Oracle
Vulnerability activity for Oracle: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 519
- Critical (CVSS 9+)
- 25
- Exploited (CISA KEV)
- 0
- With exploit code
- 1
Last 90 days
- CVEs
- 522
- Critical (CVSS 9+)
- 26
- Exploited (CISA KEV)
- 1
- With exploit code
- 2
Last 365 days
- CVEs
- 682
- Critical (CVSS 9+)
- 69
- Exploited (CISA KEV)
- 5
- With exploit code
- 4
Next expected patch release
Oracle Critical Patch Update
Jan 19, 2027, in 82 days
Expected from the vendor's usual schedule; vendors can shift dates.
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 10.0CriticalAug 24, 2026HTTP Server and Oracle Weblogic Server Proxy Plug-in Auth bypass / access controlCVE-2026-21962Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in. An attacker gains remote code execution. Patch Oracle HTTP Server and Oracle Weblogic Server to the latest version.Added to KEV Aug 24, 2026Exploited73% likelyExploit codeDetection
- 9.8CriticalJul 15, 2026Oracle E-Business Suite Privilege escalationCVE-2026-46817Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.Added to KEV Jul 15, 2026Exploited12% likely
- 9.8CriticalJun 12, 2026Oracle PeopleSoft Enterprise PeopleTools Auth bypass / access controlCVE-2026-35273Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.Added to KEV Jun 12, 2026Exploited97% likelyExploit codeNucleiDetection
- 7.5HighJun 1, 2026Oracle WebLogic ServerCVE-2024-21182Oracle WebLogic Server. An attacker gains remote code execution and unauthorized access to sensitive data. Patch Oracle WebLogic Server to the latest version and restrict network access to the server.Added to KEV Jun 1, 2026Exploited74% likely
- 9.8CriticalNov 21, 2025Oracle Fusion Middleware Auth bypass / access controlCVE-2025-61757Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.Added to KEV Nov 21, 2025Exploited89% likelyExploit codeNucleiDetection
- 7.5HighOct 12, 2025Oracle E-Business Suite SSRFCVE-2025-61884Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.Added to KEV Oct 20, 2025 · 8 days after publicationExploited96% likelyExploit codeNucleiDetection
- 9.8CriticalOct 5, 2025Oracle E-Business Suite Auth bypass / access controlCVE-2025-61882Oracle E-Business Suite contains an unspecified vulnerability in the BI Publisher Integration component. The vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks can result in takeover of Oracle Concurrent Processing.Added to KEV Oct 6, 2025 · 1 day after publicationExploited100% likelyExploit codeMetasploit · NucleiDetection
- 8.8HighFeb 17, 2024Oracle Agile Product Lifecycle Management (PLM) DeserializationCVE-2024-20953Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system.Added to KEV Feb 24, 2025 · 373 days after publicationExploited3.9% likely
- 9.8CriticalApr 15, 2020Oracle WebLogic ServerCVE-2020-2883Oracle WebLogic Server is affected. An attacker gains remote code execution and potentially full control of the server. Apply the latest patches from Oracle and ensure WebLogic Server is not exposed to the internet.Added to KEV Jan 7, 2025 · 1,727 days after publicationExploited95% likelyExploit codeMetasploit · NucleiDetection
- 7.5HighNov 18, 2024Oracle Agile Product Lifecycle Management (PLM) Auth bypass / access controlCVE-2024-21287Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure.Added to KEV Nov 21, 2024 · 2 days after publicationExploited1.7% likely
- 9.8CriticalApr 19, 2022Oracle ADF Faces DeserializationCVE-2022-21445Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution.Added to KEV Sep 18, 2024 · 882 days after publicationExploited62% likely
- 9.8CriticalJul 15, 2020Oracle WebLogic Server Code / command injectionCVE-2020-14644Oracle WebLogic Server, Remote code execution, Apply Oracle WebLogic Server 12.2.1.4.21 or later patches.Added to KEV Sep 18, 2024 · 1,525 days after publicationExploited95% likelyExploit codeNucleiDetection
- 7.4HighApr 24, 2017Oracle WebLogic Server Code / command injectionCVE-2017-3506Oracle WebLogic Server is affected. An attacker gains OS command execution and potentially remote code execution. Patch Oracle WebLogic Server to version 12.2.1.3.0 or later.Added to KEV Jun 3, 2024 · 2,596 days after publicationExploited96% likelyExploit codeNucleiDetection
- 9.8CriticalJan 15, 2020Oracle Fusion MiddlewareCVE-2020-2551Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core Components that allows an unauthenticated attacker with network access via IIOP to compromise the WebLogic Server.Added to KEV Nov 16, 2023 · 1,400 days after publicationExploited93% likelyExploit codeNucleiDetection
