NCSC-2026-0376
Vulnerability from csaf_ncscnl - Published: 2026-09-16 13:53 - Updated: 2026-09-16 13:53Summary
Kwetsbaarheden verholpen in Oracle E-Business Suite
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Oracle heeft 159 kwetsbaarheden verholpen in diverse Oracle E-Business Suite-producten, waaronder Oracle Applications Framework, Oracle Document Management and Collaboration, Oracle Mobile Application Server, Oracle Alert, Oracle Application Object Library, Oracle Applications Manager, Oracle Bills of Material, Oracle Complex Maintenance, Repair and Overhaul, Oracle Contract Lifecycle Management for Public Sector, Oracle Contracts, Oracle Customer Interaction History, Oracle Demand Signal Repository, Oracle Depot Repair, Oracle Marketing, Oracle Product Hub, Oracle Purchasing, Oracle Report Manager, Oracle Sales Online, Oracle Spares Management, Oracle User Management, Oracle iStore, Oracle HRMS (India), Oracle iRecruitment, Oracle Product Workbench, Oracle Financials for Asia/Pacific, Oracle Engineering, Oracle CRM Technical Foundation, Oracle Financials Common Modules, Oracle Installed Base, Oracle One-to-One Fulfillment, Oracle Order Management, Oracle Project Intelligence, Oracle Work in Process, Oracle Advanced Benefits, Applications DBA, Enterprise Command Center Framework, Oracle Field Service, Oracle Proposals, Oracle Sales, Oracle Sales Offline, Oracle Web Applications Desktop Integrator, Oracle Quality, Oracle Sourcing, Oracle Common Applications, Oracle Lease and Finance Management, Oracle Common Applications Calendar, Oracle Partner Management, Oracle Site Hub, Oracle US Federal Human Resources, Oracle XML Gateway, Oracle HR Intelligence, Oracle Assets en Oracle Process Manufacturing Intelligence.
Interpretaties: De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Oracle E-Business Suite-producten, waaronder mogelijkheden voor niet-geauthenticeerde en laaggeprivilegieerde kwaadwillenden om via netwerktoegang ongeautoriseerde acties uit te voeren. De kwetsbaarheden hebben CVSS-scores variërend van middel tot kritiek. Van de in totaal 159 kwetsbaarheden zijn drie als kritiek aangemerkt en volgens Oracle kunnen 19 kwetsbaarheden zonder authenticatie op afstand worden misbruikt. Succesvol misbruik kan onder meer leiden tot het verkrijgen van ongeautoriseerde toegang tot gevoelige informatie, het wijzigen of verwijderen van gegevens, volledige overname van getroffen componenten en het verstoren van de beschikbaarheid van getroffen systemen. Sommige kwetsbaarheden vereisen gebruikersinteractie of voorafgaande toegangsrechten, terwijl andere volledig op afstand en zonder authenticatie kunnen worden misbruikt.
De drie kwetsbaarheden die als kritiek zijn aangemerkt, CVE-2026-83327, CVE-2026-83452 en CVE-2026-83462, hebben een CVSS-score van 9,8 en bevinden zich respectievelijk in Oracle Applications Framework, Oracle Document Management and Collaboration en Oracle Mobile Application Server. Deze kwetsbaarheden kunnen zonder authenticatie op afstand worden misbruikt, vereisen een lage aanvalscomplexiteit en geen gebruikersinteractie. Succesvolle exploitatie kan leiden tot volledige overname van de getroffen component en heeft een hoge impact op de vertrouwelijkheid, integriteit en beschikbaarheid van getroffen systemen.
Het NCSC adviseert om de beveiligingsupdates voor de kritieke kwetsbaarheden met voorrang toe te passen.
Oplossingen: Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-306: Missing Authentication for Critical Function
A vulnerability in Oracle Web Applications Desktop Integrator versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical or all accessible data, rated with a CVSS 3.1 base score of 6.5.
6.5 (Medium)
Affected products
Known affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Application Object Library
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Applications Framework
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Applications Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Document Management and Collaboration
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Mobile Application Server
|
vers:unknown/* |
A vulnerability in Oracle XML Gateway for Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data and cause partial denial of service, rated CVSS 7.1.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Applications Framework versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle HR Intelligence versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to cause unauthorized data modification, deletion, or denial of service, rated CVSS 3.1 base score 6.8.
6.8 (Medium)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle Marketing for Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability.
7.2 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Marketing within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access and modify critical data, rated CVSS 3.1 base score 8.5.
8.5 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Marketing within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.
7.7 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle E-Business Suite Oracle Alert (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Spares Management versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Field Service versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access, modify data, and cause partial denial of service, rated CVSS 3.1 base score 7.6.
7.6 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Field Service versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to manipulate critical data, gain unauthorized access, or cause partial denial of service, rated CVSS 7.1.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Marketing within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows unauthenticated remote attackers to access sensitive data via HTTP, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Partner Management versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 7.1.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Lease and Finance Management versions 12.2.7 to 12.2.15 allows a high-privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, rated CVSS 3.1 score 7.2.
7.2 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle E-Business Suite Oracle Quality (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to gain unauthorized access and modify critical data, rated CVSS 3.1 score 7.1.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle E-Business Suite's Oracle Quality component (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to potentially compromise system confidentiality, integrity, and availability.
7.5 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Applications Manager versions 12.2.3 to 12.2.15 allows unauthenticated attackers with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Order Management versions 12.2.5 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.
7.7 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle E-Business Suite Applications DBA (AD Utilities) versions 12.2.3 to 12.2.15 allows a high-privileged attacker with HTTP network access to potentially take control, with a CVSS 3.1 base score of 7.2 indicating high impact.
7.2 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle E-Business Suite Applications DBA (versions 12.2.3-12.2.15) allows low-privileged attackers with infrastructure access to fully compromise the system, scoring 7.8 on the CVSS 3.1 scale.
7.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle E-Business Suite User Management (versions 12.2.6-12.2.15) allows low-privileged attackers with HTTP network access to fully compromise the system, rated CVSS 3.1 base score 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Alert for Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Marketing within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Report Manager versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTPS network access to fully compromise the system, rated 8.8 on the CVSS 3.1 scale.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Report Manager versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTPS network access to gain unauthorized access to critical data or cause partial denial of service, rated CVSS 3.1 base score 7.1.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Sales Online versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Report Manager versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Sales Online versions 12.2.3 to 12.2.15 allows a low-privileged attacker with network access and user interaction to gain unauthorized access and modify critical data, rated CVSS 3.1 base score 7.6.
