222 is a critical vulnerability in the Human Workflow component of Oracle Business Process Management Suite, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is remotely exploitable via SOAP by a low-privileged attacker, potentially leading to a full system takeover and unauthorized access across integrated products due to scope change.

Affected products:

• Business Process Management Suite (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91222

CVE-2026-91224

CVE-2026-91224 is a critical vulnerability in the Fabric Layer component of Oracle SOA Suite, allowing a low-privileged network attacker to achieve complete system takeover via HTTP. The vulnerability has a CVSS 3.1 base score of 9.9 and involves a scope change, potentially impacting other integrated products.

Affected products:

• SOA Suite (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91224

Related in this roundup: CVE-2026-91214, CVE-2026-91216, CVE-2026-91225, CVE-2026-91230, CVE-2026-91231, CVE-2026-91232, CVE-2026-91234, CVE-2026-91235, CVE-2026-91236, CVE-2026-91250.

CVE-2026-91225

CVE-2026-91225 is a critical vulnerability in the Adapters component of Oracle SOA Suite. An unauthenticated remote attacker with network access via HTTP can exploit this flaw to perform unauthorized modification, creation, or deletion of critical data, as well as trigger a denial-of-service condition causing the application to hang or crash.

Affected products:

• SOA Suite (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91225

Related in this roundup: CVE-2026-91214, CVE-2026-91216, CVE-2026-91224, CVE-2026-91230, CVE-2026-91231, CVE-2026-91232, CVE-2026-91234, CVE-2026-91235, CVE-2026-91236, CVE-2026-91250.

CVE-2026-91230

CVE-2026-91230 is a critical, easily exploitable vulnerability in the Fabric Layer of Oracle SOA Suite. An unauthenticated remote attacker can leverage HTTP network access to gain unauthorized access to or modify data within the SOA Suite environment. The vulnerability has a scope change (S:C), indicating that successful exploitation may impact other integrated products and services, leading to a high confidentiality impact.

Affected products:

• SOA Suite (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91230

Related in this roundup: CVE-2026-91214, CVE-2026-91216, CVE-2026-91224, CVE-2026-91225, CVE-2026-91231, CVE-2026-91232, CVE-2026-91234, CVE-2026-91235, CVE-2026-91236, CVE-2026-91250.

CVE-2026-91231

CVE-2026-91231 is a critical vulnerability affecting the Adapters component of Oracle SOA Suite. The flaw allows an unauthenticated, network-adjacent attacker to perform remote code execution, leading to a complete takeover of the service. Due to its scope change impact, the exploit can extend beyond the SOA Suite to compromise other connected products, requiring immediate patching for versions 12.2.1.4.0 and 14.1.2.0.0.

Affected products:

• SOA Suite (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91231

Related in this roundup: CVE-2026-91214, CVE-2026-91216, CVE-2026-91224, CVE-2026-91225, CVE-2026-91230, CVE-2026-91232, CVE-2026-91234, CVE-2026-91235, CVE-2026-91236, CVE-2026-91250.

CVE-2026-91232

CVE-2026-91232 is a critical vulnerability in the Fabric Layer of Oracle SOA Suite affecting versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is network-exploitable via HTTP by a low-privileged user, allowing for a full takeover of the application with a scope change impact, resulting in high confidentiality, integrity, and availability loss.

Affected products:

• SOA Suite (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91232

Related in this roundup: CVE-2026-91214, CVE-2026-91216, CVE-2026-91224, CVE-2026-91225, CVE-2026-91230, CVE-2026-91231, CVE-2026-91234, CVE-2026-91235, CVE-2026-91236, CVE-2026-91250.

CVE-2026-91233

Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability in the Enterprise Scheduling System component. An unauthenticated remote attacker can exploit this via SOAP requests to achieve a full takeover of the Oracle SOA Suite instance. The vulnerability carries a CVSS base score of 9.8, indicating high severity across confidentiality, integrity, and availability.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91233

CVE-2026-91234

CVE-2026-91234 is a critical vulnerability within the Fabric Layer component of Oracle SOA Suite. An unauthenticated attacker can exploit this flaw remotely via HTTP to achieve full compromise of the application. The vulnerability carries a CVSS base score of 9.8, indicating severe risks to confidentiality, integrity, and availability.

Affected products:

• SOA Suite (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91234

Related in this roundup: CVE-2026-91214, CVE-2026-91216, CVE-2026-91224, CVE-2026-91225, CVE-2026-91230, CVE-2026-91231, CVE-2026-91232, CVE-2026-91235, CVE-2026-91236, CVE-2026-91250.

CVE-2026-91235

CVE-2026-91235 is a critical vulnerability in the Fabric Layer component of Oracle SOA Suite. An unauthenticated attacker with network access via HTTP can exploit this flaw to achieve full takeover of the application. The vulnerability carries a CVSS base score of 9.8, indicating high risk to confidentiality, integrity, and availability.

Affected products:

• SOA Suite (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91235

Related in this roundup: CVE-2026-91214, CVE-2026-91216, CVE-2026-91224, CVE-2026-91225, CVE-2026-91230, CVE-2026-91231, CVE-2026-91232, CVE-2026-91234, CVE-2026-91236, CVE-2026-91250.

CVE-2026-91236

Oracle SOA Suite, specifically the Fabric Layer component, contains a critical vulnerability that allows an unauthenticated attacker with network access via HTTP to perform a remote takeover of the application. The vulnerability is highly exploitable and impacts the confidentiality, integrity, and availability of the affected software.

Affected products:

• SOA Suite (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91236

Related in this roundup: CVE-2026-91214, CVE-2026-91216, CVE-2026-91224, CVE-2026-91225, CVE-2026-91230, CVE-2026-91231, CVE-2026-91232, CVE-2026-91234, CVE-2026-91235, CVE-2026-91250.

CVE-2026-91241

Oracle Business Intelligence Enterprise Edition contains a high-severity vulnerability in the Analytics Web Administration component. The flaw is remotely exploitable over HTTP by a high-privileged attacker and allows for a full system takeover and significant scope change, impacting the confidentiality, integrity, and availability of the affected environment.

Affected products:

• Oracle Business Intelligence Enterprise Edition (8.2.0.0.0, 12.2.1.4.0, 26.01.0.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91241

Related in this roundup: CVE-2026-101531.

CVE-2026-91243

CVE-2026-91243 is a high-severity vulnerability in the Fabric Layer of the Oracle Business Process Management Suite. A low-privileged attacker with network access via HTTP can exploit this flaw to perform unauthorized modification, deletion, or exfiltration of critical data, with impacts potentially extending beyond the suite due to a scope change. The vulnerability has a CVSS 3.1 base score of 9.6.