- 9.8CriticalApr 21, 2016Oracle Java SE and JRockit Auth bypass / access controlCVE-2016-3427Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.Added to KEV May 12, 2023 · 2,577 days after publicationExploited92% likelyExploit code
- 7.5HighJan 17, 2023Oracle WebLogic Server Auth bypass / access controlCVE-2023-21839Oracle WebLogic Server is affected. An attacker gains remote code execution and unauthorized access to sensitive data. Apply the latest patches and updates from Oracle to remediate the vulnerability.Added to KEV May 1, 2023 · 103 days after publicationExploited100% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalOct 18, 2022Oracle E-Business Suite Auth bypass / access controlCVE-2022-21587Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.Added to KEV Feb 2, 2023 · 107 days after publicationExploited98% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalJan 19, 2022Oracle Fusion Middleware DeserializationCVE-2021-35587Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.Added to KEV Nov 28, 2022 · 313 days after publicationExploited96% likelyExploit codeMetasploit · NucleiDetection
- 9.8CriticalApr 19, 2018Oracle WebLogic Server DeserializationCVE-2018-2628Oracle WebLogic Server is affected, an attacker gains remote code execution, patch Oracle WebLogic Server to version 12.2.1.3.16 or later.Added to KEV Sep 8, 2022 · 1,603 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 9.8CriticalApr 1, 2010Oracle Java Runtime Environment (JRE)CVE-2010-0840Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors.Added to KEV May 25, 2022 · 4,436 days after publicationExploited96% likelyExploit codeExploit-DB · Metasploit
- 9.8CriticalMay 3, 2012Oracle Fusion MiddlewareCVE-2012-1710Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Designer.Added to KEV May 25, 2022 · 3,673 days after publicationExploited7.8% likely
- 9.8CriticalJan 10, 2013Oracle Java Runtime Environment (JRE) Privilege escalationCVE-2013-0422A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system.Added to KEV May 25, 2022 · 3,421 days after publicationExploited97% likelyExploit codeExploit-DB · Metasploit
- 3.7LowJan 31, 2013Oracle Java Runtime Environment (JRE)CVE-2013-0431Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox.Added to KEV May 25, 2022 · 3,400 days after publicationExploited90% likelyExploit codeExploit-DB · Metasploit
- 3.7LowApr 17, 2013Oracle Java Runtime Environment (JRE) Auth bypass / access controlCVE-2013-2423Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity.Added to KEV May 25, 2022 · 3,324 days after publicationExploited85% likelyExploit codeExploit-DB · Metasploit
- 8.8HighOct 16, 2019Oracle Solaris Privilege escalationCVE-2019-3010Oracle Solaris component: XScreenSaver contains an unspecified vulnerability that allows for privilege escalation.Added to KEV May 25, 2022 · 951 days after publicationExploited13% likelyExploit codeExploit-DB · Metasploit
Recent
- 9.1CriticalOct 24, 2026Oracle Java SE Crypto / certificateCVE-2026-114820Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols toExploit code
- 9.1CriticalOct 21, 2026Oracle Java SE Auth bypass / access controlCVE-2026-91403Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; Oracle GraalVM for JDK: 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition: 21.3.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle Graal
- –UnscoredOct 21, 2026OracleADV-cccs-991d9b5f2ac2Serial Number: AV26-1071 Date: October 20, 2026 As of October 20, 2026, Oracle Corporation is affected by vulnerabilities in the following products: Helidon JD Edwards EnterpriseOne Configurator JD Edwards EnterpriseOne General Ledger JD Edwards EnterpriseOne Homebuilder JD Edwards EnterpriseOne Human Resources Management JD Edwards EnterpriseOne Localizations JD Edwards EnterpriseOne Operational Sourcing JD Edwards EnterpriseOne Orchestrator JD Edwards EnterpriseOne Sales Order Entry JD Edwards
- 8.8HighOct 20, 2026Oracle Data Integrator Privilege escalationCVE-2026-91668Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Data Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector:
- 7.5HighOct 20, 2026Oracle essbase Denial of serviceCVE-2026-91664Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- 9.9CriticalOct 20, 2026Oracle Essbase Auth bypass / access controlCVE-2026-91663Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availa