7.6 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Sales Offline versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.
7.7 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Sales Offline versions 12.2.3 to 12.2.15 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Sales within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical Oracle Sales data, with a CVSS 3.1 base score of 7.7.
7.7 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Site Hub versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to create, delete, modify, or read critical data, with a CVSS 3.1 base score of 7.1 indicating significant confidentiality and integrity impact.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Web Applications Desktop Integrator versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTPS network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.
7.7 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle iStore (E-Business Suite 12.2.3-12.2.15) allows low-privileged attackers with network access to manipulate critical data via HTTP, with a CVSS 3.1 base score of 8.1.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle iStore versions 12.2.3 to 12.2.15 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle iStore within E-Business Suite versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.
7.7 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle iStore (E-Business Suite 12.2.3-12.2.15) allows low-privileged attackers with network access and user interaction to create, delete, or modify critical data unauthorizedly.
8.7 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Spares Management versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Spares Management versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-privileged attacker can exploit a vulnerability in Oracle Spares Management (12.2.3-12.2.15) via HTTP to compromise system confidentiality, integrity, and availability, with a CVSS 3.1 base score of 8.0.
8.0 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Field Service versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 6.5.
6.5 (Medium)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Field Service versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.
7.7 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Proposals within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.
7.7 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Project Intelligence versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Applications Manager versions 12.2.3 to 12.2.15 allows a high-privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, rated CVSS 3.1 base score 8.0.
8.0 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Applications Manager versions 12.2.3 to 12.2.15 allows low-privileged attackers with infrastructure access to compromise system integrity and confidentiality, with a CVSS 3.1 base score of 7.1.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability (CVSS 7.8) in Oracle E-Business Suite Applications DBA (ADPatch component) versions 12.2.3-12.2.15 allows an unauthenticated attacker with infrastructure logon and user interaction to potentially take control of Applications DBA.
7.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Project Intelligence versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to create, delete, modify, or read critical data, with a CVSS 3.1 base score of 7.1.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Application Object Library versions 12.2.3 to 12.2.15 allows unauthenticated attackers with HTTPS network access to create, delete, or modify critical data, resulting in unauthorized access with a CVSS 3.1 base score of 7.4.
7.4 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Application Object Library versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Customer Interaction History versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Customer Interaction History (versions 12.2.3-12.2.15) allows a low-privileged attacker with HTTPS network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Customer Interaction History versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.
7.7 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Application Object Library versions 12.2.3 to 12.2.15 allows unauthenticated remote attackers to access sensitive data via HTTP, with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Applications Manager versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTPS network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle One-to-One Fulfillment versions 12.2.3 to 12.2.15 allows unauthenticated remote attackers to potentially compromise system confidentiality, integrity, and availability, with a CVSS 3.1 base score of 8.1.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle One-to-One Fulfillment (versions 12.2.3-12.2.15) allows a low-privileged attacker with network access to fully compromise the system, impacting confidentiality, integrity, and availability.
8.0 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle One-to-One Fulfillment versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data and cause partial denial of service, rated CVSS 7.1.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Sales Online versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 8.5.
8.5 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle One-to-One Fulfillment versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data and cause partial denial of service, rated CVSS 7.1.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle CRM Technical Foundation versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Application Object Library versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 6.5.
6.5 (Medium)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle E-Business Suite Common Applications (versions 12.2.3-12.2.15) allows a privileged attacker with HTTP network access to potentially compromise the application, with a CVSS 3.1 base score of 7.2.
7.2 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle One-to-One Fulfillment (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle Application Object Library versions 12.2.3 to 12.2.15 allows a highly privileged attacker with HTTP network access to potentially take control of the component, impacting Oracle E-Business Suite products, with a CVSS 3.1 score of 8.0.
8.0 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle E-Business Suite Common Applications Calendar (12.2.3-12.2.15) allows low-privileged network attackers to modify critical data, gain unauthorized access, and cause partial denial of service, with a CVSS 3.1 score of 7.1.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Application Object Library versions 12.2.3 to 12.2.15 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical data, resulting in unauthorized access with a CVSS 3.1 base score of 7.4.
7.4 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle E-Business Suite Common Applications (12.2.3-12.2.15) allows low-privileged attackers with network access and user interaction to modify critical data, with a CVSS 3.1 base score of 7.3 indicating high confidentiality and integrity impact.
7.3 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle E-Business Suite Common Applications Calendar (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, or modify critical data and cause partial denial of service, rated CVSS 7.1.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle E-Business Suite Common Applications Calendar (12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, modify, or read critical data, with a CVSS 3.1 base score of 7.1.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle Depot Repair versions 12.2.3 to 12.2.15 allows a highly privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability.
7.2 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle E-Business Suite User Management (Proxy User Delegation) versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to potentially compromise system confidentiality, integrity, and availability (CVSS 8.8).
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Depot Repair versions 12.2.10 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Field Service versions 12.2.3 to 12.2.15 allows a low-privileged attacker with network access and user interaction to gain unauthorized read and write access to certain data, with a CVSS 3.1 base score of 5.4.
5.4 (Medium)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Process Manufacturing Intelligence (versions 12.2.3-12.2.15) allows a low-privileged attacker with network access via Oracle Net to gain unauthorized access to critical data, with a CVSS 3.1 base score of 6.5.
6.5 (Medium)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle Sourcing within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to potentially compromise system confidentiality, integrity, and availability.
7.5 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Applications Framework versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle XML Gateway for Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data and cause partial denial of service, rated CVSS 7.1.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical unauthenticated remote code execution vulnerability in Oracle Applications Framework versions 12.2.3 to 12.2.15 via SOAP has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle Applications Framework versions 12.2.3 to 12.2.15 allows a highly privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability.
7.2 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Applications Framework versions 12.2.9 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8 indicating high severity.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Applications Framework versions 12.2.9 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8 indicating high severity.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Applications Framework versions 12.2.9 to 12.2.15 allows low-privileged attackers with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 7.1.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Applications Manager versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Applications Manager versions 12.2.3 to 12.2.15 allows unauthenticated attackers with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle XML Gateway for Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data and cause partial denial of service, rated CVSS 7.1.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle XML Gateway for Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data and cause partial denial of service, rated CVSS 7.1.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle E-Business Suite Enterprise Command Center Framework 16 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated CVSS 3.1 base score 7.7.