Affected products:

• Oracle Business Process Management Suite (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91243

Related in this roundup: CVE-2026-91220.

CVE-2026-91250

Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to a remote, easily exploitable flaw in the Adapters component. A low-privileged attacker with network access can leverage multiple protocols to achieve a full takeover of the application, with the potential for impact across additional products due to a scope change (CVSS 9.9).

Affected products:

• SOA Suite (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91250

Related in this roundup: CVE-2026-91214, CVE-2026-91216, CVE-2026-91224, CVE-2026-91225, CVE-2026-91230, CVE-2026-91231, CVE-2026-91232, CVE-2026-91234, CVE-2026-91235, CVE-2026-91236.

CVE-2026-91251

CVE-2026-91251 is a critical vulnerability in the Adapters component of Oracle SOA Suite within Oracle Fusion Middleware. A low-privileged attacker with network access via HTTP can exploit this flaw to achieve full takeover of the application. The vulnerability allows for scope change, potentially impacting other integrated products, and carries a CVSS 3.1 base score of 9.9.

Affected products:

• Oracle SOA Suite (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91251

Related in this roundup: CVE-2026-91218, CVE-2026-91221.

CVE-2026-91265

CVE-2026-91265 is a critical vulnerability in the Enterprise Infrastructure SEC component of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5). The vulnerability is network-exploitable by an unauthenticated attacker via HTTP, allowing for unauthorized read, modification, or deletion of critical data, resulting in a CVSS 3.1 base score of 9.1.

Affected products:

• JD Edwards EnterpriseOne Tools (9.2.0.0-9.2.26.5)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91265

Related in this roundup: CVE-2026-91305.

CVE-2026-91299

CVE-2026-91299 is a critical vulnerability in the E1 IOT Orchestrator Security component of Oracle JD Edwards EnterpriseOne Orchestrator. The vulnerability is network-exploitable without authentication and allows for a complete compromise of the service, including scope change impacts that can affect other products. It carries a CVSS 3.1 score of 10.0.

Affected products:

• JD Edwards EnterpriseOne Orchestrator (9.2.0.0-9.2.26.5)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91299

CVE-2026-91305

CVE-2026-91305 is a critical vulnerability in the Installation Security component of Oracle JD Edwards EnterpriseOne Tools. The flaw allows an unauthenticated, network-adjacent attacker to exploit the application via HTTPS, resulting in unauthorized access to, modification of, or deletion of critical data. The vulnerability is highly exploitable due to low complexity and no required user interaction or privileges.

Affected products:

• JD Edwards EnterpriseOne Tools (9.2.0.0-9.2.26.5)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91305

Related in this roundup: CVE-2026-91265.

CVE-2026-91323

Oracle WebLogic Server contains a vulnerability in the Core component that allows an unauthenticated, network-adjacent attacker to achieve a full system takeover via HTTP. The vulnerability is highly exploitable, requiring no privileges or user interaction, and carries a CVSS base score of 9.8.

Affected products:

• WebLogic Server (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91323

Related in this roundup: CVE-2026-83399, CVE-2026-87302.

CVE-2026-91341

CVE-2026-91341 is a critical vulnerability in the Oracle Outside In Clean Content SDK component of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can exploit this vulnerability to perform unauthorized modification, creation, or deletion of critical data, and can trigger a denial-of-service condition via an application crash or hang.

Affected products:

• Outside In Technology (8.5.8)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91341

Related in this roundup: CVE-2026-91354.

CVE-2026-91354

CVE-2026-91354 is a critical vulnerability in the Oracle Outside In Clean Content SDK (part of Oracle Fusion Middleware) version 8.5.8. An attacker with low privileges can exploit this flaw over HTTP to achieve a full takeover of the component. The vulnerability allows for scope change, potentially impacting other products integrated with the SDK, with a CVSS base score of 9.9.

Affected products:

• Outside In Technology (8.5.8)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91354

Related in this roundup: CVE-2026-91341.

CVE-2026-91408

CVE-2026-91408 is a critical vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware. An unauthenticated attacker with network access via T3 or IIOP protocols can exploit this flaw to achieve a full takeover of the application. Given the CVSS score of 9.8 and the ease of exploitation, this represents a significant risk to confidentiality, integrity, and availability.

Affected products:

• Oracle Identity Manager (12.2.1.4.0, 14.1.2.1.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91408

CVE-2026-91490

CVE-2026-91490 is a high-severity vulnerability in the LDAP Gateway component of the Oracle Identity Manager Connector, allowing unauthenticated attackers with network access to perform unauthorized read, write, or delete operations on critical data. The vulnerability is network-exploitable with low complexity, potentially leading to a total compromise of data integrity and confidentiality within the affected connector.

Affected products:

• Identity Manager Connector (12.2.1.4.0, 14.1.2.1.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91490

CVE-2026-91491

CVE-2026-91491 is a critical vulnerability in the LDAP Gateway component of Oracle Identity Manager Connector, part of Oracle Fusion Middleware. The vulnerability allows an unauthenticated, remote attacker with network access to the LDAP service to fully compromise the product, leading to a complete takeover. It is rated with a CVSS 3.1 base score of 9.8.

Affected products:

• Oracle Identity Manager Connector (12.2.1.4.0, 14.1.2.1.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91491

CVE-2026-91495

Oracle WebCenter Content is vulnerable to an unauthenticated, remotely exploitable flaw that allows an attacker to achieve a complete system takeover via HTTP. The vulnerability carries a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability.

Affected products:

• WebCenter Content (12.2.1.4.0, 14.1.2.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91495

CVE-2026-91622

CVE-2026-91622 is a critical vulnerability in the Product Quality Management component of Oracle Agile Product Lifecycle Management for Process version 6.2.4. The vulnerability allows an unauthenticated, remote attacker to perform unauthorized actions, including the creation, deletion, or modification of critical data, through a web-based attack vector. Exploitation requires user interaction and can result in significant data compromise across the affected system due to scope change.

Affected products:

• Agile Product Lifecycle Management for Process (6.2.4)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91622

Related in this roundup: CVE-2026-91624, CVE-2026-101473.

CVE-2026-91624

CVE-2026-91624 is a vulnerability in the Product Quality Management component of Oracle Agile Product Lifecycle Management for Process version 6.2.4. The vulnerability allows an unauthenticated, remote attacker to gain unauthorized access to or modify critical data via HTTP requests, posing a significant risk to data confidentiality and integrity.

Affected products:

• Agile Product Lifecycle Management for Process (6.2.4)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91624

Related in this roundup: CVE-2026-91622, CVE-2026-101473.

