{"document":{"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"text":"Copyright © Oracle. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp"}},"lang":"en","publisher":{"category":"vendor","name":"Oracle","namespace":"https://www.oracle.com"},"references":[{"summary":"URL to html version of Advisory","url":"https://www.oracle.com/security-alerts/cpuoct2026.html"},{"category":"self","summary":"Canonical URL for this CSAF document.","url":"https://www.oracle.com/docs/tech/security-alerts/cpuoct2026csaf.json"}],"title":"Oracle Critical Patch Update Advisory - October 2026 - Oracle CSAF","tracking":{"current_release_date":"2026-10-20T13:00:00-07:00","id":"cpuoct2026csaf","initial_release_date":"2026-10-20T13:00:00-07:00","revision_history":[{"date":"2026-10-20T13:00:00-07:00","number":"1","summary":"Initial Release."}],"status":"final","version":"1"}},"product_tree":{"branches":[{"branches":[{"branches":[{"branches":[{"category":"product_version_range","name":">=24.1.0|<=24.1.19","product":{"name":"Oracle APEX Version 24.1.0-24.1.19","product_id":"P-1348V-24.1.0-24.1.19","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:apex:24.1.0-24.1.19:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=24.1.0|<=24.1.21","product":{"name":"Oracle APEX Version 24.1.0-24.1.21","product_id":"P-1348V-24.1.0-24.1.21","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:apex:24.1.0-24.1.21:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=24.2.0|<=24.2.18","product":{"name":"Oracle APEX Version 24.2.0-24.2.18","product_id":"P-1348V-24.2.0-24.2.18","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:apex:24.2.0-24.2.18:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=24.2.0|<=24.2.20","product":{"name":"Oracle APEX Version 24.2.0-24.2.20","product_id":"P-1348V-24.2.0-24.2.20","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:apex:24.2.0-24.2.20:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=26.1.0|<=26.1.2","product":{"name":"Oracle APEX Version 26.1.0-26.1.2","product_id":"P-1348V-26.1.0-26.1.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:apex:26.1.0-26.1.2:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=26.1.0|<=26.1.4","product":{"name":"Oracle APEX Version 26.1.0-26.1.4","product_id":"P-1348V-26.1.0-26.1.4","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:apex:26.1.0-26.1.4:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle APEX"}],"category":"product_family","name":"Oracle APEX"},{"branches":[{"branches":[{"category":"product_version","name":"Oracle BI Publisher Version 12.2.1.4.0","product":{"name":"Oracle BI Publisher Version 12.2.1.4.0","product_id":"P-1479V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle BI Publisher Version 26.01.0.0.0","product":{"name":"Oracle BI Publisher Version 26.01.0.0.0","product_id":"P-1479V-26.01.0.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:bi_publisher:26.01.0.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle BI Publisher Version 8.2.0.0.0","product":{"name":"Oracle BI Publisher Version 8.2.0.0.0","product_id":"P-1479V-8.2.0.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:bi_publisher:8.2.0.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle BI Publisher"},{"branches":[{"category":"product_version","name":"Oracle Business Intelligence Enterprise Edition Version 12.2.1.4.0","product":{"name":"Oracle Business Intelligence Enterprise Edition Version 12.2.1.4.0","product_id":"P-2025V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*"}}},{"category":"product_version","name":"Oracle Business Intelligence Enterprise Edition Version 26.01.0.0.0","product":{"name":"Oracle Business Intelligence Enterprise Edition Version 26.01.0.0.0","product_id":"P-2025V-26.01.0.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:business_intelligence:26.01.0.0.0:*:*:*:enterprise:*:*:*"}}},{"category":"product_version","name":"Oracle Business Intelligence Enterprise Edition Version 8.2.0.0.0","product":{"name":"Oracle Business Intelligence Enterprise Edition Version 8.2.0.0.0","product_id":"P-2025V-8.2.0.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:business_intelligence:8.2.0.0.0:*:*:*:enterprise:*:*:*"}}}],"category":"product_name","name":"Oracle Business Intelligence Enterprise Edition"}],"category":"product_family","name":"Oracle Analytics"},{"branches":[{"branches":[{"category":"product_version","name":"Oracle Application Testing Suite Version 13.3.0.1","product":{"name":"Oracle Application Testing Suite Version 13.3.0.1","product_id":"P-4622V-13.3.0.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Application Testing Suite"}],"category":"product_family","name":"Oracle Application Testing Suite"},{"branches":[{"branches":[{"category":"product_version_range","name":">=26.3|<=26.8","product":{"name":"Oracle Autonomous Health Framework Version 26.3-26.8","product_id":"P-14634V-26.3-26.8","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:autonomous_health_framework:26.3-26.8:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Autonomous Health Framework"}],"category":"product_family","name":"Oracle Autonomous Health Framework"},{"branches":[{"branches":[{"category":"product_version","name":"Oracle Commerce Platform Version 11.4.0","product":{"name":"Oracle Commerce Platform Version 11.4.0","product_id":"P-9348V-11.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:commerce_platform:11.4.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Commerce Platform"}],"category":"product_family","name":"Oracle Commerce"},{"branches":[{"branches":[{"category":"product_version","name":"Oracle Communications BRM - Elastic Charging Engine Version 15.0.0.0.0","product":{"name":"Oracle Communications BRM - Elastic Charging Engine Version 15.0.0.0.0","product_id":"P-9742V-15.0.0.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:15.0.0.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications BRM - Elastic Charging Engine Version 15.0.1.0.0","product":{"name":"Oracle Communications BRM - Elastic Charging Engine Version 15.0.1.0.0","product_id":"P-9742V-15.0.1.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:15.0.1.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications BRM - Elastic Charging Engine Version 15.1.0.0.0","product":{"name":"Oracle Communications BRM - Elastic Charging Engine Version 15.1.0.0.0","product_id":"P-9742V-15.1.0.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:15.1.0.