CVE-2026-91357 is a vulnerability in Oracle Order Management within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to potentially gain unauthorized access to critical data. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.3, primarily impacting confidentiality. Exploitation is considered difficult due to the high attack complexity and requires no user interaction. Oracle has released patches as part of its October 2026 Critical Patch Update.
CVE-2026-91321 is a vulnerability in Oracle E-Business Suite's iProcurement component (Requisition Management) affecting versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to potentially take over the iProcurement application. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has released patches for this vulnerability as part of its October 2026 Critical Patch Update.
CVE-2026-91243 is a critical vulnerability in Oracle Business Process Management Suite versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 base score of 9.6, indicating high confidentiality and integrity impacts without affecting availability.
CVE-2026-91222 is a critical vulnerability in Oracle Business Process Management Suite versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via SOAP to compromise the product, potentially leading to full takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 9.9. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, indicating patches are available.
Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite. Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-91213 is a high-severity vulnerability in Oracle Business Process Management Suite versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to fully compromise the affected system, impacting confidentiality, integrity, and availability. The vulnerability is easily exploitable and can lead to complete takeover of the Oracle Business Process Management Suite instance.
CVE-2026-87389 is a vulnerability in Oracle JD Edwards EnterpriseOne Human Resources Management version 9.2. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible data. The vulnerability is difficult to exploit and impacts data integrity without affecting confidentiality or availability. The CVSS 3.1 base score is 3.7, indicating a low severity risk. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory and provides patches for affected products.
CVE-2026-87385 is a vulnerability in Oracle JD Edwards EnterpriseOne Human Resources Management version 9.2. It allows an unauthenticated attacker with network access via JDENET to perform unauthorized read and write operations on accessible data. The vulnerability has a CVSS 3.1 base score of 4.8, indicating medium severity with impacts on confidentiality and integrity but no impact on availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update, which provides patches for affected products including JD Edwards EnterpriseOne Human Resources Management 9.2.
CVE-2026-87384 is a vulnerability in Oracle JD Edwards EnterpriseOne Human Resources Management version 9.2. It allows a low privileged attacker with network access via JDENET to perform unauthorized update, insert, or delete operations on accessible data and cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity with impacts on integrity and availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, indicating that patches are available.
CVE-2026-87297 is a vulnerability in Oracle Communications Billing and Revenue Management versions 15.0.0.0.0 through 15.2.0.0.0. It allows a high privileged attacker with logon access to the infrastructure to compromise the product, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 6.7, indicating a medium severity with high impact on confidentiality, integrity, and availability.
A vulnerability in Oracle Communications Billing and Revenue Management versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0 allows a high privileged attacker with logon access to the infrastructure to compromise the product. The vulnerability has a CVSS 3.1 base score of 6.7, indicating a medium severity with high confidentiality, integrity, and availability impacts. Successful exploitation can lead to full takeover of the affected system.
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector. Successful attacks of this vulnerability can result in takeover of Oracle Contract Lifecycle Management for Public Sector. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Contract Lifecycle Management for Public Sector accessible data as well as unauthorized access to critical data or complete access to all Oracle Contract Lifecycle Management for Public Sector accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVE-2026-83139 is a vulnerability in Oracle Order Management within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with a high confidentiality impact but no integrity or availability impact. Oracle has released a Critical Patch Update addressing this and many other vulnerabilities, strongly recommending customers apply patches promptly.
CVE-2026-60968 is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools (versions 8.61 to 8.63) affecting the Updates Environment Management component. It allows a high privileged attacker with logon access to the infrastructure to compromise PeopleSoft Enterprise PeopleTools. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or accessible data, and can cause a denial of service through hangs or repeated crashes. The CVSS 3.1 base score is 6.0, indicating a medium severity with impacts on integrity and availability.
CVE-2026-60746 is a vulnerability in Oracle Order Management within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to potentially gain unauthorized access to critical data and perform unauthorized update, insert, or delete operations on accessible data. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.9, reflecting high confidentiality impact and low integrity impact. Oracle has released security patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update.
CVE-2026-101857 is a vulnerability in Oracle Order Management within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous patches across many products. However, no specific patch link for this vulnerability was provided in the advisory content.
CVE-2026-101856 is a vulnerability in Oracle Order Management within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no impact on integrity or availability. Oracle has released security patches as part of their October 2026 Critical Patch Update to address this and other vulnerabilities.
A vulnerability in Oracle Contract Lifecycle Management for Public Sector (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a high privileged attacker with network access via HTTP to compromise the product. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity with impacts on confidentiality, integrity, and availability. Successful exploitation can lead to full takeover of the affected system.
CVE-2026-101832 is a vulnerability in Oracle Order Management within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no impact on integrity or availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous patches across multiple products.