CVE-2026-91637

Oracle Essbase version 21.8.3.0.0 is vulnerable to an easily exploitable flaw in its Security component. A low-privileged attacker with network access via HTTP can achieve a full takeover of the system. The vulnerability carries a high CVSS score of 9.9 and impacts confidentiality, integrity, and availability, with the potential for scope change to affect other integrated products.

Affected products:

• Essbase (21.8.3.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91637

Related in this roundup: CVE-2026-91638, CVE-2026-91644, CVE-2026-91655, CVE-2026-91658, CVE-2026-91663, CVE-2026-91665.

CVE-2026-91638

CVE-2026-91638 is a critical vulnerability in the Security component of Oracle Essbase, version 21.8.3.0.0. The flaw is remotely exploitable via HTTP by low-privileged attackers and allows for full system takeover with a scope change impact, potentially affecting other connected products. Due to the high CVSS score of 9.9 and the nature of the exploit, this represents a significant risk for unauthorized access, data compromise, and system instability.

Affected products:

• Essbase (21.8.3.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91638

Related in this roundup: CVE-2026-91637, CVE-2026-91644, CVE-2026-91655, CVE-2026-91658, CVE-2026-91663, CVE-2026-91665.

CVE-2026-91644

CVE-2026-91644 is a critical, easily exploitable vulnerability in the Security component of Oracle Essbase (version 21.8.3.0.0). The flaw allows an unauthenticated remote attacker with network access via HTTP to perform unauthorized data access, updates, insertions, or deletions. Due to a scope change, successful exploitation can compromise the broader environment beyond the Essbase application itself.

Affected products:

• Essbase (21.8.3.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91644

Related in this roundup: CVE-2026-91637, CVE-2026-91638, CVE-2026-91655, CVE-2026-91658, CVE-2026-91663, CVE-2026-91665.

CVE-2026-91655

CVE-2026-91655 is a vulnerability in the Security component of Oracle Essbase (version 21.8.3.0.0). The vulnerability is network-exploitable via HTTP by low-privileged attackers. Successful exploitation allows for unauthorized access, modification, or deletion of critical data, as well as a partial denial of service (DoS), with a scope change impact on additional products. The vulnerability carries a CVSS 3.1 base score of 9.1.

Affected products:

• Essbase (21.8.3.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91655

Related in this roundup: CVE-2026-91637, CVE-2026-91638, CVE-2026-91644, CVE-2026-91658, CVE-2026-91663, CVE-2026-91665.

CVE-2026-91656

CVE-2026-91656 is a critical vulnerability in the Federated Partitions component of Oracle Essbase version 21.8.3.0.0. The vulnerability is network-exploitable via HTTP by a low-privileged user, allowing for unauthorized access, modification, or deletion of critical data, as well as potential partial denial-of-service conditions. Due to the scope change vector, successful exploitation may also impact integrated products beyond the affected component.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91656

CVE-2026-91658

CVE-2026-91658 is a critical vulnerability in the Security component of Oracle Essbase, version 21.8.3.0.0. The flaw is remotely exploitable over HTTP by a low-privileged attacker, potentially leading to a full system takeover. Due to a scope change (S:C), the vulnerability can impact environments beyond the Essbase instance itself. The vulnerability is characterized by high impact on confidentiality, integrity, and availability.

Affected products:

• Essbase (21.8.3.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91658

Related in this roundup: CVE-2026-91637, CVE-2026-91638, CVE-2026-91644, CVE-2026-91655, CVE-2026-91663, CVE-2026-91665.

CVE-2026-91663

Oracle Essbase component Security contains a critical vulnerability allowing a low-privileged attacker with network access via T3 or IIOP protocols to achieve a full takeover of the application. The vulnerability carries a CVSS 9.9 and involves a scope change, potentially impacting other integrated products.

Affected products:

• Essbase (21.8.3.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91663

Related in this roundup: CVE-2026-91637, CVE-2026-91638, CVE-2026-91644, CVE-2026-91655, CVE-2026-91658, CVE-2026-91665.

CVE-2026-91665

CVE-2026-91665 is a critical, unauthenticated remote code execution vulnerability residing in the Security component of Oracle Essbase version 21.8.3.0.0. The vulnerability allows an attacker with network access via TCP to fully compromise the target system, resulting in a complete takeover of the application with high impact to confidentiality, integrity, and availability.

Affected products:

• Essbase (21.8.3.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-91665

Related in this roundup: CVE-2026-91637, CVE-2026-91638, CVE-2026-91644, CVE-2026-91655, CVE-2026-91658, CVE-2026-91663.

CVE-2026-101387

A vulnerability in the Oracle Capacity component of Oracle E-Business Suite allows a low-privileged attacker with network access via HTTP to perform unauthorized operations, including accessing, updating, inserting, or deleting critical data, and causing a partial denial of service. The vulnerability is characterized by a CVSS 3.1 base score of 7.6.

Affected products:

• E-Business Suite (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101387

Related in this roundup: CVE-2026-101808, CVE-2026-101809, CVE-2026-101536, CVE-2026-101540, CVE-2026-101545, CVE-2026-101546, CVE-2026-101551, CVE-2026-101552, CVE-2026-101555, CVE-2026-101557, CVE-2026-101566.

CVE-2026-101398

CVE-2026-101398 is an easily exploitable vulnerability in the Oracle Capacity component of Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this flaw to gain unauthorized access to or modify critical data, as well as cause a partial denial of service (DoS) within the Oracle Capacity product.

Affected products:

• Oracle E-Business Suite (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101398

Related in this roundup: CVE-2026-101634, CVE-2026-101767, CVE-2026-101466, CVE-2026-101519, CVE-2026-101532, CVE-2026-101534, CVE-2026-101535, CVE-2026-101541, CVE-2026-101542, CVE-2026-101543, CVE-2026-101544, CVE-2026-101554, CVE-2026-101556, CVE-2026-101567.

CVE-2026-101438

CVE-2026-101438 is a vulnerability in Oracle Siebel CRM Cloud Applications (specifically the Siebel Cloud Manager component) that allows an unauthenticated attacker with physical access to the network segment of the hosting hardware to gain unauthorized access to or modify critical data. The vulnerability features a scope change and carries a CVSS 3.1 base score of 8.0, indicating significant impact on data confidentiality and integrity.

Affected products:

• Siebel CRM Cloud Applications (22.3-26.9)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101438

Related in this roundup: CVE-2026-101446.

