NCSC-2026-0442
Vulnerability from csaf_ncscnl - Published: 2026-10-21 12:33 - Updated: 2026-10-21 12:33Summary
Kwetsbaarheden verholpen in Oracle E-Business Suite
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Oracle heeft 194 kwetsbaarheden verholpen in Oracle E-Business Suite en gerelateerde componenten, specifiek voor versies 12.2.3 tot en met 12.2.15.
Interpretaties: Afhankelijk van de specifieke kwetsbaarheid kunnen deze door een aanvaller met netwerktoegang worden misbruikt om ongeautoriseerde toegang tot gegevens te verkrijgen of om gegevens aan te maken, in te zien, te wijzigen of te verwijderen. In ernstige gevallen kan misbruik leiden tot Remote Code Execution (RCE), waardoor een aanvaller willekeurige code kan uitvoeren op het getroffen systeem.
Een deel van de kwetsbaarheden kan op afstand worden misbruikt zonder authenticatie. Voor andere kwetsbaarheden zijn geldige inloggegevens, specifieke toegangsrechten of gebruikersinteractie vereist. De impact en de voorwaarden voor misbruik verschillen per kwetsbaarheid en getroffen component. De CVSS 3.1-scores lopen op tot de maximale score van 10,0.
Oplossingen: Oracle heeft updates uitgebracht om de kwetsbaarheden in de genoemde versies en componenten van Oracle E-Business Suite te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-306: Missing Authentication for Critical Function
A vulnerability in Oracle Contract Lifecycle Management for Public Sector (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 score of 8.1.
8.1 (High)
Affected products
Known affected
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / E-Business Suite
|
vers:unknown/* |
A critical vulnerability in Oracle Contract Lifecycle Management for Public Sector (versions 12.2.3-12.2.15) allows a low-privileged attacker with HTTP network access to fully compromise the system, rated CVSS 3.1 8.8 for high impact.
8.8 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 of Oracle E-Business Suite allows a low privileged attacker with HTTP network access to potentially compromise confidentiality, integrity, and availability, rated CVSS 3.1 base score 8.5.
8.5 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A vulnerability in Oracle Applications Framework versions 12.2.3 to 12.2.15 allows a low-privileged attacker with network access and user interaction to create, delete, or modify critical data, with a CVSS 3.1 score of 8.7.
8.7 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle E-Business Suite iSupport (versions 12.2.3-12.2.15) enables low-privileged attackers with network access to modify, create, delete data, and cause partial denial of service, rated CVSS 8.5.
8.5 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A high-severity vulnerability in Oracle E-Business Suite Workflow Notification Mailer (12.2.3-12.2.15) allows unauthenticated HTTP attackers to potentially compromise the Workflow component, with a CVSS 3.1 score of 8.1.
8.1 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle Applications Manager versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle EDI Gateway versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to gain unauthorized access and modify sensitive data, rated with a CVSS 3.1 base score of 8.5.
8.5 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle E-Business Suite Oracle Capacity (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to fully compromise the system, rated CVSS 3.1 base score 8.8.
8.8 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle Purchasing versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8 indicating high impact.
8.8 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle Cost Management versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle Mobile Field Service versions 12.2.3 to 12.2.15 allows unauthenticated attackers with HTTP network access to gain unauthorized sensitive data access or cause denial of service, rated CVSS 3.1 base score 9.1.
9.1 (Critical)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle Mobile Field Service (versions 12.2.3 to 12.2.15) allows a low-privileged attacker with network HTTP access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle Marketing (Oracle E-Business Suite versions 12.2.3-12.2.15) allows unauthenticated remote attackers to gain unauthorized access and modify data, with a CVSS 3.1 base score of 8.2 indicating high confidentiality and integrity impact.
8.2 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A vulnerability in Oracle Partner Management versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized data access, modify critical data, cause partial denial of service, and affect other Oracle products, with a CVSS 3.1 score of 8.4.
