CVE-2026-83374 is a vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition affecting specific versions. It allows an unauthenticated attacker with network access via multiple protocols to potentially create, delete, or modify critical data accessible by these products. The vulnerability involves APIs in the security component and can be exploited through web services or sandboxed Java applications that run untrusted code. The CVSS 3.1 base score is 5.9, indicating a medium severity with integrity impact but no confidentiality or availability impact. Oracle has released patches as part of its October 2026 Critical Patch Update, and customers are strongly advised to apply these patches promptly.
CVE-2026-83373 is a low-severity vulnerability in Oracle PeopleSoft Enterprise PeopleTools Portal component versions 8.61 through 8.63. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools data. Exploitation requires human interaction from a user other than the attacker and is considered difficult. The vulnerability has a CVSS 3.1 base score of 3.0, indicating limited confidentiality impact without integrity or availability effects. Oracle has published a Critical Patch Update advisory that includes patches for multiple products, including PeopleSoft Enterprise PeopleTools. Users are strongly advised to apply the relevant patches promptly to mitigate this vulnerability.
CVE-2026-83372 is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools Portal component affecting versions 8.61 through 8.63. It allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible data, as well as unauthorized read access to some data. Successful exploitation requires user interaction from a person other than the attacker and may impact additional products beyond PeopleTools. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity with confidentiality and integrity impacts. Oracle has released security patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.
CVE-2026-83371 is a medium severity vulnerability in Oracle HRMS (UK) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, delete, and read operations on accessible data. Successful exploitation requires human interaction from a third party. The vulnerability has a CVSS 3.1 base score of 5.4, indicating limited confidentiality and integrity impact without availability impact. Oracle has released patches addressing this and other vulnerabilities in their October 2026 Critical Patch Update advisory.
CVE-2026-83370 is a vulnerability in the Oracle E-Business Suite Sourcing product (component: Auctions) affecting versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to potentially take over the Sourcing component. The vulnerability is rated high severity with a CVSS 3.1 base score of 7.5, impacting confidentiality, integrity, and availability.
CVE-2026-83367 is a vulnerability in Oracle Shipping Execution, part of Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. It allows an unauthenticated attacker with network access via Oracle Net to potentially compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, or unauthorized access to all data accessible by Oracle Shipping Execution. The vulnerability has a CVSS 3.1 base score of 7.4, indicating high severity with significant confidentiality and integrity impacts. Oracle has released patches for this vulnerability in their October 2026 Critical Patch Update advisory.
CVE-2026-83366 is a vulnerability in Oracle Shipping Execution, part of Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. It allows an unauthenticated attacker with network access via HTTP to potentially create, delete, or modify critical data or gain unauthorized access to all accessible data within Oracle Shipping Execution. The vulnerability is rated with a CVSS 3.1 base score of 7.4, indicating high severity with impacts on confidentiality and integrity. Exploitation is considered difficult due to the high attack complexity. Oracle has released patches for this vulnerability as part of its October 2026 Critical Patch Update. Users are strongly advised to apply these patches promptly to mitigate risk.
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector. Successful attacks of this vulnerability can result in takeover of Oracle Contract Lifecycle Management for Public Sector. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-83361 is a high-severity vulnerability in Oracle Contract Lifecycle Management for Public Sector versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized creation, deletion, or modification access to critical data. The vulnerability impacts confidentiality and integrity but not availability. Oracle has released a Critical Patch Update addressing this and many other vulnerabilities in October 2026.
CVE-2026-83360 is a vulnerability in Oracle HRMS (Republic of Korea) component of Oracle E-Business Suite Korean Payroll. It affects versions 12.2.3 through 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within Oracle HRMS. The CVSS 3.1 base score is 6.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Oracle has published a Critical Patch Update advisory referencing this vulnerability.
CVE-2026-83359 is a vulnerability in the Oracle HRMS (India) component of Oracle E-Business Suite Indian Payroll. It affects versions 12.2.3 through 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within Oracle HRMS (India). The CVSS 3.1 base score is 6.5, indicating a medium severity with a high confidentiality impact but no integrity or availability impact.
CVE-2026-83358 is a vulnerability in Oracle HRMS (Norway) component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within Oracle HRMS (Norway). The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no impact on integrity or availability.
CVE-2026-83139 is a vulnerability in Oracle Order Management within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data in Oracle Order Management. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity focused on confidentiality impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.
CVE-2026-73964 is a vulnerability in the Oracle Database Server RDBMS component affecting versions 19.3 through 19.32 and 21.3 through 21.23. It allows a high privileged attacker with Query Optimizer privilege and network access via Oracle Net to gain unauthorized read access to a subset of RDBMS accessible data. The vulnerability has a low CVSS score of 2.7, indicating limited confidentiality impact without integrity or availability effects. Oracle has released patches addressing this vulnerability as part of their October 2026 Critical Patch Update.
CVE-2026-70869 is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools Integration Broker component affecting versions 8.61 through 8.63. It allows an unauthenticated attacker with network access via HTTP to potentially compromise the system, but exploitation is difficult and requires human interaction from a user other than the attacker. Successful exploitation can lead to unauthorized update, insert, or delete operations, as well as unauthorized read access to some accessible data. The vulnerability has a CVSS 3.1 base score of 4.7, indicating medium severity with limited confidentiality and integrity impacts and no availability impact.
CVE-2026-70860 is a vulnerability in Oracle PeopleSoft Enterprise FIN Common Objects Argentina version 9.1. It allows a low privileged attacker with network access via HTTP to perform unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to some data. The vulnerability is difficult to exploit and has a medium severity with a CVSS 3.1 base score of 5.9. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, indicating that patches are available.
CVE-2026-60968 is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63. It allows a high privileged attacker with logon access to the infrastructure to compromise the PeopleTools environment. Exploitation can lead to unauthorized creation, deletion, or modification of critical or accessible data, and can cause a hang or repeated crash resulting in denial of service. The vulnerability has a CVSS 3.1 base score of 6.0, indicating medium severity with impacts on integrity and availability.
CVE-2026-60964 is a low-severity vulnerability in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. It involves the Open Query component and requires a high-privileged attacker with logon access to the infrastructure where PeopleTools executes. Successful exploitation can lead to unauthorized read access to a subset of accessible PeopleTools data. The vulnerability is difficult to exploit and does not impact integrity or availability.
CVE-2026-60887 is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools Data Mover component affecting versions 8.61 through 8.63. It requires a high privileged attacker with logon access to the infrastructure and human interaction from another user to exploit. Successful exploitation can lead to unauthorized read, update, insert, or delete access to some PeopleSoft Enterprise PeopleTools data and may cause a partial denial of service. The CVSS 3.1 base score is 3.8, indicating a low severity impact.
CVE-2026-60885 is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools, specifically in the Push Notifications component. It affects versions 8.61 and 8.62. The flaw allows a high privileged attacker with access to the physical communication segment attached to the hardware running PeopleTools to compromise the system, potentially leading to full takeover. The CVSS 3.1 base score is 6.8, indicating a medium severity with impacts on confidentiality, integrity, and availability.