CVE-2026-101447

CVE-2026-101447 is a vulnerability within the Workflow component of Oracle Siebel CRM Development versions 25.12 through 26.9. The vulnerability allows a low-privileged attacker with network access to compromise the application via HTTP. Exploitation is categorized as difficult and requires human interaction from a victim, but if successful, it can lead to a full takeover of the Siebel CRM Development instance.

Affected products:

• Siebel CRM Development (25.12-26.9)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101447

CVE-2026-101451

CVE-2026-101451 is a vulnerability in the Web UI component of Oracle Siebel CRM's Life Sciences product, affecting versions 17.0 through 26.9. The vulnerability allows a low-privileged attacker with network access via HTTP to perform unauthorized creation, deletion, or modification of critical data, as well as gain unauthorized access to all accessible data. The attack requires human interaction and can result in a scope change impacting other products.

Affected products:

• Siebel CRM (17.0-26.9)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101451

Related in this roundup: CVE-2026-101457, CVE-2026-101458, CVE-2026-101460, CVE-2026-101463, CVE-2026-101464, CVE-2026-101467, CVE-2026-101495, CVE-2026-101508.

CVE-2026-101452

CVE-2026-101452 is a vulnerability in the AHF Instant Diagnostic Replay component of the Oracle Autonomous Health Framework. An attacker with low-level local access to the underlying infrastructure can exploit this flaw to gain complete control over the Oracle Autonomous Health Framework. The vulnerability is rated with a CVSS base score of 7.8, indicating significant impact on confidentiality, integrity, and availability.

Affected products:

• Autonomous Health Framework (26.3-26.8)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101452

Related in this roundup: CVE-2026-101477, CVE-2026-101478.

CVE-2026-101457

Oracle Siebel CRM, specifically the eDetailing component of Siebel Apps - Life Sciences, contains a vulnerability (CVE-2026-101457) that allows a low-privileged attacker with network access to perform SQL injection attacks. Successful exploitation can lead to a full takeover of the application, compromising confidentiality, integrity, and availability.

Affected products:

• Siebel CRM (17.0-26.9)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101457

Related in this roundup: CVE-2026-101451, CVE-2026-101458, CVE-2026-101460, CVE-2026-101463, CVE-2026-101464, CVE-2026-101467, CVE-2026-101495, CVE-2026-101508.

CVE-2026-101458

CVE-2026-101458 is a high-severity vulnerability in the Oracle Siebel CRM Deployment component (Server Infrastructure), affecting versions 17.0 through 26.9. The vulnerability is easily exploitable by an unauthenticated attacker over HTTP, allowing for unauthorized access, modification, or deletion of critical data. The flaw carries a CVSS 3.1 base score of 8.2 and specifically impacts data confidentiality and integrity.

Affected products:

• Siebel CRM (17.0-26.9)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101458

Related in this roundup: CVE-2026-101451, CVE-2026-101457, CVE-2026-101460, CVE-2026-101463, CVE-2026-101464, CVE-2026-101467, CVE-2026-101495, CVE-2026-101508.

CVE-2026-101459

CVE-2026-101459 is a vulnerability in the Server Infrastructure component of Oracle Siebel CRM Deployment versions 17.0 through 26.9. The vulnerability allows a low-privileged network-based attacker to perform unauthorized data modification, deletion, or exfiltration, as well as cause a partial denial of service via HTTP requests.

Affected products:

• Siebel CRM Deployment (17.0-26.9)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101459

CVE-2026-101460

CVE-2026-101460 is an easily exploitable vulnerability in the Server Infrastructure component of Oracle Siebel CRM versions 17.0 through 26.9. The flaw allows an unauthenticated, network-adjacent attacker to gain unauthorized access to critical data or potentially full access to information managed by the Siebel CRM Deployment product via TLS.

Affected products:

• Siebel CRM (17.0-26.9)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101460

Related in this roundup: CVE-2026-101451, CVE-2026-101457, CVE-2026-101458, CVE-2026-101463, CVE-2026-101464, CVE-2026-101467, CVE-2026-101495, CVE-2026-101508.

CVE-2026-101461

CVE-2026-101461 is a vulnerability in the Server Infrastructure component of Oracle Siebel CRM Deployment versions 17.0 through 26.9. The flaw allows an unauthenticated, network-adjacent attacker to bypass authentication via HTTP, potentially leading to unauthorized access to or exposure of critical sensitive data stored within the Siebel CRM environment.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101461

CVE-2026-101463

An unauthenticated, network-exploitable vulnerability exists in the UIF Open UI component of Oracle Siebel CRM versions 17.0 through 26.9. The flaw allows remote attackers to compromise the Siebel CRM End User product and gain unauthorized access to critical data. The vulnerability is rated with a CVSS 3.1 base score of 7.5, reflecting a significant impact on confidentiality.

Affected products:

• Siebel CRM (17.0-26.9)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101463

Related in this roundup: CVE-2026-101451, CVE-2026-101457, CVE-2026-101458, CVE-2026-101460, CVE-2026-101464, CVE-2026-101467, CVE-2026-101495, CVE-2026-101508.

CVE-2026-101464

CVE-2026-101464 is a vulnerability in the Server Infrastructure component of Oracle Siebel CRM versions 17.0 through 26.9. A low-privileged attacker with local logon access to the host environment can exploit this flaw to gain unauthorized read/write access to critical data managed by Siebel CRM Deployment, resulting in significant confidentiality and integrity impact.

Affected products:

• Siebel CRM (17.0 - 26.9)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101464

Related in this roundup: CVE-2026-101451, CVE-2026-101457, CVE-2026-101458, CVE-2026-101460, CVE-2026-101463, CVE-2026-101467, CVE-2026-101495, CVE-2026-101508.

CVE-2026-101466

CVE-2026-101466 is a vulnerability in the Oracle EDI Gateway component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The vulnerability is remotely exploitable over HTTP by a high-privileged attacker, potentially leading to a full takeover of the Oracle EDI Gateway component. It carries a CVSS 3.1 base score of 7.2.

Affected products:

• Oracle E-Business Suite (12.2.3-12.2.15)
• Oracle EDI Gateway (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101466

Related in this roundup: CVE-2026-101634, CVE-2026-101767, CVE-2026-101398, CVE-2026-101519, CVE-2026-101532, CVE-2026-101534, CVE-2026-101535, CVE-2026-101541, CVE-2026-101542, CVE-2026-101543, CVE-2026-101544, CVE-2026-101554, CVE-2026-101556, CVE-2026-101567.

CVE-2026-101467

A vulnerability in the Portal Framework component of Oracle Siebel CRM allows an unauthenticated, remote attacker to gain unauthorized access to, modify, or delete critical data within the application. The vulnerability is exploitable over HTTPS and carries a CVSS 3.1 base score of 7.4.