7.7 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Complex Maintenance, Repair and Overhaul (versions 12.2.12-12.2.15) allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data and cause partial denial of service, rated CVSS 8.5.
8.5 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Demand Signal Repository (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Demand Signal Repository (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Product Workbench versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Product Workbench versions 12.2.3 to 12.2.15 allows a low-privileged attacker with network access and user interaction to gain unauthorized read and write access to certain data, with a CVSS 3.1 base score of 5.4.
5.4 (Medium)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Depot Repair for E-Business Suite versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 score of 8.1.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Depot Repair (versions 12.2.3-12.2.15) allows a high-privileged attacker with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 6.5 indicating significant confidentiality and integrity impacts.
6.5 (Medium)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Product Workbench versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle E-Business Suite Oracle Bills of Material (versions 12.2.13-12.2.15) allows low-privileged network attackers to create, delete, or modify critical data, with a CVSS 3.1 score of 8.2.
8.2 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Depot Repair for E-Business Suite versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to gain unauthorized critical data access and cause partial denial of service, rated CVSS 7.1.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Engineering within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated CVSS 3.1 base score 7.7.
7.7 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.2.
8.2 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows a highly privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 7.2.
7.2 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to create, delete, or modify critical data, leading to unauthorized access with a CVSS 3.1 base score of 6.8.
6.8 (Medium)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows a highly privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 7.2.
7.2 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Assets versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 6.5.
6.5 (Medium)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, with a CVSS 3.1 score of 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Complex Maintenance, Repair and Overhaul (versions 12.2.3 to 12.2.15) allows a low-privileged attacker with HTTPS network access to fully compromise the system, rated CVSS 3.1 base score 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Financials Common Modules (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Bills of Material versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Bills of Material versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Bills of Material versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data and cause partial denial of service, rated CVSS 8.5.
8.5 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high privileged attacker with network access can exploit a critical vulnerability in Oracle Bills of Material (versions 12.2.3-12.2.15) to compromise the product and related Oracle E-Business Suite components, with a CVSS 3.1 score of 8.0.
8.0 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Product Workbench versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to potentially compromise confidentiality, integrity, and availability, rated CVSS 3.1 base score 8.5.
8.5 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical unauthenticated remote code execution vulnerability in Oracle Document Management and Collaboration (versions 12.2.3-12.2.15) with a CVSS 3.1 base score of 9.8 impacts confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle Document Management and Collaboration (versions 12.2.3-12.2.15) allows a privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability.
7.2 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Document Management and Collaboration (versions 12.2.3-12.2.15) allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Demand Signal Repository (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Demand Signal Repository versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Demand Signal Repository (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to cause unauthorized data modification, deletion, or system crashes, with a CVSS 3.1 score of 8.1.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Mobile Application Server versions 12.2.3 to 12.2.15 allows unauthenticated attackers to access sensitive data and cause partial denial of service, rated with a CVSS 3.1 base score of 8.2.
8.2 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Mobile Application Server versions 12.2.3 to 12.2.15 allows unauthenticated network attackers to fully compromise the server, with a CVSS 3.1 base score of 9.8 indicating severe impacts on confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle Mobile Application Server versions 12.2.3 to 12.2.15 allows an unauthenticated attacker with physical network access to potentially fully compromise the server, with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Mobile Application Server versions 12.2.3 through 12.2.15 allows unauthenticated network attackers to potentially take control of the server, with a CVSS 3.1 base score of 8.1.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Mobile Application Server versions 12.2.3 to 12.2.15 allows unauthenticated attackers with HTTP network access to cause denial of service and unauthorized data modification, with a CVSS 3.1 base score of 8.2.
8.2 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Work in Process (versions 12.2.3-12.2.15) permits unauthenticated attackers with network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Contracts versions 12.2.14 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle Contracts versions 12.2.14 to 12.2.15 allows a privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, rated CVSS 3.1 score 7.2.
7.2 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle Contracts versions 12.2.14 to 12.2.15 allows a privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, rated CVSS 3.1 score 7.2.
7.2 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Advanced Benefits (versions 12.2.3-12.2.15) of Oracle E-Business Suite allows a high privileged attacker with HTTP network access to potentially compromise confidentiality, integrity, and availability, rated CVSS 8.0.
8.0 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle US Federal Human Resources (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, modify, or read critical data, with a CVSS 3.1 base score of 7.1.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Product Hub within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.
7.7 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Product Hub within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.
7.7 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Product Hub within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.
7.7 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle iRecruitment versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 8.5.
8.5 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle iRecruitment versions 12.2.3 to 12.2.15 allows unauthenticated attackers with network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 6.8 indicating significant confidentiality and integrity impact.
6.8 (Medium)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle iRecruitment versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, with a CVSS 3.1 base score of 7.7.
7.7 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Financials for Asia/Pacific (versions 12.2.8-12.2.15) enables a low-privileged attacker with HTTP network access to gain unauthorized access, modify critical data, or cause partial denial of service, with a CVSS 3.1 score of 8.3.
8.3 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Report Manager versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data or cause partial denial of service, rated CVSS 3.1 base score 7.1.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Purchasing versions 12.2.10 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, with a CVSS 3.1 base score of 7.7.
7.7 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Contract Lifecycle Management for Public Sector (versions 12.2.8-12.2.15) allows low-privileged attackers with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 score of 7.1.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Bills of Material versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle E-Business Suite's Oracle Bills of Material (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to gain unauthorized access to critical data, rated CVSS 3.1 base score 7.7.
7.7 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle E-Business Suite Installed Base (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, scoring 8.1 on CVSS 3.1.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, with a CVSS 3.1 score of 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 7.1 indicating significant confidentiality and integrity impact.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Order Management versions 12.2.4 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Order Management V16 allows a low-privileged attacker with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 7.1 indicating high confidentiality and integrity impact.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle HRMS (India) for Oracle E-Business Suite 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data unauthorizedly.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle HRMS (India) for Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTPS network access to gain unauthorized access and modify critical data, with a CVSS 3.1 score of 7.1.
7.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle HRMS (India) versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 8.5.
