CVE-2026-101494 is a high-severity vulnerability in Oracle REST Data Services (Core component) affecting versions 24.2.0 through 26.2.2. It allows a low privileged attacker with network access via HTTP to compromise the service, potentially gaining unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 base score of 7.7, indicating significant confidentiality impact without affecting integrity or availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update, which provides security patches for affected products.
CVE-2026-101493 is a vulnerability in Oracle REST Data Services Core component affecting versions 24.2.0 through 26.2.1. It allows a low privileged attacker with network access via HTTP to perform unauthorized read and write operations on accessible data. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity with impacts on confidentiality and integrity but no impact on availability. Oracle has published a Critical Patch Update advisory addressing this and other vulnerabilities, recommending timely application of patches.
CVE-2026-101492 is a medium severity vulnerability in Oracle Siebel CRM Integration (Open Integration component) affecting versions 25.12 through 26.9. It allows an unauthenticated attacker with network access via HTTP to potentially compromise the product. Successful exploitation requires human interaction from a user other than the attacker and can result in unauthorized read, update, insert, or delete access to some Siebel CRM Integration accessible data. The vulnerability also has a scope change, potentially impacting additional products. The CVSS 3.1 base score is 4.7, reflecting limited confidentiality and integrity impacts without availability impact. Oracle has released patches as part of their October 2026 Critical Patch Update advisory.
CVE-2026-101491 is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools Query component affecting versions 8.61 through 8.63. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some PeopleSoft Enterprise PeopleTools data. The vulnerability has a CVSS 3.1 base score of 5.0, indicating a medium severity impact focused on confidentiality. The vulnerability may also impact additional Oracle products due to scope change. Oracle has released security patches as part of its October 2026 Critical Patch Update.
CVE-2026-101490 is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools (Fluid Core component) versions 8.61 through 8.63. It allows an unauthenticated attacker with network access via HTTP to potentially compromise the system. Successful exploitation requires user interaction by someone other than the attacker and can lead to unauthorized update, insert, or delete operations on accessible data, as well as unauthorized read access to some data. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity with confidentiality and integrity impacts. Oracle has released patches as part of its October 2026 Critical Patch Update. Users are strongly advised to apply these patches promptly.
CVE-2026-101489 is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools Portal component versions 8.61 through 8.63. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some PeopleSoft Enterprise PeopleTools data. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity with confidentiality impact only. No known exploits in the wild have been reported. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.
CVE-2026-101488 is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools (Business Interlink component) versions 8.61 through 8.63. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized read access to some data and cause a partial denial of service. The CVSS 3.1 base score is 6.5, indicating a medium severity with confidentiality and availability impacts. Oracle has published a Critical Patch Update advisory that includes patches for this and other vulnerabilities.
CVE-2026-101487 is a medium severity vulnerability in Oracle PeopleSoft Enterprise PeopleTools Portal component affecting versions 8.61 through 8.63. It allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible data, as well as unauthorized read access to some data. Successful exploitation requires user interaction from a person other than the attacker and may impact additional PeopleSoft products. The vulnerability has a CVSS 3.1 base score of 5.4, reflecting confidentiality and integrity impacts but no availability impact. Oracle has released security patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.
CVE-2026-101486 is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools (Fluid Core component) versions 8.61 through 8.63. It allows a low privileged attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible data, as well as unauthorized read access to some data. Successful exploitation requires user interaction from a person other than the attacker. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity with confidentiality and integrity impacts but no availability impact. Oracle has released security patches addressing this and other vulnerabilities in their October 2026 Critical Patch Update advisory.
CVE-2026-101485 is a vulnerability in Oracle Autonomous Health Framework's Trace File Analyzer component affecting versions 26.3 through 26.8. It allows a low privileged attacker with logon access to the infrastructure to compromise the framework, potentially leading to unauthorized access to critical data or complete access to all data accessible by the framework. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact and no impact on integrity or availability.
Vulnerability in Oracle Secure Backup (component: Backup and Restore). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup. Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-101483 is a vulnerability in Oracle Secure Backup versions 19.1.0.0.0 and 19.1.0.1.0 that allows a low privileged attacker with logon access to cause a denial of service (DoS) by hanging or crashing the Oracle Secure Backup service. The vulnerability impacts availability but does not affect confidentiality or integrity. The attack scope may extend to other Oracle products due to the nature of the infrastructure. The CVSS 3.1 base score is 6.5, indicating a medium severity level.
Vulnerability in Oracle Secure Backup (component: Device Management and Support). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup. Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in Oracle Secure Backup (component: Device Management and Support). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup. While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-101480 is a vulnerability in Oracle Secure Backup's NDMP daemon affecting versions 19.1.0.0.0 and 19.1.0.1.0. It allows an unauthenticated attacker with network access via TCP to gain unauthorized read access to some Oracle Secure Backup data. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity with confidentiality impact only. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across Oracle products.
CVE-2026-101479 is a high-severity vulnerability in Oracle Secure Backup versions 19.1.0.0.0 and 19.1.0.1.0. It allows an unauthenticated attacker with network access via TCP to cause a denial of service by hanging or repeatedly crashing the Oracle Secure Backup service. The vulnerability has a CVSS 3.1 base score of 8.6, indicating a significant impact on availability. The vulnerability may also affect additional Oracle products due to scope change. Oracle has published a Critical Patch Update advisory including patches for multiple products, but specific patch details for this vulnerability were not explicitly provided in the advisory content.
CVE-2026-101478 is a vulnerability in Oracle Autonomous Health Framework's Trace File Analyzer component affecting versions 26.3 through 26.8. It allows a low privileged attacker with logon access to the infrastructure to compromise and potentially take over the Oracle Autonomous Health Framework. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-101477 is a vulnerability in Oracle Autonomous Health Framework's Trace File Analyzer component affecting versions 26.3 through 26.8. It allows a low privileged attacker with logon access to the infrastructure to compromise the framework, potentially leading to full takeover. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-101476 is a vulnerability in Oracle Siebel Apps - Marketing versions 17.0 through 26.9. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on accessible data. Exploitation requires human interaction from a user other than the attacker. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity with integrity impact only.
CVE-2026-101475 is a vulnerability in Oracle Primavera Unifier's logging component affecting multiple versions from 21.12.0 through 25.12.9. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within Primavera Unifier. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Oracle has released security patches addressing this vulnerability as part of its October 2026 Critical Patch Update.