Affected products:

• Siebel CRM (17.0-26.9)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101467

Related in this roundup: CVE-2026-101451, CVE-2026-101457, CVE-2026-101458, CVE-2026-101460, CVE-2026-101463, CVE-2026-101464, CVE-2026-101495, CVE-2026-101508.

CVE-2026-101468

CVE-2026-101468 is a critical vulnerability in the Cloud Gateway component of Oracle Siebel CRM, allowing unauthenticated remote attackers to perform unauthorized data access via HTTP. The vulnerability is network-exploitable with low attack complexity, leading to significant confidentiality impact on sensitive data stored within the Siebel CRM Deployment.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101468

CVE-2026-101469

CVE-2026-101469 is a vulnerability in the Installation component of Oracle Product Lifecycle Analytics version 3.6.1. A low-privileged attacker with network access can exploit this flaw using SQL to achieve a full compromise of the application, affecting confidentiality, integrity, and availability.

Affected products:

• Product Lifecycle Analytics (3.6.1)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101469

CVE-2026-101473

CVE-2026-101473 is a critical vulnerability in the Product Quality Management component of Oracle Agile Product Lifecycle Management for Process version 6.2.4. The vulnerability allows an unauthenticated, remote attacker to gain full control of the application via HTTP, resulting in impacts to confidentiality, integrity, and availability.

Affected products:

• Agile Product Lifecycle Management for Process (6.2.4)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101473

Related in this roundup: CVE-2026-91622, CVE-2026-91624.

CVE-2026-101477

Oracle Autonomous Health Framework, specifically the Trace File Analyzer component, contains a vulnerability in versions 26.3 through 26.8. A low-privileged user with local access to the infrastructure can exploit this flaw to achieve full takeover of the component, resulting in high confidentiality, integrity, and availability impacts.

Affected products:

• Autonomous Health Framework (26.3-26.8)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101477

Related in this roundup: CVE-2026-101452, CVE-2026-101478.

CVE-2026-101478

Oracle Autonomous Health Framework, specifically the Trace File Analyzer component in versions 26.3 through 26.8, is vulnerable to a local privilege escalation issue. A low-privileged attacker with local logon access to the host infrastructure can exploit this flaw to gain unauthorized control over the framework, resulting in a full system compromise of the component's functionality.

Affected products:

• Autonomous Health Framework (26.3-26.8)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101478

Related in this roundup: CVE-2026-101452, CVE-2026-101477.

CVE-2026-101479

CVE-2026-101479 is a vulnerability in Oracle Secure Backup that allows an unauthenticated, network-adjacent attacker to perform a denial-of-service (DoS) attack. The vulnerability permits the attacker to cause a repeatable crash or hang of the backup service, with the potential for impact to extend to other systems due to a scope change (CVSS 3.1 scope: changed).

Affected products:

• Secure Backup (19.1.0.0.0, 19.1.0.1.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101479

Related in this roundup: CVE-2026-101484, CVE-2026-101481, CVE-2026-101482.

CVE-2026-101481

CVE-2026-101481 is a vulnerability in the Device Management and Support component of Oracle Secure Backup (versions 19.1.0.0.0 and 19.1.0.1.0). An attacker with low-privileged local access can exploit this flaw to achieve full compromise of the Oracle Secure Backup application. Due to a scope change, this vulnerability may also allow for the compromise of additional products within the infrastructure.

Affected products:

• Secure Backup (19.1.0.0.0, 19.1.0.1.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101481

Related in this roundup: CVE-2026-101484, CVE-2026-101479, CVE-2026-101482.

CVE-2026-101482

Oracle Secure Backup versions 19.1.0.0.0 and 19.1.0.1.0 contain a vulnerability in the Device Management and Support component that allows an authenticated, low-privileged attacker with local access to the underlying infrastructure to achieve a full takeover of the application. This vulnerability is rated with a CVSS 3.1 score of 7.8, indicating high impacts to confidentiality, integrity, and availability.

Affected products:

• Secure Backup (19.1.0.0.0, 19.1.0.1.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101482

Related in this roundup: CVE-2026-101484, CVE-2026-101479, CVE-2026-101481.

CVE-2026-101494

CVE-2026-101494 is a vulnerability in the Core component of Oracle REST Data Services versions 24.2.0 through 26.2.2. The vulnerability allows a low-privileged attacker with network access to perform unauthorized access to sensitive data via HTTP. The vulnerability has a scope change (S:C) impact, meaning successful exploitation may affect downstream products or services integrated with the REST Data Services instance.

Affected products:

• REST Data Services (24.2.0-26.2.2)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101494

CVE-2026-101495

CVE-2026-101495 is a critical vulnerability in the Oracle Siebel Approval Manager component of Siebel CRM versions 17.0 through 26.9. An unauthenticated attacker with network access can exploit this flaw via HTTP to achieve a full takeover of the application. The attack requires human interaction, making it a target for social engineering or web-based redirection vectors leading to compromised system integrity, confidentiality, and availability.

Affected products:

• Siebel CRM (17.0-26.9)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101495

Related in this roundup: CVE-2026-101451, CVE-2026-101457, CVE-2026-101458, CVE-2026-101460, CVE-2026-101463, CVE-2026-101464, CVE-2026-101467, CVE-2026-101508.

CVE-2026-101498

Oracle Trusted Answer Search version 26.1 contains a vulnerability in its PLSQL package component that allows an unauthenticated, remote attacker to gain full control of the application via Oracle Net. The vulnerability is difficult to exploit but results in complete compromise of confidentiality, integrity, and availability.

Affected products:

• Trusted Answer Search (26.1)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101498

Related in this roundup: CVE-2026-101501, CVE-2026-101503, CVE-2026-101504, CVE-2026-101505, CVE-2026-101506.

CVE-2026-101504

CVE-2026-101504 is a vulnerability in the Application expert UI component of Oracle Trusted Answer Search version 26.1. The flaw allows a low-privileged attacker with network access to perform unauthorized data operations—including read, update, insert, and delete—via HTTP. Successful exploitation requires human interaction and results in a scope change, potentially impacting other integrated products.

Affected products:

• Trusted Answer Search (26.1)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101504

Related in this roundup: CVE-2026-101501, CVE-2026-101503, CVE-2026-101498, CVE-2026-101505, CVE-2026-101506.

CVE-2026-101505

CVE-2026-101505 is a vulnerability in the Application expert UI component of Oracle Trusted Answer Search version 26.1. The flaw is remotely exploitable over HTTP by a low-privileged attacker, provided there is human interaction from a victim. Successful exploitation results in unauthorized access, modification, or deletion of critical data, and features a changed attack scope, potentially impacting integrated or downstream products.