8.5 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Contract Lifecycle Management for Public Sector (versions 12.2.13-12.2.15) allows a low-privileged attacker with HTTP network access to fully compromise the system, rated CVSS 3.1 base score 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Purchasing versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8 indicating high impact.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Contract Lifecycle Management for Public Sector (v16) allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Purchasing versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A high-severity vulnerability in Oracle E-Business Suite's Oracle Purchasing (G-Invoicing) versions 12.2.11-12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data unauthorizedly.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Purchasing versions 12.2.10 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A vulnerability in Oracle Contract Lifecycle Management for Public Sector (versions 12.2.3-12.2.15) allows unauthenticated network attackers to perform unauthorized read and write operations via HTTP, with a CVSS 3.1 base score of 6.1.
6.1 (Medium)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
A critical vulnerability in Oracle Purchasing versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
5 products, the same list as for
CVE-2026-70755
References
160 references
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Oracle heeft 159 kwetsbaarheden verholpen in diverse Oracle E-Business Suite-producten, waaronder Oracle Applications Framework, Oracle Document Management and Collaboration, Oracle Mobile Application Server, Oracle Alert, Oracle Application Object Library, Oracle Applications Manager, Oracle Bills of Material, Oracle Complex Maintenance, Repair and Overhaul, Oracle Contract Lifecycle Management for Public Sector, Oracle Contracts, Oracle Customer Interaction History, Oracle Demand Signal Repository, Oracle Depot Repair, Oracle Marketing, Oracle Product Hub, Oracle Purchasing, Oracle Report Manager, Oracle Sales Online, Oracle Spares Management, Oracle User Management, Oracle iStore, Oracle HRMS (India), Oracle iRecruitment, Oracle Product Workbench, Oracle Financials for Asia/Pacific, Oracle Engineering, Oracle CRM Technical Foundation, Oracle Financials Common Modules, Oracle Installed Base, Oracle One-to-One Fulfillment, Oracle Order Management, Oracle Project Intelligence, Oracle Work in Process, Oracle Advanced Benefits, Applications DBA, Enterprise Command Center Framework, Oracle Field Service, Oracle Proposals, Oracle Sales, Oracle Sales Offline, Oracle Web Applications Desktop Integrator, Oracle Quality, Oracle Sourcing, Oracle Common Applications, Oracle Lease and Finance Management, Oracle Common Applications Calendar, Oracle Partner Management, Oracle Site Hub, Oracle US Federal Human Resources, Oracle XML Gateway, Oracle HR Intelligence, Oracle Assets en Oracle Process Manufacturing Intelligence.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Oracle E-Business Suite-producten, waaronder mogelijkheden voor niet-geauthenticeerde en laaggeprivilegieerde kwaadwillenden om via netwerktoegang ongeautoriseerde acties uit te voeren. De kwetsbaarheden hebben CVSS-scores vari\u00ebrend van middel tot kritiek. Van de in totaal 159 kwetsbaarheden zijn drie als kritiek aangemerkt en volgens Oracle kunnen 19 kwetsbaarheden zonder authenticatie op afstand worden misbruikt. Succesvol misbruik kan onder meer leiden tot het verkrijgen van ongeautoriseerde toegang tot gevoelige informatie, het wijzigen of verwijderen van gegevens, volledige overname van getroffen componenten en het verstoren van de beschikbaarheid van getroffen systemen. Sommige kwetsbaarheden vereisen gebruikersinteractie of voorafgaande toegangsrechten, terwijl andere volledig op afstand en zonder authenticatie kunnen worden misbruikt.\n\nDe drie kwetsbaarheden die als kritiek zijn aangemerkt, CVE-2026-83327, CVE-2026-83452 en CVE-2026-83462, hebben een CVSS-score van 9,8 en bevinden zich respectievelijk in Oracle Applications Framework, Oracle Document Management and Collaboration en Oracle Mobile Application Server. Deze kwetsbaarheden kunnen zonder authenticatie op afstand worden misbruikt, vereisen een lage aanvalscomplexiteit en geen gebruikersinteractie. Succesvolle exploitatie kan leiden tot volledige overname van de getroffen component en heeft een hoge impact op de vertrouwelijkheid, integriteit en beschikbaarheid van getroffen systemen.\n\nHet NCSC adviseert om de beveiligingsupdates voor de kritieke kwetsbaarheden met voorrang toe te passen.\n",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Missing Authentication for Critical Function",
"title": "CWE-306"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://www.oracle.com/security-alerts/cspusep2026.html"
}
],
"title": "Kwetsbaarheden verholpen in Oracle E-Business Suite",
"tracking": {
"current_release_date": "2026-09-16T13:53:16.753900Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0376",
"initial_release_date": "2026-09-16T13:53:16.753900Z",
"revision_history": [
{
"date": "2026-09-16T13:53:16.753900Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "Oracle Application Object Library"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "Oracle Applications Framework"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-3"
}
}
],
"category": "product_name",
"name": "Oracle Applications Manager"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-4"
}
}
],
"category": "product_name",
"name": "Oracle Document Management and Collaboration"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-5"
}
}
],
"category": "product_name",
"name": "Oracle Mobile Application Server"
}
],
"category": "vendor",
"name": "Oracle"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-70755",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Web Applications Desktop Integrator versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical or all accessible data, rated with a CVSS 3.1 base score of 6.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70755 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70755.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-70755"
},
{
"cve": "CVE-2026-83044",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle XML Gateway for Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data and cause partial denial of service, rated CVSS 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83044 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83044.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83044"
},
{
"cve": "CVE-2026-83072",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Applications Framework versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83072 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83072.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83072"
},
{
"cve": "CVE-2026-83076",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle HR Intelligence versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to cause unauthorized data modification, deletion, or denial of service, rated CVSS 3.1 base score 6.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83076 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83076.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83076"
},
{
"cve": "CVE-2026-83082",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Marketing for Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83082 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83082.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83082"
},
{
"cve": "CVE-2026-83083",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Marketing within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access and modify critical data, rated CVSS 3.1 base score 8.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83083 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83083.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83083"
},
{
"cve": "CVE-2026-83084",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Marketing within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83084 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83084.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83084"
},
{
"cve": "CVE-2026-83089",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle E-Business Suite Oracle Alert (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83089 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83089.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83089"
},
{
"cve": "CVE-2026-83090",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Spares Management versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83090 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83090.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83090"
},
{
"cve": "CVE-2026-83091",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Field Service versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access, modify data, and cause partial denial of service, rated CVSS 3.1 base score 7.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83091 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83091.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83091"
},
{
"cve": "CVE-2026-83092",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Field Service versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to manipulate critical data, gain unauthorized access, or cause partial denial of service, rated CVSS 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83092 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83092.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83092"
},
{
"cve": "CVE-2026-83110",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Marketing within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows unauthenticated remote attackers to access sensitive data via HTTP, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83110 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83110.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83110"
},
{
"cve": "CVE-2026-83111",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Partner Management versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83111 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83111.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83111"
},
{
"cve": "CVE-2026-83112",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Lease and Finance Management versions 12.2.7 to 12.2.15 allows a high-privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, rated CVSS 3.1 score 7.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83112 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83112.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83112"
},
{
"cve": "CVE-2026-83113",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle E-Business Suite Oracle Quality (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to gain unauthorized access and modify critical data, rated CVSS 3.1 score 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83113 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83113.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83113"
},
{
"cve": "CVE-2026-83114",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle E-Business Suite\u0027s Oracle Quality component (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to potentially compromise system confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83114 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83114.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83114"
},
{
"cve": "CVE-2026-83115",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Applications Manager versions 12.2.3 to 12.2.15 allows unauthenticated attackers with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83115 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83115.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83115"
},
{
"cve": "CVE-2026-83116",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Order Management versions 12.2.5 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83116 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83116.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83116"
},
{
"cve": "CVE-2026-83117",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle E-Business Suite Applications DBA (AD Utilities) versions 12.2.3 to 12.2.15 allows a high-privileged attacker with HTTP network access to potentially take control, with a CVSS 3.1 base score of 7.2 indicating high impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83117 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83117.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83117"
},
{