8.4 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle Mobile Field Service versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTPS network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle Mobile Field Service versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTPS network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle Mobile Field Service (versions 12.2.3 to 12.2.15) allows a low-privileged attacker with network HTTP access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle Mobile Field Service versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTPS network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle Mobile Field Service (versions 12.2.3 to 12.2.15) allows a low-privileged attacker with network HTTP access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A vulnerability in Oracle Mobile Field Service versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A high-severity vulnerability in Oracle Call Center Technology versions 12.2.3 to 12.2.15 allows unauthenticated remote attackers to potentially compromise system confidentiality, integrity, and availability via RMI access.
8.1 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A vulnerability in Oracle E-Business Suite Integrated SOA Gateway (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to gain unauthorized data access or modification and cause partial denial of service, rated CVSS 8.3.
8.3 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle E-Business Suite Integrated SOA Gateway (versions 12.2.3 to 12.2.15) allows low-privileged attackers with HTTP network access to potentially compromise system confidentiality, integrity, and availability, rated CVSS 8.8.
8.8 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle E-Business Suite Integrated SOA Gateway (versions 12.2.3 to 12.2.15) allows low-privileged attackers with HTTP network access to potentially compromise system confidentiality, integrity, and availability, rated CVSS 8.8.
8.8 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle E-Business Suite Integrated SOA Gateway (versions 12.2.3-12.2.15) allows unauthenticated attackers to access sensitive data via HTTP, with a CVSS 3.1 base score of 8.6.
8.6 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle E-Business Suite Integrated SOA Gateway (versions 12.2.3-12.2.15) allows unauthenticated attackers to gain unauthorized access and modify sensitive data via HTTP, with a CVSS 3.1 base score of 8.2.
8.2 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle Mobile Field Service (versions 12.2.3-12.2.15) allows a low-privileged attacker with network HTTP access to fully compromise the system, with a CVSS 3.1 base score of 8.8 indicating high impact.
8.8 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A high-severity vulnerability in Oracle Application Object Library versions 12.2.3 to 12.2.15 allows unauthenticated remote attackers to compromise system confidentiality, integrity, and availability via HTTP, with a CVSS score of 8.1.
8.1 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A high-severity vulnerability in Oracle Concurrent Processing (versions 12.2.3-12.2.15) enables a high-privileged attacker with infrastructure access to fully compromise the component, risking confidentiality, integrity, and availability.
8.2 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle Applications Manager versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle Application Object Library versions 12.2.3 to 12.2.15 allows unauthenticated remote attackers to fully compromise systems via HTTP, with a CVSS 3.1 base score of 9.8 indicating severe impact on confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle E-Business Suite Product Workbench (12.2.3-12.2.15) allows unauthenticated remote attackers to create, delete, or modify critical data via HTTP, with a CVSS 3.1 score of 9.1 indicating high confidentiality and integrity impact.
9.1 (Critical)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical unauthenticated remote code execution vulnerability in Oracle E-Business Suite Workflow Notification Mailer (versions 12.2.3-12.2.15) has a CVSS 3.1 base score of 10.0, severely impacting confidentiality, integrity, and availability.
10.0 (Critical)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle E-Business Suite Engineering component versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated CVSS 3.1 base score 8.8.
8.8 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A high-severity vulnerability (CVSS 8.7) in Oracle E-Business Suite Document Management and Collaboration (versions 12.2.3-12.2.15) allows low-privileged attackers with network access and user interaction to manipulate critical data.
8.7 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A vulnerability in Oracle E-Business Suite Oracle Quality (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 score of 8.1.
8.1 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle Shipping Execution versions 12.2.3 through 12.2.15 allows unauthenticated remote attackers to potentially gain full system control via HTTP, with a CVSS 3.1 base score of 8.1.
