CyberSecBulletin

Oracle vulnerabilities

We track 3,014 vulnerabilities in Oracle products across 60+ products. 3,006 are rated high or critical, and 81 have been exploited in real attacks. The most recent was published on October 24, 2026.

3,014vulnerabilities
715critical
2,291high
81exploited
8.3average CVSS score

Latest Oracle vulnerabilities

  • 9.8 Critical severity

    Oracle SOA Suite: Improper Authentication

    CVE-2026-91234Oracle

    Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HT

  • 9.8 Critical severity

    Oracle SOA Suite: Improper Authentication

    CVE-2026-91233Oracle

    Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with netwo

  • 9.9 Critical severity

    Oracle SOA Suite: Improper Access Control

    CVE-2026-91232Oracle

    Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTT

  • 10.0 Critical severity

    Oracle SOA Suite: Missing Authentication for Critical Functionality

    CVE-2026-91231Oracle

    Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t

  • 9.3 Critical severity

    Oracle SOA Suite: Missing Authentication for Critical Functionality

    CVE-2026-91230Oracle

    Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HT

  • 7.5 High severity

    Oracle SOA Suite: Improper Access Control

    CVE-2026-91229Oracle

    Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via H

  • 7.1 High severity

    Oracle SOA Suite: Incorrect Authorization

    CVE-2026-91228Oracle

    Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTT

  • 7.5 High severity

    Oracle SOA Suite: Improper Access Control

    CVE-2026-91227Oracle

    Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via H

  • 7.5 High severity

    Oracle SOA Suite: Improper Access Control

    CVE-2026-91226Oracle

    Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via H

  • 9.1 Critical severity

    Oracle SOA Suite: Missing Authentication for Critical Functionality

    CVE-2026-91225Oracle

    Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t

  • 9.9 Critical severity

    Oracle SOA Suite: Improper Access Control

    CVE-2026-91224Oracle

    Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTT

  • 8.8 High severity

    Oracle SOA Suite: Improper Access Control

    CVE-2026-91223Oracle

    Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTT

  • 9.9 Critical severity

    Oracle Business Process Management Suite: Improper Authentication

    CVE-2026-91222Oracle

    Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow (11g+)). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged att

  • 10.0 Critical severity

    Oracle SOA Suite: Improper Access Control

    CVE-2026-91221Oracle

    Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3

  • 9.8 Critical severity

    Oracle Business Process Management Suite: Improper Authentication

    CVE-2026-91220Oracle

    Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker

  • 8.6 High severity

    Oracle SOA Suite: Missing Authentication for Critical Functionality

    CVE-2026-91219Oracle

    Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HT

  • 9.6 Critical severity

    Oracle SOA Suite: Incorrect Authorization

    CVE-2026-91218Oracle

    Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTT

  • 8.6 High severity

    Oracle SOA Suite: Missing Authentication for Critical Functionality

    CVE-2026-91217Oracle

    Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HT

  • 10.0 Critical severity

    Oracle SOA Suite: Missing Authentication for Critical Functionality

    CVE-2026-91216Oracle

    Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3

  • 8.8 High severity

    Oracle SOA Suite: Improper Access Control

    CVE-2026-91215Oracle

    Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTT

  • 9.8 Critical severity

    Oracle SOA Suite: Improper Authentication

    CVE-2026-91214Oracle

    Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HT

  • 8.8 High severity

    Oracle Business Process Management Suite: Improper Authentication

    CVE-2026-91213Oracle

    Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: BPM Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker wit

  • 8.6 High severity

    Oracle Identity Manager Connector: Improper Access Control

    CVE-2026-91212Oracle

    Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with netw

  • 8.7 High severity

    Oracle Identity Manager Connector: Improper Access Control

    CVE-2026-91211Oracle

    Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged

  • 7.1 High severity

    Oracle Solaris: Improper Authorization

    CVE-2026-87421Oracle

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracl

  • 8.8 High severity

    Oracle Service Bus: Improper Access Control

    CVE-2026-87420Oracle

    Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Orac

  • 8.8 High severity

    Oracle Service Bus: Missing Authentication for Critical Functionality

    CVE-2026-87419Oracle

    Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to c

  • 7.5 High severity

    Oracle Solaris: Exposure of Sensitive Information to an Unauthorized Actor

    CVE-2026-87417Oracle

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracl

  • 8.7 High severity

    Oracle Applications Framework: Cross-Site Request Forgery

    CVE-2026-87408Oracle

    Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via

  • 7.5 High severity

    Pasta: Missing Authentication for Critical Functionality

    CVE-2026-87404Oracle

    Vulnerability in the Pasta product of Oracle E-Business Suite (component: Printing Engine). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Pa

  • 7.1 High severity

    Applications DBA: Improper Access Control

    CVE-2026-87403Oracle

    Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where

  • 7.3 High severity

    Applications DBA: Improper Access Control

    CVE-2026-87402Oracle

    Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where

  • 7.5 High severity

    Oracle Outside In Technology: Uncontrolled Resource Consumption

    CVE-2026-87398Oracle

    Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t

  • 8.8 High severity

    Oracle Outside In Technology: Improper Access Control

    CVE-2026-87397Oracle

    Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t

  • 7.5 High severity

    Oracle Outside In Technology: Uncontrolled Resource Consumption

    CVE-2026-87395Oracle

    Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t

  • 8.2 High severity

    Oracle Outside In Technology: Improper Access Control

    CVE-2026-87394Oracle

    Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP t

  • 7.5 High severity

    Oracle Service Bus: Uncontrolled Resource Consumption

    CVE-2026-87369Oracle

    Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to

  • 8.8 High severity

    Oracle Service Bus: Improper Access Control

    CVE-2026-87364Oracle

    Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to c

  • 7.5 High severity

    Oracle Payroll: Exposure of Sensitive Information to an Unauthorized Actor

    CVE-2026-87363Oracle

    Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to

  • 8.8 High severity

    Oracle Service Bus: Exposure of Sensitive Information to an Unauthorized Actor

    CVE-2026-87359Oracle

    Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to c