"cve": "CVE-2026-83118",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle E-Business Suite Applications DBA (versions 12.2.3-12.2.15) allows low-privileged attackers with infrastructure access to fully compromise the system, scoring 7.8 on the CVSS 3.1 scale.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83118 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83118.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83118"
},
{
"cve": "CVE-2026-83119",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle E-Business Suite User Management (versions 12.2.6-12.2.15) allows low-privileged attackers with HTTP network access to fully compromise the system, rated CVSS 3.1 base score 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83119 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83119.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83119"
},
{
"cve": "CVE-2026-83120",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Alert for Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83120 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83120.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83120"
},
{
"cve": "CVE-2026-83121",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Marketing within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83121 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83121.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83121"
},
{
"cve": "CVE-2026-83122",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Report Manager versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTPS network access to fully compromise the system, rated 8.8 on the CVSS 3.1 scale.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83122 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83122.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83122"
},
{
"cve": "CVE-2026-83123",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Report Manager versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTPS network access to gain unauthorized access to critical data or cause partial denial of service, rated CVSS 3.1 base score 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83123 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83123.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83123"
},
{
"cve": "CVE-2026-83124",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Sales Online versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83124 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83124.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83124"
},
{
"cve": "CVE-2026-83125",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Report Manager versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83125 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83125.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83125"
},
{
"cve": "CVE-2026-83126",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Sales Online versions 12.2.3 to 12.2.15 allows a low-privileged attacker with network access and user interaction to gain unauthorized access and modify critical data, rated CVSS 3.1 base score 7.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83126 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83126.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83126"
},
{
"cve": "CVE-2026-83127",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Sales Offline versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83127 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83127.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83127"
},
{
"cve": "CVE-2026-83128",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Sales Offline versions 12.2.3 to 12.2.15 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83128 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83128.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83128"
},
{
"cve": "CVE-2026-83129",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Sales within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical Oracle Sales data, with a CVSS 3.1 base score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83129 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83129.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83129"
},
{
"cve": "CVE-2026-83130",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Site Hub versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to create, delete, modify, or read critical data, with a CVSS 3.1 base score of 7.1 indicating significant confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83130 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83130.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83130"
},
{
"cve": "CVE-2026-83131",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Web Applications Desktop Integrator versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTPS network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83131 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83131.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83131"
},
{
"cve": "CVE-2026-83132",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle iStore (E-Business Suite 12.2.3-12.2.15) allows low-privileged attackers with network access to manipulate critical data via HTTP, with a CVSS 3.1 base score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83132 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83132.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83132"
},
{
"cve": "CVE-2026-83133",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle iStore versions 12.2.3 to 12.2.15 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83133 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83133.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83133"
},
{
"cve": "CVE-2026-83134",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle iStore within E-Business Suite versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83134 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83134.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83134"
},
{
"cve": "CVE-2026-83135",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle iStore (E-Business Suite 12.2.3-12.2.15) allows low-privileged attackers with network access and user interaction to create, delete, or modify critical data unauthorizedly.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83135 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83135.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83135"
},
{
"cve": "CVE-2026-83136",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Spares Management versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83136 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83136.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83136"
},
{
"cve": "CVE-2026-83137",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Spares Management versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83137 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83137.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83137"
},
{
"cve": "CVE-2026-83138",
"notes": [
{
"category": "description",
"text": "A high-privileged attacker can exploit a vulnerability in Oracle Spares Management (12.2.3-12.2.15) via HTTP to compromise system confidentiality, integrity, and availability, with a CVSS 3.1 base score of 8.0.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83138 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83138.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83138"
},
{
"cve": "CVE-2026-83140",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Field Service versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 6.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83140 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83140.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83140"
},
{
"cve": "CVE-2026-83141",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Field Service versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83141 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83141.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83141"
},
{
"cve": "CVE-2026-83142",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Proposals within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83142 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83142.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83142"
},
{
"cve": "CVE-2026-83152",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Project Intelligence versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83152 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83152.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83152"
},
{
"cve": "CVE-2026-83157",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Applications Manager versions 12.2.3 to 12.2.15 allows a high-privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, rated CVSS 3.1 base score 8.0.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83157 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83157.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83157"
},
{
"cve": "CVE-2026-83158",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Applications Manager versions 12.2.3 to 12.2.15 allows low-privileged attackers with infrastructure access to compromise system integrity and confidentiality, with a CVSS 3.1 base score of 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83158 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83158.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83158"
},
{
"cve": "CVE-2026-83159",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability (CVSS 7.8) in Oracle E-Business Suite Applications DBA (ADPatch component) versions 12.2.3-12.2.15 allows an unauthenticated attacker with infrastructure logon and user interaction to potentially take control of Applications DBA.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83159 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83159.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83159"
},
{
"cve": "CVE-2026-83161",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Project Intelligence versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to create, delete, modify, or read critical data, with a CVSS 3.1 base score of 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83161 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83161.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83161"
},
{
"cve": "CVE-2026-83162",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Application Object Library versions 12.2.3 to 12.2.15 allows unauthenticated attackers with HTTPS network access to create, delete, or modify critical data, resulting in unauthorized access with a CVSS 3.1 base score of 7.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83162 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83162.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83162"
},
{
"cve": "CVE-2026-83163",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Application Object Library versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83163 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83163.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83163"
},
{
"cve": "CVE-2026-83164",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Customer Interaction History versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83164 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83164.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83164"
},
{
"cve": "CVE-2026-83165",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Customer Interaction History (versions 12.2.3-12.2.15) allows a low-privileged attacker with HTTPS network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83165 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83165.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83165"
},
{
"cve": "CVE-2026-83166",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Customer Interaction History versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83166 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83166.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83166"
},
{
"cve": "CVE-2026-83167",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Application Object Library versions 12.2.3 to 12.2.15 allows unauthenticated remote attackers to access sensitive data via HTTP, with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83167 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83167.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83167"
},
{
"cve": "CVE-2026-83168",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Applications Manager versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTPS network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83168 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83168.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83168"
},
{
