CVE-2026-91518 is a medium severity vulnerability in Oracle BI Publisher that allows a low privileged attacker with network access via HTTP to gain unauthorized read and write access to some accessible data. The vulnerability affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 of Oracle BI Publisher. Successful exploitation can lead to unauthorized update, insert, or delete operations on accessible data, as well as unauthorized reading of a subset of data. The CVSS 3.1 base score is 5.4, indicating a moderate impact on confidentiality and integrity without affecting availability. Oracle has released a Critical Patch Update that includes patches for this vulnerability, and customers are strongly advised to apply these patches promptly.
CVE-2026-91517 is a high-severity vulnerability in Oracle Management Pack for Oracle GoldenGate versions 13.4.1.0.1 through 13.5.2.0.6. It allows an unauthenticated attacker with access to the physical communication segment of the hardware running the software to compromise the product. Successful exploitation requires human interaction from a third party. The vulnerability can lead to full takeover of the Oracle Management Pack for Oracle GoldenGate.
CVE-2026-91515 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a low privileged attacker with network access via HTTP to potentially take over the affected product. The vulnerability is rated with a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability.
CVE-2026-91514 is a vulnerability in Oracle BI Publisher affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. It allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data or all data accessible by Oracle BI Publisher. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact focused on confidentiality. Oracle has released security patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update advisory.
CVE-2026-91512 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows a high privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 7.2. Oracle has acknowledged this issue in their October 2026 Critical Patch Update advisory.
CVE-2026-91511 is a vulnerability in Oracle Purchasing component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful exploitation can lead to unauthorized access to critical data and unauthorized update, insert, or delete operations on Oracle Purchasing accessible data. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with confidentiality and integrity impacts. Oracle has released security patches addressing this vulnerability as part of its October 2026 Critical Patch Update.
CVE-2026-91506 is a high-severity vulnerability in the Oracle E-Business Suite Workflow Notification Mailer component. It affects versions 12.2.3 through 12.2.15. The vulnerability allows an unauthenticated attacker with network access via HTTP to potentially take over the Workflow component. The CVSS 3.1 base score is 8.1, indicating high impact on confidentiality, integrity, and availability. Oracle has released patches for this vulnerability as part of its October 2026 Critical Patch Update.
CVE-2026-91505 is a vulnerability in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. It allows a high privileged attacker with logon access to the infrastructure running PeopleSoft Enterprise PeopleTools to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all accessible data within PeopleSoft Enterprise PeopleTools. The CVSS 3.1 base score is 6.0, indicating a medium severity vulnerability with high confidentiality and integrity impacts but no availability impact.
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Portal Suite). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the VPD component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create Table privilege with network access via Oracle Net to compromise VPD. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all VPD accessible data as well as unauthorized access to critical data or complete access to all VPD accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager executes to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having DBMS_VECTOR privilege with network access via Oracle Net to compromise RDBMS. Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Workflow. Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP+). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).