Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-91219 is a high-severity vulnerability in Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to compromise the product, potentially gaining unauthorized access to critical or all accessible data. The vulnerability impacts confidentiality but does not affect integrity or availability. Oracle has released patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update.
CVE-2026-91218 is a critical vulnerability in Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 base score of 9.6, indicating high confidentiality and integrity impacts. Attacks exploiting this flaw may also affect additional Oracle products due to scope change. Oracle has released security patches addressing this and many other vulnerabilities in its October 2026 Critical Patch Update advisory.
CVE-2026-91217 is a high-severity vulnerability in Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via HTTP to compromise the product, potentially gaining unauthorized access to critical or all accessible data within Oracle SOA Suite. The vulnerability has a CVSS 3.1 base score of 8.6, indicating significant confidentiality impact with no required privileges or user interaction. Oracle has published a Critical Patch Update addressing this and many other vulnerabilities.
CVE-2026-91216 is a critical vulnerability in Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access via T3 or IIOP protocols to fully compromise the Oracle SOA Suite, potentially impacting additional Oracle products. The vulnerability has a CVSS 3.1 base score of 10.0, indicating severe confidentiality, integrity, and availability impacts.
CVE-2026-91215 is a high-severity vulnerability in Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The vulnerability affects confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8. Oracle has released patches for this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-91213 is a high-severity vulnerability in Oracle Business Process Management Suite versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the suite, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has included this fix in its October 2026 Critical Patch Update, which contains numerous security patches across multiple products.
CVE-2026-91212 is a high-severity vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0. It allows an unauthenticated attacker with network access via HTTP to compromise the product, potentially leading to unauthorized access to critical or all accessible data. The vulnerability affects the Generic REST component and has a CVSS 3.1 base score of 8.6, indicating a significant confidentiality impact. The vulnerability's exploitation scope may extend to additional Oracle products. Oracle has published a Critical Patch Update advisory addressing this and other vulnerabilities.
CVE-2026-91211 is a high-severity vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0. It allows a high privileged attacker with network access via SOAP to compromise the product, potentially impacting additional Oracle products. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data accessible by the connector. The vulnerability has a CVSS 3.1 base score of 8.7, indicating significant confidentiality and integrity impacts without availability impact.
CVE-2026-91210 is a vulnerability in Oracle WebCenter Content 14.1.2.0.0 that allows a low privileged attacker with network access via HTTP to compromise the product. Exploitation is difficult and requires user interaction from someone other than the attacker. Successful exploitation can lead to unauthorized access to critical data and unauthorized modification of some data within Oracle WebCenter Content. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity with high confidentiality impact and low integrity impact. Oracle has published a Critical Patch Update advisory including patches for this and other vulnerabilities.
CVE-2026-91209 is a vulnerability in Oracle Solaris 11.4 affecting the X Window System component. It allows a low privileged attacker with logon access to the infrastructure to compromise Oracle Solaris. Exploitation requires human interaction from a person other than the attacker. Successful exploitation can lead to unauthorized read, update, insert, or delete access to some Oracle Solaris accessible data and can cause a partial denial of service. The CVSS 3.1 base score is 4.2, indicating a medium severity level.
CVE-2026-91208 is a vulnerability in Oracle Solaris 11.4 that allows an unauthenticated attacker with logon access to the infrastructure to cause a hang or repeated crash, resulting in a denial of service. The vulnerability is difficult to exploit and impacts availability without affecting confidentiality or integrity. The CVSS 3.1 base score is 5.1, indicating a medium severity. Oracle has published a Critical Patch Update advisory that includes patches for multiple vulnerabilities, including this one.
Vulnerability in the Oracle Solaris product of Oracle Systems (component: X Window System). The supported version that is affected is 11.4. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Solaris accessible data as well as unauthorized read access to a subset of Oracle Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Solaris. CVSS 3.1 Base Score 4.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L).
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The supported version that is affected is 11.4. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Solaris accessible data. CVSS 3.1 Base Score 2.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Solaris accessible data as well as unauthorized update, insert or delete access to some of Oracle Solaris accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N).
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 2.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Solaris accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).