Affected products:

• Trusted Answer Search (26.1)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101505

Related in this roundup: CVE-2026-101501, CVE-2026-101503, CVE-2026-101498, CVE-2026-101504, CVE-2026-101506.

CVE-2026-101506

CVE-2026-101506 is a vulnerability in the Application expert UI component of Oracle Trusted Answer Search version 26.1. The vulnerability allows a low-privileged attacker with network access via HTTP to perform unauthorized access to critical data or obtain complete access to all data accessible by the application. The vulnerability has a scope change (S:C) impact, meaning it may affect additional products beyond the primary target.

Affected products:

• Trusted Answer Search (26.1)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101506

Related in this roundup: CVE-2026-101501, CVE-2026-101503, CVE-2026-101498, CVE-2026-101504, CVE-2026-101505.

CVE-2026-101508

An unauthenticated remote attacker can exploit a vulnerability in the EAI component of Oracle Siebel CRM via HTTP to trigger a complete denial-of-service (DoS) condition, resulting in a system hang or repeatable crash.

Affected products:

• Siebel CRM (17.0-26.9)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101508

Related in this roundup: CVE-2026-101451, CVE-2026-101457, CVE-2026-101458, CVE-2026-101460, CVE-2026-101463, CVE-2026-101464, CVE-2026-101467, CVE-2026-101495.

CVE-2026-101518

CVE-2026-101518 is a vulnerability in the Agent Next Gen component of the Oracle Enterprise Manager Base Platform. The flaw is remotely exploitable over HTTP by a low-privileged attacker, potentially leading to a full system takeover.

Affected products:

• Oracle Enterprise Manager Base Platform (13.5, 24.1)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101518

CVE-2026-101519

CVE-2026-101519 is a critical vulnerability within the Oracle EDI Gateway component of the Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. The flaw is remotely exploitable via HTTP by an attacker with high privileges, potentially leading to a full takeover of the EDI Gateway component. The vulnerability has a CVSS base score of 7.2, impacting confidentiality, integrity, and availability.

Affected products:

• Oracle E-Business Suite (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101519

Related in this roundup: CVE-2026-101634, CVE-2026-101767, CVE-2026-101398, CVE-2026-101466, CVE-2026-101532, CVE-2026-101534, CVE-2026-101535, CVE-2026-101541, CVE-2026-101542, CVE-2026-101543, CVE-2026-101544, CVE-2026-101554, CVE-2026-101556, CVE-2026-101567.

CVE-2026-101520

A vulnerability in the NextGen Installer component of the Oracle Global Lifecycle Management NextGen OUI Framework within Oracle Fusion Middleware allows an unauthenticated attacker with network access to trigger a denial-of-service (DoS) condition. By sending specially crafted HTTP requests, an attacker can cause the service to hang or crash repeatedly, impacting system availability.

Affected products:

• Fusion Middleware (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0, 15.1.1.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101520

CVE-2026-101525

Oracle Enterprise Manager for Siebel, specifically the Configuration Management component, contains an easily exploitable vulnerability that allows a low-privileged attacker with network access via HTTP to fully compromise the application. The vulnerability impacts confidentiality, integrity, and availability, resulting in a potential complete takeover of the affected product.

Affected products:

• Oracle Enterprise Manager for Siebel (13.5, 24.1)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101525

CVE-2026-101526

CVE-2026-101526 is a critical vulnerability in the Configuration Management component of Oracle Enterprise Manager for Siebel, versions 13.5 and 24.1. The flaw is remotely exploitable over HTTP by an authenticated low-privileged user. Successful exploitation can lead to a full takeover of the application, resulting in high impact to confidentiality, integrity, and availability.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101526

CVE-2026-101527

CVE-2026-101527 is a high-severity vulnerability in the Enterprise Manager Install component of the Oracle Enterprise Manager Base Platform. The vulnerability allows a low-privileged attacker with local access to the underlying infrastructure to achieve a full takeover of the application. The vulnerability is characterized by a CVSS 3.1 base score of 7.8, indicating significant impact on confidentiality, integrity, and availability.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101527

CVE-2026-101531

CVE-2026-101531 is an easily exploitable, unauthenticated vulnerability in the Analytics Server component of Oracle Business Intelligence Enterprise Edition. An attacker can leverage network access via HTTP to gain unauthorized access to critical or sensitive data stored within the application, leading to a high confidentiality impact.

Affected products:

• Oracle Business Intelligence Enterprise Edition (8.2.0.0.0, 26.01.0.0.0)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101531

Related in this roundup: CVE-2026-91241.

CVE-2026-101532

CVE-2026-101532 is a critical vulnerability within the Oracle EDI Gateway component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The vulnerability is network-exploitable via HTTP and allows an attacker with high privileges to achieve full takeover of the affected component, impacting confidentiality, integrity, and availability.

Affected products:

• Oracle E-Business Suite (12.2.3-12.2.15)
• Oracle EDI Gateway

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101532

Related in this roundup: CVE-2026-101634, CVE-2026-101767, CVE-2026-101398, CVE-2026-101466, CVE-2026-101519, CVE-2026-101534, CVE-2026-101535, CVE-2026-101541, CVE-2026-101542, CVE-2026-101543, CVE-2026-101544, CVE-2026-101554, CVE-2026-101556, CVE-2026-101567.

CVE-2026-101534

Oracle EDI Gateway in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is susceptible to a vulnerability that allows a low-privileged network attacker to compromise the component via HTTP. Successful exploitation can lead to unauthorized access, modification, or deletion of critical data, with a scope change impacting additional products.

Affected products:

• Oracle E-Business Suite (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101534

Related in this roundup: CVE-2026-101634, CVE-2026-101767, CVE-2026-101398, CVE-2026-101466, CVE-2026-101519, CVE-2026-101532, CVE-2026-101535, CVE-2026-101541, CVE-2026-101542, CVE-2026-101543, CVE-2026-101544, CVE-2026-101554, CVE-2026-101556, CVE-2026-101567.

CVE-2026-101535

CVE-2026-101535 is a high-severity vulnerability in the Security API component of the Oracle Sales Foundation product within Oracle E-Business Suite. The flaw allows a low-privileged attacker with network access via HTTP to potentially take over the application. With a CVSS base score of 7.5, it represents a significant risk to confidentiality, integrity, and availability.

