A vulnerability in Oracle Contract Lifecycle Management for Public Sector (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a high privileged attacker with network access via HTTP to compromise the product. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity with impacts on confidentiality, integrity, and availability. Successful exploitation can lead to full takeover of the affected system.
CVE-2026-101832 is a vulnerability in Oracle Order Management within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no impact on integrity or availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous patches across multiple products.
A vulnerability in Oracle E-Business Suite's Document Management and Collaboration component (versions 12.2.3 through 12.2.15) allows a low privileged attacker with network access via HTTP to compromise the system. Exploitation requires user interaction by someone other than the attacker. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Document Management and Collaboration, with potential impact extending to additional products. The vulnerability has a CVSS 3.1 base score of 8.7, indicating high severity with significant confidentiality and integrity impacts.
CVE-2026-101807 is a vulnerability in Oracle Communications Billing and Revenue Management versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized read and write operations on accessible data. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.8, indicating limited confidentiality and integrity impacts. Exploitation is considered difficult due to high attack complexity. Oracle has released a Critical Patch Update addressing this and many other vulnerabilities, and customers are strongly advised to apply patches promptly.
Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Communications Billing and Revenue Management accessible data as well as unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
A vulnerability in Oracle Communications Billing and Revenue Management versions 15.0.0.0.0 through 15.2.0.0.0 allows a low privileged attacker with logon access to the infrastructure to compromise the system. The vulnerability can lead to unauthorized access to critical data. The CVSS 3.1 base score is 5.5, indicating a medium severity with high confidentiality impact but no impact on integrity or availability.
CVE-2026-101759 is a high-severity vulnerability in Oracle Communications Billing and Revenue Management (BRM) versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data within the affected product. The vulnerability impacts confidentiality but does not affect integrity or availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous patches across Oracle products. However, the specific patch for this vulnerability is not explicitly detailed in the advisory content provided.
CVE-2026-101758 is a vulnerability in Oracle Communications Billing and Revenue Management (BRM) versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data and perform unauthorized updates, inserts, or deletes on accessible data. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity with significant confidentiality and integrity impacts. Oracle has released patches for this vulnerability as part of its October 2026 Critical Patch Update advisory.
CVE-2026-101746 is a vulnerability in Oracle Agile Engineering Data Management version 6.2.1 that allows an unauthenticated attacker with physical access to the communication segment attached to the hardware to compromise the system. Exploitation requires human interaction from a person other than the attacker. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the product. The vulnerability has a CVSS 3.1 base score of 7.3, indicating high severity with significant confidentiality and integrity impacts.
CVE-2026-101745 is a vulnerability in Oracle Agile Engineering Data Management version 6.2.1 that allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to certain data. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity with confidentiality impact only. No integrity or availability impacts are reported. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across multiple products.
CVE-2026-101744 is a vulnerability in Oracle Agile Engineering Data Management version 6.2.1 that allows a low privileged attacker with network access via HTTP to compromise the product. Exploitation can lead to unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data, and partial denial of service. The vulnerability is difficult to exploit and has a high CVSS score of 8.4, indicating significant confidentiality, integrity, and availability impacts. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory but has not explicitly listed a patch for this specific version in the provided data.
CVE-2026-101741 is a vulnerability in Oracle Agile Engineering Data Management version 6.2.1. It allows an unauthenticated attacker with physical access to the communication segment attached to the hardware running the product to potentially gain unauthorized access to critical or all accessible data. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.3, primarily impacting confidentiality. The attack complexity is high, and no privileges or user interaction are required. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory but has not explicitly listed a patch for this specific version in the provided data.
CVE-2026-101740 is a vulnerability in Oracle Agile Engineering Data Management version 6.2.1 that allows a low privileged attacker with logon access to the infrastructure to perform unauthorized read and write operations on accessible data. The vulnerability is difficult to exploit and impacts confidentiality and integrity with a low severity score of 3.6. No public exploits or known active exploitation have been reported. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, but no specific patch for this version is explicitly stated in the advisory content.
CVE-2026-101739 is a vulnerability in Oracle Agile Engineering Data Management version 6.2.1 that allows a low privileged attacker with logon access to the infrastructure to potentially take over the product. The vulnerability is difficult to exploit and impacts confidentiality, integrity, and availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, indicating that patches are available for affected products.
CVE-2026-101738 is a vulnerability in Oracle Agile Engineering Data Management version 6.2.1. It allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible data. The vulnerability is difficult to exploit and impacts data integrity without affecting confidentiality or availability. The CVSS 3.1 base score is 3.1, indicating a low severity issue. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains multiple patches for various products.
CVE-2026-101734 is a vulnerability in Oracle Agile Engineering Data Management version 6.2.1. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some accessible data. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity impact focused on confidentiality.
CVE-2026-101680 is a high-severity vulnerability in Oracle Communications Billing and Revenue Management versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. It allows an unauthenticated attacker with network access via TLS to potentially create, delete, or modify critical data or gain unauthorized access to all accessible data. The vulnerability is difficult to exploit and has a CVSS 3.1 base score of 7.4, indicating high impact on confidentiality and integrity. Oracle has released a Critical Patch Update advisory that includes patches for this and other vulnerabilities, strongly recommending customers apply patches promptly. No known exploits in the wild have been reported.
CVE-2026-101667 is a vulnerability in Oracle Trade Management component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to perform unauthorized read and write operations on accessible data. Exploitation requires user interaction by a person other than the attacker and can impact additional Oracle products. The CVSS 3.1 base score is 5.4, indicating medium severity with confidentiality and integrity impacts but no availability impact.
CVE-2026-101666 is a vulnerability in Oracle Trade Management component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to perform unauthorized read and write operations on accessible data, requiring user interaction from a third party. The vulnerability impacts confidentiality and integrity but not availability, with a CVSS 3.1 base score of 5.4 (medium severity).
CVE-2026-101651 is a vulnerability in Oracle Partner Management within Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with a high confidentiality impact but no integrity or availability impact. Oracle has released a Critical Patch Update advisory that includes patches for this and many other vulnerabilities.