"cve": "CVE-2026-83169",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle One-to-One Fulfillment versions 12.2.3 to 12.2.15 allows unauthenticated remote attackers to potentially compromise system confidentiality, integrity, and availability, with a CVSS 3.1 base score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83169 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83169.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83169"
},
{
"cve": "CVE-2026-83170",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle One-to-One Fulfillment (versions 12.2.3-12.2.15) allows a low-privileged attacker with network access to fully compromise the system, impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83170 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83170.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83170"
},
{
"cve": "CVE-2026-83171",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle One-to-One Fulfillment versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data and cause partial denial of service, rated CVSS 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83171 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83171.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83171"
},
{
"cve": "CVE-2026-83172",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Sales Online versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 8.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83172 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83172.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83172"
},
{
"cve": "CVE-2026-83173",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle One-to-One Fulfillment versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data and cause partial denial of service, rated CVSS 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83173 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83173.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83173"
},
{
"cve": "CVE-2026-83174",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle CRM Technical Foundation versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83174 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83174.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83174"
},
{
"cve": "CVE-2026-83175",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Application Object Library versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 6.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83175 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83175.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83175"
},
{
"cve": "CVE-2026-83176",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle E-Business Suite Common Applications (versions 12.2.3-12.2.15) allows a privileged attacker with HTTP network access to potentially compromise the application, with a CVSS 3.1 base score of 7.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83176 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83176.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83176"
},
{
"cve": "CVE-2026-83177",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle One-to-One Fulfillment (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83177 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83177.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83177"
},
{
"cve": "CVE-2026-83178",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Application Object Library versions 12.2.3 to 12.2.15 allows a highly privileged attacker with HTTP network access to potentially take control of the component, impacting Oracle E-Business Suite products, with a CVSS 3.1 score of 8.0.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83178 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83178.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83178"
},
{
"cve": "CVE-2026-83179",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle E-Business Suite Common Applications Calendar (12.2.3-12.2.15) allows low-privileged network attackers to modify critical data, gain unauthorized access, and cause partial denial of service, with a CVSS 3.1 score of 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83179 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83179.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83179"
},
{
"cve": "CVE-2026-83184",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Application Object Library versions 12.2.3 to 12.2.15 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical data, resulting in unauthorized access with a CVSS 3.1 base score of 7.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83184 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83184.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83184"
},
{
"cve": "CVE-2026-83185",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle E-Business Suite Common Applications (12.2.3-12.2.15) allows low-privileged attackers with network access and user interaction to modify critical data, with a CVSS 3.1 base score of 7.3 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83185 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83185.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83185"
},
{
"cve": "CVE-2026-83186",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle E-Business Suite Common Applications Calendar (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, or modify critical data and cause partial denial of service, rated CVSS 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83186 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83186.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83186"
},
{
"cve": "CVE-2026-83187",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle E-Business Suite Common Applications Calendar (12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, modify, or read critical data, with a CVSS 3.1 base score of 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83187 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83187.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83187"
},
{
"cve": "CVE-2026-83188",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Depot Repair versions 12.2.3 to 12.2.15 allows a highly privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83188 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83188.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83188"
},
{
"cve": "CVE-2026-83189",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle E-Business Suite User Management (Proxy User Delegation) versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to potentially compromise system confidentiality, integrity, and availability (CVSS 8.8).",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83189 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83189.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83189"
},
{
"cve": "CVE-2026-83194",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Depot Repair versions 12.2.10 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83194 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83194.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83194"
},
{
"cve": "CVE-2026-83198",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Field Service versions 12.2.3 to 12.2.15 allows a low-privileged attacker with network access and user interaction to gain unauthorized read and write access to certain data, with a CVSS 3.1 base score of 5.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83198 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83198.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83198"
},
{
"cve": "CVE-2026-83200",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Process Manufacturing Intelligence (versions 12.2.3-12.2.15) allows a low-privileged attacker with network access via Oracle Net to gain unauthorized access to critical data, with a CVSS 3.1 base score of 6.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83200 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83200.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83200"
},
{
"cve": "CVE-2026-83204",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Sourcing within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to potentially compromise system confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83204 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83204.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83204"
},
{
"cve": "CVE-2026-83205",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Applications Framework versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83205 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83205.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83205"
},
{
"cve": "CVE-2026-83300",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle XML Gateway for Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data and cause partial denial of service, rated CVSS 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83300 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83300.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83300"
},
{
"cve": "CVE-2026-83327",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"notes": [
{
"category": "other",
"text": "Missing Authentication for Critical Function",
"title": "CWE-306"
},
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Applications Framework versions 12.2.3 to 12.2.15 via SOAP has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83327 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83327.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83327"
},
{
"cve": "CVE-2026-83328",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Applications Framework versions 12.2.3 to 12.2.15 allows a highly privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83328 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83328.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83328"
},
{
"cve": "CVE-2026-83329",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Applications Framework versions 12.2.9 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8 indicating high severity.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83329 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83329.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83329"
},
{
"cve": "CVE-2026-83331",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Applications Framework versions 12.2.9 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8 indicating high severity.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83331 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83331.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83331"
},
{
"cve": "CVE-2026-83332",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Applications Framework versions 12.2.9 to 12.2.15 allows low-privileged attackers with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83332 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83332.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83332"
},
{
"cve": "CVE-2026-83338",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Applications Manager versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83338 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83338.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83338"
},
{
"cve": "CVE-2026-83341",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Applications Manager versions 12.2.3 to 12.2.15 allows unauthenticated attackers with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83341 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83341.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83341"
},
{
"cve": "CVE-2026-83345",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle XML Gateway for Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data and cause partial denial of service, rated CVSS 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83345 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83345.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83345"
},
{
"cve": "CVE-2026-83352",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle XML Gateway for Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data and cause partial denial of service, rated CVSS 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83352 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83352.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83352"
},
{
"cve": "CVE-2026-83356",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle E-Business Suite Enterprise Command Center Framework 16 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated CVSS 3.1 base score 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83356 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83356.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83356"
},
{