Affected products:

• Oracle E-Business Suite (12.2.3-12.2.15)
• Oracle Sales Foundation

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101535

Related in this roundup: CVE-2026-101634, CVE-2026-101767, CVE-2026-101398, CVE-2026-101466, CVE-2026-101519, CVE-2026-101532, CVE-2026-101534, CVE-2026-101541, CVE-2026-101542, CVE-2026-101543, CVE-2026-101544, CVE-2026-101554, CVE-2026-101556, CVE-2026-101567.

CVE-2026-101536

Oracle Cost Management within Oracle E-Business Suite versions 12.2.3 through 12.2.15 contains a vulnerability that allows a low-privileged attacker with network access via HTTP to potentially take over the component. The vulnerability is rated with a CVSS 3.1 score of 7.5, indicating significant impact on confidentiality, integrity, and availability.

Affected products:

• E-Business Suite (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101536

Related in this roundup: CVE-2026-101808, CVE-2026-101809, CVE-2026-101387, CVE-2026-101540, CVE-2026-101545, CVE-2026-101546, CVE-2026-101551, CVE-2026-101552, CVE-2026-101555, CVE-2026-101557, CVE-2026-101566.

CVE-2026-101540

A vulnerability in the Oracle Capacity component of Oracle E-Business Suite allows a low-privileged attacker with network access via HTTP to perform unauthorized access to critical data. Due to the scope change, the impact can extend beyond the Oracle Capacity component to other integrated products, resulting in a significant confidentiality impact.

Affected products:

• E-Business Suite (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101540

Related in this roundup: CVE-2026-101808, CVE-2026-101809, CVE-2026-101387, CVE-2026-101536, CVE-2026-101545, CVE-2026-101546, CVE-2026-101551, CVE-2026-101552, CVE-2026-101555, CVE-2026-101557, CVE-2026-101566.

CVE-2026-101541

CVE-2026-101541 is a vulnerability in the Oracle Capacity component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The vulnerability is network-exploitable via HTTP by a low-privileged attacker, allowing for unauthorized access to critical data. Due to scope change, the impact extends beyond the Oracle Capacity component itself.

Affected products:

• Oracle E-Business Suite (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101541

Related in this roundup: CVE-2026-101634, CVE-2026-101767, CVE-2026-101398, CVE-2026-101466, CVE-2026-101519, CVE-2026-101532, CVE-2026-101534, CVE-2026-101535, CVE-2026-101542, CVE-2026-101543, CVE-2026-101544, CVE-2026-101554, CVE-2026-101556, CVE-2026-101567.

CVE-2026-101542

Oracle E-Business Suite's Oracle Capacity component contains a vulnerability in its Internal Operations module that allows a low-privileged, network-adjacent attacker to perform a complete takeover of the component via HTTP. The vulnerability has a CVSS score of 8.8, indicating high impact on confidentiality, integrity, and availability.

Affected products:

• Oracle E-Business Suite (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101542

Related in this roundup: CVE-2026-101634, CVE-2026-101767, CVE-2026-101398, CVE-2026-101466, CVE-2026-101519, CVE-2026-101532, CVE-2026-101534, CVE-2026-101535, CVE-2026-101541, CVE-2026-101543, CVE-2026-101544, CVE-2026-101554, CVE-2026-101556, CVE-2026-101567.

CVE-2026-101543

Oracle E-Business Suite contains a vulnerability in the Capacity component, specifically within Internal Operations, that allows a low-privileged attacker with network access via HTTP to potentially take over the application. This vulnerability is difficult to exploit but carries a CVSS base score of 7.5, indicating significant potential impact on confidentiality, integrity, and availability.

Affected products:

• Oracle E-Business Suite (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101543

Related in this roundup: CVE-2026-101634, CVE-2026-101767, CVE-2026-101398, CVE-2026-101466, CVE-2026-101519, CVE-2026-101532, CVE-2026-101534, CVE-2026-101535, CVE-2026-101541, CVE-2026-101542, CVE-2026-101544, CVE-2026-101554, CVE-2026-101556, CVE-2026-101567.

CVE-2026-101544

CVE-2026-101544 is a vulnerability in the Oracle Payroll component of Oracle E-Business Suite. The vulnerability allows a low-privileged authenticated attacker with access to the underlying infrastructure to achieve a full takeover of the Oracle Payroll application. It is characterized as a difficult to exploit vulnerability that impacts the confidentiality, integrity, and availability of the system.

Affected products:

• Oracle E-Business Suite (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101544

Related in this roundup: CVE-2026-101634, CVE-2026-101767, CVE-2026-101398, CVE-2026-101466, CVE-2026-101519, CVE-2026-101532, CVE-2026-101534, CVE-2026-101535, CVE-2026-101541, CVE-2026-101542, CVE-2026-101543, CVE-2026-101554, CVE-2026-101556, CVE-2026-101567.

CVE-2026-101545

A vulnerability in the Oracle Inventory Management component of Oracle E-Business Suite allows a low-privileged attacker with local access to the infrastructure to achieve full takeover of the Inventory Management product. The vulnerability is difficult to exploit but results in high impacts to confidentiality, integrity, and availability.

Affected products:

• E-Business Suite (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101545

Related in this roundup: CVE-2026-101808, CVE-2026-101809, CVE-2026-101387, CVE-2026-101536, CVE-2026-101540, CVE-2026-101546, CVE-2026-101551, CVE-2026-101552, CVE-2026-101555, CVE-2026-101557, CVE-2026-101566.

CVE-2026-101546

Oracle E-Business Suite, specifically the Materials Requirement Planning component, contains a vulnerability that allows a low-privileged attacker with network access via HTTP to potentially take over the component. The vulnerability is rated with a CVSS 3.1 base score of 7.5, indicating significant impact on confidentiality, integrity, and availability, despite being classified as difficult to exploit.

Affected products:

• E-Business Suite (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101546

Related in this roundup: CVE-2026-101808, CVE-2026-101809, CVE-2026-101387, CVE-2026-101536, CVE-2026-101540, CVE-2026-101545, CVE-2026-101551, CVE-2026-101552, CVE-2026-101555, CVE-2026-101557, CVE-2026-101566.

CVE-2026-101548

Oracle Application Testing Suite version 13.3.0.1 is vulnerable to a local exploitation flaw within the OpenScript component. A low-privileged attacker with authenticated access to the underlying infrastructure can achieve a full takeover of the application. The vulnerability carries a CVSS 3.1 base score of 7.0, indicating significant impacts to confidentiality, integrity, and availability.

Affected products:

• Application Testing Suite (13.3.0.1)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101548

Related in this roundup: CVE-2026-101549.