8.1 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A vulnerability in Oracle E-Business Suite Global Order Promising (versions 12.2.3-12.2.15) allows low-privileged network attackers to create, delete, or modify critical data, impacting confidentiality and integrity with a CVSS score of 8.2.
8.2 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle E-Business Suite Strategic Network Optimization (versions 12.2.3 to 12.2.15) allows unauthenticated HTTP attackers to potentially compromise system confidentiality, integrity, and availability with a CVSS 3.1 score of 8.8.
8.8 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, with a CVSS 3.1 score of 8.8.
8.8 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, with a CVSS 3.1 score of 8.8.
8.8 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
A critical vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, with a CVSS 3.1 score of 8.8.
8.8 (High)
Affected products
Known affected
1 product, the same list as for
CVE-2026-83361
References
44 references
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Oracle heeft 194 kwetsbaarheden verholpen in Oracle E-Business Suite en gerelateerde componenten, specifiek voor versies 12.2.3 tot en met 12.2.15.",
"title": "Feiten"
},
{
"category": "description",
"text": "Afhankelijk van de specifieke kwetsbaarheid kunnen deze door een aanvaller met netwerktoegang worden misbruikt om ongeautoriseerde toegang tot gegevens te verkrijgen of om gegevens aan te maken, in te zien, te wijzigen of te verwijderen. In ernstige gevallen kan misbruik leiden tot Remote Code Execution (RCE), waardoor een aanvaller willekeurige code kan uitvoeren op het getroffen systeem.\n\nEen deel van de kwetsbaarheden kan op afstand worden misbruikt zonder authenticatie. Voor andere kwetsbaarheden zijn geldige inloggegevens, specifieke toegangsrechten of gebruikersinteractie vereist. De impact en de voorwaarden voor misbruik verschillen per kwetsbaarheid en getroffen component. De CVSS 3.1-scores lopen op tot de maximale score van 10,0.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Oracle heeft updates uitgebracht om de kwetsbaarheden in de genoemde versies en componenten van Oracle E-Business Suite te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Missing Authentication for Critical Function",
"title": "CWE-306"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"title": "Kwetsbaarheden verholpen in Oracle E-Business Suite",
"tracking": {
"current_release_date": "2026-10-21T12:33:43.755532Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0442",
"initial_release_date": "2026-10-21T12:33:43.755532Z",
"revision_history": [
{
"date": "2026-10-21T12:33:43.755532Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": " E-Business Suite"
}
],
"category": "vendor",
"name": "Oracle "
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-83361",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Contract Lifecycle Management for Public Sector (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83361 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83361.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-83361"
},
{
"cve": "CVE-2026-83363",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Contract Lifecycle Management for Public Sector (versions 12.2.3-12.2.15) allows a low-privileged attacker with HTTP network access to fully compromise the system, rated CVSS 3.1 8.8 for high impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83363 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83363.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-83363"
},
{
"cve": "CVE-2026-83393",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 of Oracle E-Business Suite allows a low privileged attacker with HTTP network access to potentially compromise confidentiality, integrity, and availability, rated CVSS 3.1 base score 8.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83393 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83393.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-83393"
},
{
"cve": "CVE-2026-87408",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Applications Framework versions 12.2.3 to 12.2.15 allows a low-privileged attacker with network access and user interaction to create, delete, or modify critical data, with a CVSS 3.1 score of 8.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87408 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87408.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-87408"
},
{
"cve": "CVE-2026-91347",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle E-Business Suite iSupport (versions 12.2.3-12.2.15) enables low-privileged attackers with network access to modify, create, delete data, and cause partial denial of service, rated CVSS 8.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91347 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91347.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-91347"
},
{
"cve": "CVE-2026-91506",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle E-Business Suite Workflow Notification Mailer (12.2.3-12.2.15) allows unauthenticated HTTP attackers to potentially compromise the Workflow component, with a CVSS 3.1 score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91506 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91506.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-91506"
},
{
"cve": "CVE-2026-91532",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Applications Manager versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91532 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91532.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-91532"
},
{
"cve": "CVE-2026-101534",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle EDI Gateway versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to gain unauthorized access and modify sensitive data, rated with a CVSS 3.1 base score of 8.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101534 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101534.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101534"
},
{
"cve": "CVE-2026-101542",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle E-Business Suite Oracle Capacity (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to fully compromise the system, rated CVSS 3.1 base score 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101542 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101542.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101542"
},
{
"cve": "CVE-2026-101557",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Purchasing versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8 indicating high impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101557 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101557.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101557"