"cve": "CVE-2026-83425",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Complex Maintenance, Repair and Overhaul (versions 12.2.12-12.2.15) allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data and cause partial denial of service, rated CVSS 8.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83425 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83425.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83425"
},
{
"cve": "CVE-2026-83428",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Demand Signal Repository (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83428 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83428.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83428"
},
{
"cve": "CVE-2026-83429",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Demand Signal Repository (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83429 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83429.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83429"
},
{
"cve": "CVE-2026-83430",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Product Workbench versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83430 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83430.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83430"
},
{
"cve": "CVE-2026-83431",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Product Workbench versions 12.2.3 to 12.2.15 allows a low-privileged attacker with network access and user interaction to gain unauthorized read and write access to certain data, with a CVSS 3.1 base score of 5.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83431 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83431.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83431"
},
{
"cve": "CVE-2026-83432",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Depot Repair for E-Business Suite versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83432 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83432.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83432"
},
{
"cve": "CVE-2026-83433",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Depot Repair (versions 12.2.3-12.2.15) allows a high-privileged attacker with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 6.5 indicating significant confidentiality and integrity impacts.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83433 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83433.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83433"
},
{
"cve": "CVE-2026-83434",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Product Workbench versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83434 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83434.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83434"
},
{
"cve": "CVE-2026-83435",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle E-Business Suite Oracle Bills of Material (versions 12.2.13-12.2.15) allows low-privileged network attackers to create, delete, or modify critical data, with a CVSS 3.1 score of 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83435 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83435.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83435"
},
{
"cve": "CVE-2026-83436",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Depot Repair for E-Business Suite versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to gain unauthorized critical data access and cause partial denial of service, rated CVSS 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83436 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83436.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83436"
},
{
"cve": "CVE-2026-83437",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Engineering within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated CVSS 3.1 base score 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83437 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83437.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83437"
},
{
"cve": "CVE-2026-83438",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83438 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83438.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83438"
},
{
"cve": "CVE-2026-83440",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows a highly privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 7.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83440 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83440.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83440"
},
{
"cve": "CVE-2026-83441",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to create, delete, or modify critical data, leading to unauthorized access with a CVSS 3.1 base score of 6.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83441 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83441.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83441"
},
{
"cve": "CVE-2026-83442",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows a highly privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 7.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83442 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83442.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83442"
},
{
"cve": "CVE-2026-83443",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Assets versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 6.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83443 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83443.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83443"
},
{
"cve": "CVE-2026-83444",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, with a CVSS 3.1 score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83444 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83444.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83444"
},
{
"cve": "CVE-2026-83445",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Complex Maintenance, Repair and Overhaul (versions 12.2.3 to 12.2.15) allows a low-privileged attacker with HTTPS network access to fully compromise the system, rated CVSS 3.1 base score 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83445 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83445.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83445"
},
{
"cve": "CVE-2026-83446",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Financials Common Modules (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83446 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83446.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83446"
},
{
"cve": "CVE-2026-83447",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Bills of Material versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83447 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83447.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83447"
},
{
"cve": "CVE-2026-83448",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Bills of Material versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83448 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83448.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83448"
},
{
"cve": "CVE-2026-83449",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Bills of Material versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data and cause partial denial of service, rated CVSS 8.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83449 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83449.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83449"
},
{
"cve": "CVE-2026-83450",
"notes": [
{
"category": "description",
"text": "A high privileged attacker with network access can exploit a critical vulnerability in Oracle Bills of Material (versions 12.2.3-12.2.15) to compromise the product and related Oracle E-Business Suite components, with a CVSS 3.1 score of 8.0.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83450 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83450.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83450"
},
{
"cve": "CVE-2026-83451",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Product Workbench versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to potentially compromise confidentiality, integrity, and availability, rated CVSS 3.1 base score 8.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83451 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83451.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83451"
},
{
"cve": "CVE-2026-83452",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"notes": [
{
"category": "other",
"text": "Missing Authentication for Critical Function",
"title": "CWE-306"
},
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Document Management and Collaboration (versions 12.2.3-12.2.15) with a CVSS 3.1 base score of 9.8 impacts confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83452 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83452.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83452"
},
{
"cve": "CVE-2026-83453",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Document Management and Collaboration (versions 12.2.3-12.2.15) allows a privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83453 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83453.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83453"
},
{
"cve": "CVE-2026-83454",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Document Management and Collaboration (versions 12.2.3-12.2.15) allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83454 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83454.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83454"
},
{
"cve": "CVE-2026-83455",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Demand Signal Repository (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83455 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83455.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83455"
},
{
"cve": "CVE-2026-83456",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Demand Signal Repository versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83456 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83456.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83456"
},
{
"cve": "CVE-2026-83457",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Demand Signal Repository (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to cause unauthorized data modification, deletion, or system crashes, with a CVSS 3.1 score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83457 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83457.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83457"
},
{
"cve": "CVE-2026-83461",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Mobile Application Server versions 12.2.3 to 12.2.15 allows unauthenticated attackers to access sensitive data and cause partial denial of service, rated with a CVSS 3.1 base score of 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83461 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83461.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83461"
},
{
"cve": "CVE-2026-83462",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"notes": [
{
"category": "other",
"text": "Missing Authentication for Critical Function",
"title": "CWE-306"
},
{
"category": "description",
"text": "A critical vulnerability in Oracle Mobile Application Server versions 12.2.3 to 12.2.15 allows unauthenticated network attackers to fully compromise the server, with a CVSS 3.1 base score of 9.8 indicating severe impacts on confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83462 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83462.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83462"
},
{
"cve": "CVE-2026-83463",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Mobile Application Server versions 12.2.3 to 12.2.15 allows an unauthenticated attacker with physical network access to potentially fully compromise the server, with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83463 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83463.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83463"
},
{
"cve": "CVE-2026-83464",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Mobile Application Server versions 12.2.3 through 12.2.15 allows unauthenticated network attackers to potentially take control of the server, with a CVSS 3.1 base score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83464 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83464.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83464"
},
{
"cve": "CVE-2026-83465",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Mobile Application Server versions 12.2.3 to 12.2.15 allows unauthenticated attackers with HTTP network access to cause denial of service and unauthorized data modification, with a CVSS 3.1 base score of 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83465 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83465.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83465"