- 6.4MediumOct 20, 2026Oracle essbase Auth bypass / access controlCVE-2026-91662Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete
- 7.7HighOct 20, 2026Oracle essbase Information disclosureCVE-2026-91661Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data
- 4.3MediumOct 20, 2026Oracle essbase Denial of serviceCVE-2026-91660Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
- 7.7HighOct 20, 2026Oracle essbase Auth bypass / access controlCVE-2026-91659Vulnerability in Oracle Essbase (component: Build). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data. C
- 9.9CriticalOct 20, 2026Oracle Essbase Auth bypass / access controlCVE-2026-91658Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availabili
- 4.3MediumOct 20, 2026Oracle essbase Information disclosureCVE-2026-91657Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
- 9.1CriticalOct 20, 2026Oracle essbase Auth bypass / access controlCVE-2026-91656Vulnerability in Oracle Essbase (component: Federated Partitions). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase acc
- 9.1CriticalOct 20, 2026Oracle essbaseCVE-2026-91655Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data
- 6.3MediumOct 20, 2026Oracle essbaseCVE-2026-91654Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Essbase accessible data as well as unauthorized read access to a subset of Oracle Essbase accessible data and unauthorized ability to cause a par
- 8.5HighOct 20, 2026Oracle EssbaseCVE-2026-91653Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase acc
- 5.0MediumOct 20, 2026Oracle essbaseCVE-2026-91652Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5
- 8.5HighOct 20, 2026Oracle Essbase Auth bypass / access controlCVE-2026-91651Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity
- 3.7LowOct 20, 2026Oracle essbaseCVE-2026-91650Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
- 6.0MediumOct 20, 2026Oracle essbaseCVE-2026-91649Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete a
- 5.3MediumOct 20, 2026Oracle essbaseCVE-2026-91648Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
- 8.1HighOct 20, 2026Oracle Essbase Auth bypass / access controlCVE-2026-91647Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
- 5.6MediumOct 20, 2026Oracle essbase Auth bypass / access controlCVE-2026-91646Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Essbase accessible data as well as unauthorized read access to a subset of Oracle Essbase accessible data and unauthorized ability to caus
- 5.3MediumOct 20, 2026Oracle essbase Information disclosureCVE-2026-91645Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
- 9.3CriticalOct 20, 2026Oracle essbase Auth bypass / access controlCVE-2026-91644Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible dat
- 5.3MediumOct 20, 2026Oracle essbase Information disclosureCVE-2026-91643Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
- 7.3HighOct 20, 2026Oracle essbase Auth bypass / access controlCVE-2026-91642Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Essbase accessible data as well as unauthorized read access to a subset of Oracle Essbase accessible data and unauthorized ability to cause a pa
- 5.0MediumOct 20, 2026Oracle essbase Information disclosureCVE-2026-91641Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5
- 5.0MediumOct 20, 2026Oracle essbase Information disclosureCVE-2026-91640Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5
- 7.7HighOct 20, 2026Oracle essbase Information disclosureCVE-2026-91639Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data
- 9.9CriticalOct 20, 2026Oracle Essbase Auth bypass / access controlCVE-2026-91638Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availabili
- 9.9CriticalOct 20, 2026Oracle Essbase Auth bypass / access controlCVE-2026-91637Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availabili
- 7.7HighOct 20, 2026Oracle essbase Information disclosureCVE-2026-91636Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data
- 8.1HighOct 20, 2026Oracle Essbase Auth bypass / access controlCVE-2026-91635Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
- 5.3MediumOct 20, 2026Oracle essbase Information disclosureCVE-2026-91634Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
- 6.0MediumOct 20, 2026Oracle essbase Auth bypass / access controlCVE-2026-91633Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to
- 7.7HighOct 20, 2026Oracle essbase Information disclosureCVE-2026-91632Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data
