CVE-2026-91608 is a high-severity vulnerability in Oracle BI Publisher's web server component affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical or all accessible data in Oracle BI Publisher. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a significant confidentiality impact without requiring user interaction or privileges. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across multiple products. However, the specific patch availability for this vulnerability is not explicitly stated in the advisory content provided.
CVE-2026-91574 is a vulnerability in Oracle BI Publisher that allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data. The affected versions include 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no impact on integrity or availability.
CVE-2026-91517 is a vulnerability in the Oracle Management Pack for Oracle GoldenGate (EM Plugin component) affecting versions 13.4.1.0.1 through 13.5.2.0.6. It allows an unauthenticated attacker with physical access to the communication segment attached to the hardware running the product to compromise it. Successful exploitation requires human interaction by someone other than the attacker and can lead to full takeover of the Oracle Management Pack for Oracle GoldenGate. The vulnerability has a CVSS 3.1 base score of 8.0, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-91497 is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools (versions 8.61 through 8.63) that allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible data. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity primarily impacting data integrity. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, recommending customers apply patches promptly to mitigate risk.
CVE-2026-91483 is a vulnerability in Oracle Outside In Technology version 8.5.8 that allows an unauthenticated attacker with logon access to the infrastructure to compromise the product. Exploitation requires user interaction from a person other than the attacker. Successful exploitation can lead to full takeover of Oracle Outside In Technology, impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity.
CVE-2026-91475 is a vulnerability in Oracle Outside In Technology version 8.5.8 that allows a low privileged attacker with logon access to compromise the product. Exploitation can lead to unauthorized creation, deletion, or modification of critical or accessible data, unauthorized read access to some data, and partial denial of service. The vulnerability has a CVSS 3.1 base score of 6.6, indicating a medium severity level.
CVE-2026-91458 is a vulnerability in Oracle Outside In Technology version 8.5.8 that allows an unauthenticated attacker with logon access to the infrastructure to potentially take over the Oracle Outside In Technology component. Exploitation requires user interaction from a person other than the attacker. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-91457 is a vulnerability in Oracle Outside In Technology version 8.5.8 that allows an unauthenticated attacker with logon access to the infrastructure to compromise the product. Exploitation requires user interaction by someone other than the attacker. Successful exploitation can lead to full takeover of Oracle Outside In Technology, impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity.
CVE-2026-91448 is a vulnerability in the Oracle Siebel CRM Deployment product affecting versions 17.0 through 26.9. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data within Siebel CRM Deployment. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with a significant confidentiality impact but no impact on integrity or availability.
CVE-2026-91406 is a vulnerability in Oracle Outside In Technology version 8.5.8 that allows an unauthenticated attacker with network access via HTTP to potentially take over the product. Exploitation is difficult and requires user interaction from someone other than the attacker. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 7.5. Oracle has published a Critical Patch Update advisory but does not explicitly confirm a patch for this specific version in the provided data.
CVE-2026-91405 is a vulnerability in Oracle Outside In Technology version 8.5.8, specifically in the Outside In PDF Export SDK component. It allows an unauthenticated attacker with network access via HTTP to potentially compromise the product. Exploitation is difficult and requires user interaction from someone other than the attacker. Successful exploitation can lead to full takeover of the Oracle Outside In Technology component. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability.
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM End User, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data as well as unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Siebel CRM End User accessible data as well as unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and 27; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L).
Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access). Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N).
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).
CVE-2026-91350 is a vulnerability in Oracle Outside In Technology version 8.5.8 that allows an unauthenticated attacker with network access via HTTP to cause a denial of service by hanging or crashing the product. The vulnerability has a CVSS 3.1 base score of 7.5, indicating a high severity impact on availability. No confidentiality or integrity impacts are reported. Oracle has published a Critical Patch Update advisory that includes patches for multiple vulnerabilities, but no specific patch link for this product version is provided in the advisory content.
CVE-2026-91349 is a vulnerability in Oracle Outside In Technology version 8.5.8 that allows an unauthenticated attacker with network access via HTTP to cause a denial of service (DoS) by making the product hang or crash repeatedly. The vulnerability impacts availability but does not affect confidentiality or integrity. It has a CVSS 3.1 base score of 7.5, indicating high severity. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across Oracle products. However, no specific patch link or fixed version is provided for this product in the advisory content.
CVE-2026-91345 is a vulnerability in Oracle Outside In Technology version 8.5.8 that allows an unauthenticated attacker with network access via HTTP to cause a denial of service by triggering a hang or repeated crash. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with impact on availability only. No confidentiality or integrity impacts are reported. Oracle has published a Critical Patch Update advisory that includes security patches for multiple products, including Oracle Outside In Technology, recommending timely patch application.