},
{
"cve": "CVE-2026-83477",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Work in Process (versions 12.2.3-12.2.15) permits unauthenticated attackers with network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83477 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83477.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83477"
},
{
"cve": "CVE-2026-83479",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Contracts versions 12.2.14 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83479 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83479.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83479"
},
{
"cve": "CVE-2026-83481",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Contracts versions 12.2.14 to 12.2.15 allows a privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, rated CVSS 3.1 score 7.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83481 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83481.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83481"
},
{
"cve": "CVE-2026-83482",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Contracts versions 12.2.14 to 12.2.15 allows a privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, rated CVSS 3.1 score 7.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83482 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83482.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83482"
},
{
"cve": "CVE-2026-83483",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Advanced Benefits (versions 12.2.3-12.2.15) of Oracle E-Business Suite allows a high privileged attacker with HTTP network access to potentially compromise confidentiality, integrity, and availability, rated CVSS 8.0.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83483 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83483.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83483"
},
{
"cve": "CVE-2026-83484",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle US Federal Human Resources (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, modify, or read critical data, with a CVSS 3.1 base score of 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83484 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83484.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83484"
},
{
"cve": "CVE-2026-83485",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Product Hub within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83485 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83485.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83485"
},
{
"cve": "CVE-2026-83486",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Product Hub within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83486 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83486.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83486"
},
{
"cve": "CVE-2026-83487",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Product Hub within Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83487 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83487.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83487"
},
{
"cve": "CVE-2026-83490",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle iRecruitment versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 8.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83490 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83490.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83490"
},
{
"cve": "CVE-2026-83491",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle iRecruitment versions 12.2.3 to 12.2.15 allows unauthenticated attackers with network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 6.8 indicating significant confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83491 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83491.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-83491"
},
{
"cve": "CVE-2026-87124",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle iRecruitment versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, with a CVSS 3.1 base score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87124 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87124.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87124"
},
{
"cve": "CVE-2026-87125",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Financials for Asia/Pacific (versions 12.2.8-12.2.15) enables a low-privileged attacker with HTTP network access to gain unauthorized access, modify critical data, or cause partial denial of service, with a CVSS 3.1 score of 8.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87125 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87125.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87125"
},
{
"cve": "CVE-2026-87126",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Report Manager versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data or cause partial denial of service, rated CVSS 3.1 base score 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87126 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87126.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87126"
},
{
"cve": "CVE-2026-87127",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Purchasing versions 12.2.10 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, with a CVSS 3.1 base score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87127 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87127.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87127"
},
{
"cve": "CVE-2026-87149",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Contract Lifecycle Management for Public Sector (versions 12.2.8-12.2.15) allows low-privileged attackers with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 score of 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87149 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87149.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87149"
},
{
"cve": "CVE-2026-87150",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Bills of Material versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87150 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87150.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87150"
},
{
"cve": "CVE-2026-87151",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle E-Business Suite\u0027s Oracle Bills of Material (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to gain unauthorized access to critical data, rated CVSS 3.1 base score 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87151 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87151.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87151"
},
{
"cve": "CVE-2026-87152",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle E-Business Suite Installed Base (versions 12.2.3-12.2.15) allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, scoring 8.1 on CVSS 3.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87152 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87152.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87152"
},
{
"cve": "CVE-2026-87153",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87153 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87153.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87153"
},
{
"cve": "CVE-2026-87154",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87154 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87154.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87154"
},
{
"cve": "CVE-2026-87155",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, with a CVSS 3.1 score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87155 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87155.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87155"
},
{
"cve": "CVE-2026-87156",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 7.1 indicating significant confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87156 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87156.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87156"
},
{
"cve": "CVE-2026-87157",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Order Management versions 12.2.4 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87157 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87157.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87157"
},
{
"cve": "CVE-2026-87158",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Order Management V16 allows a low-privileged attacker with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 7.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87158 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87158.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87158"
},
{
"cve": "CVE-2026-87159",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle HRMS (India) for Oracle E-Business Suite 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data unauthorizedly.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87159 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87159.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87159"
},
{
"cve": "CVE-2026-87160",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle HRMS (India) for Oracle E-Business Suite versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTPS network access to gain unauthorized access and modify critical data, with a CVSS 3.1 score of 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87160 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87160.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87160"
},
{
"cve": "CVE-2026-87161",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle HRMS (India) versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 8.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87161 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87161.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87161"
},
{
"cve": "CVE-2026-87162",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Contract Lifecycle Management for Public Sector (versions 12.2.13-12.2.15) allows a low-privileged attacker with HTTP network access to fully compromise the system, rated CVSS 3.1 base score 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87162 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87162.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87162"
},
{
"cve": "CVE-2026-87163",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Purchasing versions 12.2.3 to 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8 indicating high impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87163 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87163.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87163"
},
{
"cve": "CVE-2026-87165",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Contract Lifecycle Management for Public Sector (v16) allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87165 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87165.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87165"
},
{
"cve": "CVE-2026-87166",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Purchasing versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87166 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87166.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87166"
},
{
"cve": "CVE-2026-87167",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle E-Business Suite\u0027s Oracle Purchasing (G-Invoicing) versions 12.2.11-12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data unauthorizedly.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87167 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87167.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87167"
},
{
"cve": "CVE-2026-87168",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Purchasing versions 12.2.10 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87168 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87168.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87168"
},
{
"cve": "CVE-2026-87169",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Contract Lifecycle Management for Public Sector (versions 12.2.3-12.2.15) allows unauthenticated network attackers to perform unauthorized read and write operations via HTTP, with a CVSS 3.1 base score of 6.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87169 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87169.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87169"
},
{
"cve": "CVE-2026-87265",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Purchasing versions 12.2.3 to 12.2.15 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87265 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87265.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5"
]
}
],
"title": "CVE-2026-87265"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…