- 5.0MediumOct 20, 2026Oracle essbase Information disclosureCVE-2026-91631Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5
- 6.8MediumOct 20, 2026Oracle essbase Information disclosureCVE-2026-91630Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible dat
- 4.7MediumOct 20, 2026Oracle Communications Billing and Revenue Management Information disclosureCVE-2026-91629Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability
- 5.5MediumOct 20, 2026Oracle Communications Billing and Revenue Management Information disclosureCVE-2026-91628Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability
- 4.3MediumOct 20, 2026Oracle Business Intelligence Enterprise Edition Information disclosureCVE-2026-91598Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Majel Mobile Service). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Business Intelligence Enterprise Editi
- 8.3HighOct 20, 2026Oracle Business Intelligence Enterprise Edition Auth bypass / access controlCVE-2026-91597Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is i
- 5.4MediumOct 20, 2026Oracle BI Publisher Auth bypass / access controlCVE-2026-91590Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are 8.2.0.0.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope chan
- 6.5MediumOct 20, 2026Oracle Business Intelligence Enterprise Edition Auth bypass / access controlCVE-2026-91588Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). Supported versions that are affected are 8.2.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized
- 3.7LowOct 20, 2026Oracle Business Intelligence Enterprise Edition Denial of serviceCVE-2026-91582Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business Intelligence Ente
- 8.8HighOct 20, 2026Oracle BI PublisherCVE-2026-91579Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Bas
- 6.4MediumOct 20, 2026Oracle Business Intelligence Enterprise Edition Auth bypass / access controlCVE-2026-91577Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Succes
- 6.5MediumOct 20, 2026Oracle Business Intelligence Enterprise Edition Auth bypass / access controlCVE-2026-91576Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise
- 6.5MediumOct 20, 2026Oracle BI Publisher Auth bypass / access controlCVE-2026-91574Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Publisher Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 6.5 (Con
Top products
- PeopleSoft Enterprise PeopleTools66 CVEs in the last year, 2 critical, 1 exploited
- JD Edwards EnterpriseOne Tools51 CVEs in the last year
- coherence50 CVEs in the last year, 33 critical
- Oracle Java SE32 CVEs in the last year, 2 critical
- essbase27 CVEs in the last year, 3 critical
- Siebel CRM Deployment25 CVEs in the last year
- E-Business Suite22 CVEs in the last year, 1 critical, 1 exploited
- Oracle Outside In Technology19 CVEs in the last year, 1 critical
- Oracle Business Intelligence Enterprise Edition15 CVEs in the last year, 1 critical
- Oracle WebCenter Content13 CVEs in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- Oracle · Oct 24, 2026Oracle Security Alert for CVE-2026-114820CVE-2026-114820
- Oracle · Oct 21, 2026Oracle Security Alert Advisory - CVE-2026-91403CVE-2026-91403
- CCCS (Canada) · Oct 21, 2026Oracle Corporation security advisory (AV26-1071)ADV-cccs-991d9b5f2ac2
- Oracle · Oct 20, 2026Oracle Critical Security Patch Update Advisory - October 2026ADV-oracle-6f3b038106f8
- Oracle · Sep 15, 2026Oracle Critical Security Patch Update Advisory - September 2026ADV-oracle-9bb13b6ee235
- Oracle · Aug 18, 2026Oracle Critical Security Patch Update Advisory - August 2026ADV-oracle-9283aa7d0d3b
- Oracle · Jul 21, 2026Oracle Critical Patch Update Advisory - July 2026ADV-oracle-e996089f2e77
- Oracle · Jun 16, 2026Oracle Critical Security Patch Update Advisory - June 2026ADV-oracle-ab78697f1277
- Oracle · Jun 11, 2026Oracle Security Alert Advisory - CVE-2026-35273CVE-2026-35273
- Oracle · May 28, 2026Oracle Critical Security Patch Update Advisory - May 2026ADV-oracle-ece6a720da26
- Oracle · Apr 21, 2026Oracle Critical Patch Update Advisory - April 2026ADV-oracle-e201ed544fe3
- Oracle · Mar 20, 2026Oracle Security Alert for CVE-2026-21992 - 19 March 2026CVE-2026-21992
- Oracle · Jan 20, 2026Oracle Critical Patch Update Advisory - January 2026ADV-oracle-2d8982cc031f
- Oracle · Oct 21, 2025Oracle Critical Patch Update Advisory - October 2025ADV-oracle-4a91c1c37b88
- Oracle · Oct 12, 2025Oracle Security Alert for CVE-2025-61884 - 11 October 2025CVE-2025-61884
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.