},
{
"cve": "CVE-2026-101567",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Cost Management versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101567 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101567.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101567"
},
{
"cve": "CVE-2026-101634",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Mobile Field Service versions 12.2.3 to 12.2.15 allows unauthenticated attackers with HTTP network access to gain unauthorized sensitive data access or cause denial of service, rated CVSS 3.1 base score 9.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101634 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101634.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101634"
},
{
"cve": "CVE-2026-101635",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Mobile Field Service (versions 12.2.3 to 12.2.15) allows a low-privileged attacker with network HTTP access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101635 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101635.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101635"
},
{
"cve": "CVE-2026-101640",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Marketing (Oracle E-Business Suite versions 12.2.3-12.2.15) allows unauthenticated remote attackers to gain unauthorized access and modify data, with a CVSS 3.1 base score of 8.2 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101640 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101640.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101640"
},
{
"cve": "CVE-2026-101648",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Partner Management versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized data access, modify critical data, cause partial denial of service, and affect other Oracle products, with a CVSS 3.1 score of 8.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101648 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101648.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101648"
},
{
"cve": "CVE-2026-101653",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Mobile Field Service versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTPS network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101653 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101653.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101653"
},
{
"cve": "CVE-2026-101654",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Mobile Field Service versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTPS network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101654 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101654.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101654"
},
{
"cve": "CVE-2026-101655",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Mobile Field Service (versions 12.2.3 to 12.2.15) allows a low-privileged attacker with network HTTP access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101655 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101655.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101655"
},
{
"cve": "CVE-2026-101656",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Mobile Field Service versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTPS network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101656 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101656.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101656"
},
{
"cve": "CVE-2026-101664",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Mobile Field Service (versions 12.2.3 to 12.2.15) allows a low-privileged attacker with network HTTP access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101664 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101664.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101664"
},
{
"cve": "CVE-2026-101665",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Mobile Field Service versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101665 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101665.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101665"
},
{
"cve": "CVE-2026-101672",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Call Center Technology versions 12.2.3 to 12.2.15 allows unauthenticated remote attackers to potentially compromise system confidentiality, integrity, and availability via RMI access.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101672 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101672.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101672"
},
{
"cve": "CVE-2026-101684",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle E-Business Suite Integrated SOA Gateway (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to gain unauthorized data access or modification and cause partial denial of service, rated CVSS 8.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101684 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101684.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101684"
},
{
"cve": "CVE-2026-101685",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle E-Business Suite Integrated SOA Gateway (versions 12.2.3 to 12.2.15) allows low-privileged attackers with HTTP network access to potentially compromise system confidentiality, integrity, and availability, rated CVSS 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101685 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101685.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101685"
},
{
"cve": "CVE-2026-101686",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle E-Business Suite Integrated SOA Gateway (versions 12.2.3 to 12.2.15) allows low-privileged attackers with HTTP network access to potentially compromise system confidentiality, integrity, and availability, rated CVSS 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101686 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101686.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101686"
},
{
"cve": "CVE-2026-101688",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle E-Business Suite Integrated SOA Gateway (versions 12.2.3-12.2.15) allows unauthenticated attackers to access sensitive data via HTTP, with a CVSS 3.1 base score of 8.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101688 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101688.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101688"
},
{
"cve": "CVE-2026-101690",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle E-Business Suite Integrated SOA Gateway (versions 12.2.3-12.2.15) allows unauthenticated attackers to gain unauthorized access and modify sensitive data via HTTP, with a CVSS 3.1 base score of 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101690 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101690.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101690"
