E-business Suite vulnerabilities

106 known vulnerabilities in E-business Suite from Oracle. 106 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Oracle Flow Manufacturing: Improper Privilege Management

  CVE-2026-46837May 28, 2026Oracle

  Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Security). Supported versions that are affected are 12.2.9-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to com

• 8.1 High severity

  Oracle Payroll: Improper Access Control

  CVE-2026-46828May 28, 2026Oracle

  Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to co

• 8.8 High severity

  Oracle Payroll: Improper Privilege Management

  CVE-2026-46827May 28, 2026Oracle

  Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Self Service Manager). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to c

• 8.8 High severity

  Oracle Payroll: Missing Authentication for Critical Functionality

  CVE-2026-46826May 28, 2026Oracle

  Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to c

• 9.1 Critical severity

  Oracle Internet Procurement Connector: Improper Access Control

  CVE-2026-46819May 28, 2026Oracle

  Vulnerability in the Oracle Internet Procurement Connector product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with netwo

• 7.4 High severity

  Oracle Payments: Improper Access Control

  CVE-2026-46818May 28, 2026Oracle

  Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to

• 9.8 Critical severity

  Oracle E-Business Suite Improper Privilege Management Exploited

  CVE-2026-46817May 28, 2026OracleEPSS 12.3%

  Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to co

• 9.8 Critical severity

  Oracle Scripting: Missing Authentication for Critical Functionality

  CVE-2025-30727Apr 15, 2025Oracle

  Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: iSurvey Module). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to comp

• 8.1 High severity

  Oracle Customer Care: Incorrect Authorization

  CVE-2025-21516Jan 21, 2025Oracle

  Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: Service Requests). Supported versions that are affected are 12.2.5-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to

• 8.1 High severity

  Oracle Project Foundation: Incorrect Authorization

  CVE-2025-21506Jan 21, 2025Oracle

  Vulnerability in the Oracle Project Foundation product of Oracle E-Business Suite (component: Technology Foundation). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access v

• 8.1 High severity

  Oracle Financials: Incorrect Authorization

  CVE-2024-21282Oct 15, 2024Oracle

  Vulnerability in the Oracle Financials product of Oracle E-Business Suite (component: Common Components). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to c

• 8.1 High severity

  Oracle Sourcing: Incorrect Authorization

  CVE-2024-21279Oct 15, 2024Oracle

  Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Auctions). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise O

• 8.1 High severity

  Oracle Contract Lifecycle Management for…: Incorrect Authorization

  CVE-2024-21278Oct 15, 2024Oracle

  Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award Processes). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacke

• 8.1 High severity

  Oracle MES for Process Manufacturing: Incorrect Authorization

  CVE-2024-21277Oct 15, 2024Oracle

  Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Device Integration). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network

• 8.1 High severity

  Oracle Work in Process: Incorrect Authorization

  CVE-2024-21276Oct 15, 2024Oracle

  Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Messages). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compr

• 8.1 High severity

  Oracle Quoting: Incorrect Authorization

  CVE-2024-21275Oct 15, 2024Oracle

  Vulnerability in the Oracle Quoting product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.7-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to comprom

• 8.1 High severity

  Oracle Field Service: Incorrect Authorization

  CVE-2024-21271Oct 15, 2024Oracle

  Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Field Service Engineer Portal). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network acces

• 8.1 High severity

  Oracle Common Applications Calendar: Incorrect Authorization

  CVE-2024-21270Oct 15, 2024Oracle

  Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Tasks). Supported versions that are affected are 12.2.6-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTT

• 8.1 High severity

  Oracle Incentive Compensation: Incorrect Authorization

  CVE-2024-21269Oct 15, 2024Oracle

  Vulnerability in the Oracle Incentive Compensation product of Oracle E-Business Suite (component: Compensation Plan). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access v

• 8.1 High severity

  Oracle Applications Manager: Incorrect Authorization

  CVE-2024-21268Oct 15, 2024Oracle

  Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics). Supported versions that are affected are 12.2.11-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP

• 8.1 High severity

  Oracle Cost Management: Incorrect Authorization

  CVE-2024-21267Oct 15, 2024Oracle

  Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.12-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to

• 8.1 High severity

  Oracle Advanced Pricing: Incorrect Authorization

  CVE-2024-21266Oct 15, 2024Oracle

  Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Price List). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to co

• 8.1 High severity

  Oracle Site Hub: Incorrect Authorization

  CVE-2024-21265Oct 15, 2024Oracle

  Vulnerability in the Oracle Site Hub product of Oracle E-Business Suite (component: Site Hierarchy Flows). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to

• 7.5 High severity

  Production Scheduling: Inconsistent Interpretation of HTTP Requests

  CVE-2024-21088Apr 16, 2024Oracle

  Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Import Utility). Supported versions that are affected are 12.2.4-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via

• 7.5 High severity

  Applications DBA: Improper Access Control

  CVE-2023-21849Jan 18, 2023Oracle

  Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Java utils). Supported versions that are affected are 12.2.3-12.2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to c

• 9.8 Critical severity

  Oracle E-Business Suite Unspecified Exploited

  CVE-2022-21587Oct 18, 2022OracleEPSS 98.3%

  Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network acces