CVE-2026-101549

A vulnerability exists in the OpenScript component of Oracle Application Testing Suite version 13.3.0.1. A low-privileged attacker with local logon access can exploit this flaw to gain unauthorized control over the application, resulting in a full system compromise impacting confidentiality, integrity, and availability.

Affected products:

• Application Testing Suite (13.3.0.1)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101549

Related in this roundup: CVE-2026-101548.

CVE-2026-101551

CVE-2026-101551 is a vulnerability in the Oracle Diagnostics Interfaces component of Oracle Applications Manager within Oracle E-Business Suite versions 12.2.3 through 12.2.15. The vulnerability is remotely exploitable without authentication via HTTP, allowing an attacker to gain unauthorized access to or compromise sensitive data managed by the Oracle Applications Manager.

Affected products:

• E-Business Suite (12.2.3-12.2.15)
• Oracle Applications Manager

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101551

Related in this roundup: CVE-2026-101808, CVE-2026-101809, CVE-2026-101387, CVE-2026-101536, CVE-2026-101540, CVE-2026-101545, CVE-2026-101546, CVE-2026-101552, CVE-2026-101555, CVE-2026-101557, CVE-2026-101566.

CVE-2026-101552

CVE-2026-101552 is a vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite. The flaw, specifically within the Flexfields component, allows a low-privileged attacker with network access to achieve a full takeover of the Application Object Library through a successful HTTP-based exploit, resulting in significant impacts on confidentiality, integrity, and availability.

Affected products:

• E-Business Suite (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101552

Related in this roundup: CVE-2026-101808, CVE-2026-101809, CVE-2026-101387, CVE-2026-101536, CVE-2026-101540, CVE-2026-101545, CVE-2026-101546, CVE-2026-101551, CVE-2026-101555, CVE-2026-101557, CVE-2026-101566.

CVE-2026-101554

Oracle E-Business Suite's Payroll component contains a vulnerability that allows a low-privileged attacker with network access via HTTP to potentially take over the application. The vulnerability is difficult to exploit but results in significant impacts to confidentiality, integrity, and availability.

Affected products:

• Oracle E-Business Suite (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101554

Related in this roundup: CVE-2026-101634, CVE-2026-101767, CVE-2026-101398, CVE-2026-101466, CVE-2026-101519, CVE-2026-101532, CVE-2026-101534, CVE-2026-101535, CVE-2026-101541, CVE-2026-101542, CVE-2026-101543, CVE-2026-101544, CVE-2026-101556, CVE-2026-101567.

CVE-2026-101555

CVE-2026-101555 is a vulnerability in the Oracle Payroll component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The vulnerability is accessible over the network via HTTP, allowing a low-privileged attacker to achieve a full takeover of the Oracle Payroll application. The complexity is identified as high, but the successful exploitation results in significant impacts to confidentiality, integrity, and availability.

Affected products:

• E-Business Suite (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101555

Related in this roundup: CVE-2026-101808, CVE-2026-101809, CVE-2026-101387, CVE-2026-101536, CVE-2026-101540, CVE-2026-101545, CVE-2026-101546, CVE-2026-101551, CVE-2026-101552, CVE-2026-101557, CVE-2026-101566.

CVE-2026-101556

CVE-2026-101556 is a critical vulnerability in the Oracle Payroll component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The flaw allows a low-privileged attacker with network access via HTTP to perform unauthorized operations, potentially resulting in a full takeover of the Oracle Payroll application. The vulnerability is characterized by a CVSS 3.1 base score of 7.5, indicating significant risks to confidentiality, integrity, and availability.

Affected products:

• Oracle E-Business Suite (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101556

Related in this roundup: CVE-2026-101634, CVE-2026-101767, CVE-2026-101398, CVE-2026-101466, CVE-2026-101519, CVE-2026-101532, CVE-2026-101534, CVE-2026-101535, CVE-2026-101541, CVE-2026-101542, CVE-2026-101543, CVE-2026-101544, CVE-2026-101554, CVE-2026-101567.

CVE-2026-101557

CVE-2026-101557 is a vulnerability in the Oracle Purchasing component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. The flaw is remotely exploitable over HTTP by a low-privileged attacker, potentially leading to a full system takeover of the Purchasing component.

Affected products:

• E-Business Suite (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101557

Related in this roundup: CVE-2026-101808, CVE-2026-101809, CVE-2026-101387, CVE-2026-101536, CVE-2026-101540, CVE-2026-101545, CVE-2026-101546, CVE-2026-101551, CVE-2026-101552, CVE-2026-101555, CVE-2026-101566.

CVE-2026-101560

CVE-2026-101560 is a vulnerability in the Dynamo Commerce Server component of the Oracle Commerce Platform (version 11.4.0). The flaw allows a low-privileged attacker with network access via HTTP to perform unauthorized read, creation, deletion, or modification of critical data within the platform. The vulnerability is easily exploitable, requiring no user interaction.

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101560

CVE-2026-101562

Oracle Agile PLM version 2.6 contains an easily exploitable vulnerability in the Acollect component. The flaw allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data or complete access to all data stored within the Oracle Agile PLM system, resulting in significant confidentiality impacts.

Affected products:

• Agile PLM (2.6)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101562

CVE-2026-101566

A vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite allows a low-privileged authenticated attacker with local access to the infrastructure to escalate privileges and fully compromise the component. Successful exploitation leads to a complete takeover of the library, impacting the confidentiality, integrity, and availability of the system.

Affected products:

• E-Business Suite (12.2.3-12.2.15)

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101566

Related in this roundup: CVE-2026-101808, CVE-2026-101809, CVE-2026-101387, CVE-2026-101536, CVE-2026-101540, CVE-2026-101545, CVE-2026-101546, CVE-2026-101551, CVE-2026-101552, CVE-2026-101555, CVE-2026-101557.

CVE-2026-101567

CVE-2026-101567 is a critical vulnerability in the Cost Planning component of Oracle Cost Management within Oracle E-Business Suite versions 12.2.3 through 12.2.15. The vulnerability is network-exploitable via HTTP by low-privileged attackers, potentially allowing for a full compromise of the affected component with high impact on confidentiality, integrity, and availability.

Affected products:

• Oracle E-Business Suite (12.2.3-12.2.15)
• Oracle Cost Management

Source: https://nvd.nist.gov/vuln/detail/CVE-2026-101567

Related in this roundup: CVE-2026-101634, CVE-2026-101767, CVE-2026-101398, CVE-2026-101466, CVE-2026-101519, CVE-2026-101532, CVE-2026-101534, CVE-2026-101535, CVE-2026-101541, CVE-2026-101542, CVE-2026-101543, CVE-2026-101544, CVE-2026-101554, CVE-2026-101556.