},
{
"cve": "CVE-2026-101692",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Mobile Field Service (versions 12.2.3-12.2.15) allows a low-privileged attacker with network HTTP access to fully compromise the system, with a CVSS 3.1 base score of 8.8 indicating high impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101692 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101692.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101692"
},
{
"cve": "CVE-2026-101700",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Application Object Library versions 12.2.3 to 12.2.15 allows unauthenticated remote attackers to compromise system confidentiality, integrity, and availability via HTTP, with a CVSS score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101700 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101700.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101700"
},
{
"cve": "CVE-2026-101704",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Concurrent Processing (versions 12.2.3-12.2.15) enables a high-privileged attacker with infrastructure access to fully compromise the component, risking confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101704 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101704.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101704"
},
{
"cve": "CVE-2026-101742",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Applications Manager versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101742 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101742.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101742"
},
{
"cve": "CVE-2026-101767",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"notes": [
{
"category": "other",
"text": "Missing Authentication for Critical Function",
"title": "CWE-306"
},
{
"category": "description",
"text": "A critical vulnerability in Oracle Application Object Library versions 12.2.3 to 12.2.15 allows unauthenticated remote attackers to fully compromise systems via HTTP, with a CVSS 3.1 base score of 9.8 indicating severe impact on confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101767 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101767.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101767"
},
{
"cve": "CVE-2026-101808",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"notes": [
{
"category": "other",
"text": "Missing Authentication for Critical Function",
"title": "CWE-306"
},
{
"category": "description",
"text": "A critical vulnerability in Oracle E-Business Suite Product Workbench (12.2.3-12.2.15) allows unauthenticated remote attackers to create, delete, or modify critical data via HTTP, with a CVSS 3.1 score of 9.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101808 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101808.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101808"
},
{
"cve": "CVE-2026-101809",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle E-Business Suite Workflow Notification Mailer (versions 12.2.3-12.2.15) has a CVSS 3.1 base score of 10.0, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101809 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101809.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101809"
},
{
"cve": "CVE-2026-101813",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle E-Business Suite Engineering component versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated CVSS 3.1 base score 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101813 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101813.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101813"
},
{
"cve": "CVE-2026-101824",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability (CVSS 8.7) in Oracle E-Business Suite Document Management and Collaboration (versions 12.2.3-12.2.15) allows low-privileged attackers with network access and user interaction to manipulate critical data.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101824 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101824.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101824"
},
{
"cve": "CVE-2026-101831",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle E-Business Suite Oracle Quality (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101831 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101831.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101831"
},
{
"cve": "CVE-2026-101834",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Shipping Execution versions 12.2.3 through 12.2.15 allows unauthenticated remote attackers to potentially gain full system control via HTTP, with a CVSS 3.1 base score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101834 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101834.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101834"
},
{
"cve": "CVE-2026-101841",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle E-Business Suite Global Order Promising (versions 12.2.3-12.2.15) allows low-privileged network attackers to create, delete, or modify critical data, impacting confidentiality and integrity with a CVSS score of 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101841 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101841.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101841"
},
{
"cve": "CVE-2026-101842",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle E-Business Suite Strategic Network Optimization (versions 12.2.3 to 12.2.15) allows unauthenticated HTTP attackers to potentially compromise system confidentiality, integrity, and availability with a CVSS 3.1 score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101842 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101842.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101842"
},
{
"cve": "CVE-2026-101852",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, with a CVSS 3.1 score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101852 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101852.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101852"
},
{
"cve": "CVE-2026-101853",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, with a CVSS 3.1 score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101853 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101853.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101853"
},
{
"cve": "CVE-2026-101854",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, with a CVSS 3.1 score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101854 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101854.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1"
]
}
],
"title": "CVE-2026-101854"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.