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications BRM - Elastic Charging Engine Version 15.2.0.0.0","product":{"name":"Oracle Communications BRM - Elastic Charging Engine Version 15.2.0.0.0","product_id":"P-9742V-15.2.0.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_brm_-_elastic_charging_engine:15.2.0.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Communications BRM - Elastic Charging Engine"},{"branches":[{"category":"product_version","name":"Oracle Communications Billing and Revenue Management(Oracle Communications Billing and Revenue Management_BRM Server) Version 15.0.0.0.0","product":{"name":"Oracle Communications Billing and Revenue Management(Oracle Communications Billing and Revenue Management_BRM Server) Version 15.0.0.0.0","product_id":"P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_billing_and_revenue_management:15.0.0.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Billing and Revenue Management(Oracle Communications Billing and Revenue Management_Platform) Version 15.0.0.0.0","product":{"name":"Oracle Communications Billing and Revenue Management(Oracle Communications Billing and Revenue Management_Platform) Version 15.0.0.0.0","product_id":"P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.0.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_billing_and_revenue_management:15.0.0.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Billing and Revenue Management(Oracle Communications Billing and Revenue Management_BRM Server) Version 15.0.1.0.0","product":{"name":"Oracle Communications Billing and Revenue Management(Oracle Communications Billing and Revenue Management_BRM Server) Version 15.0.1.0.0","product_id":"P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_billing_and_revenue_management:15.0.1.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Billing and Revenue Management(Oracle Communications Billing and Revenue Management_Platform) Version 15.0.1.0.0","product":{"name":"Oracle Communications Billing and Revenue Management(Oracle Communications Billing and Revenue Management_Platform) Version 15.0.1.0.0","product_id":"P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.1.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_billing_and_revenue_management:15.0.1.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Billing and Revenue Management(Oracle Communications Billing and Revenue Management_BRM Server) Version 15.1.0.0.0","product":{"name":"Oracle Communications Billing and Revenue Management(Oracle Communications Billing and Revenue Management_BRM Server) Version 15.1.0.0.0","product_id":"P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_billing_and_revenue_management:15.1.0.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Billing and Revenue Management(Oracle Communications Billing and Revenue Management_Platform) Version 15.1.0.0.0","product":{"name":"Oracle Communications Billing and Revenue Management(Oracle Communications Billing and Revenue Management_Platform) Version 15.1.0.0.0","product_id":"P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.1.0.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_billing_and_revenue_management:15.1.0.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Billing and Revenue Management(Oracle Communications Billing and Revenue Management_BRM Server) Version 15.2.0.0.0","product":{"name":"Oracle Communications Billing and Revenue Management(Oracle Communications Billing and Revenue Management_BRM Server) Version 15.2.0.0.0","product_id":"P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_billing_and_revenue_management:15.2.0.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Billing and Revenue Management(Oracle Communications Billing and Revenue Management_Platform) Version 15.2.0.0.0","product":{"name":"Oracle Communications Billing and Revenue Management(Oracle Communications Billing and Revenue Management_Platform) Version 15.2.0.0.0","product_id":"P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.2.0.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_billing_and_revenue_management:15.2.0.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Communications Billing and Revenue Management"},{"branches":[{"category":"product_version","name":"Oracle Communications Cloud Native Core Binding Support Function Version 25.2.200","product":{"name":"Oracle Communications Cloud Native Core Binding Support Function Version 25.2.200","product_id":"P-14121V-25.2.200","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:25.2.200:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Cloud Native Core Binding Support Function Version 25.2.201","product":{"name":"Oracle Communications Cloud Native Core Binding Support Function Version 25.2.201","product_id":"P-14121V-25.2.201","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:25.2.201:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Communications Cloud Native Core Binding Support Function"},{"branches":[{"category":"product_version","name":"Oracle Communications Cloud Native Core Certificate Management Version 25.2.201","product":{"name":"Oracle Communications Cloud Native Core Certificate Management Version 25.2.201","product_id":"P-14868V-25.2.201","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_certificate_management:25.2.201:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Cloud Native Core Certificate Management Version 26.1.200","product":{"name":"Oracle Communications Cloud Native Core Certificate Management Version 26.1.200","product_id":"P-14868V-26.1.200","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_certificate_management:26.1.200:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Communications Cloud Native Core Certificate Management"},{"branches":[{"category":"product_version","name":"Oracle Communications Cloud Native Core Console Version 25.2.202","product":{"name":"Oracle Communications Cloud Native Core Console Version 25.2.202","product_id":"P-14250V-25.2.202","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_console:25.2.202:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Cloud Native Core Console Version 26.1.200","product":{"name":"Oracle Communications Cloud Native Core Console Version 26.1.200","product_id":"P-14250V-26.1.200","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_console:26.1.200:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Communications Cloud Native Core Console"},{"branches":[{"category":"product_version","name":"Oracle Communications Cloud Native Core Network Repository Function(Oracle Communications Cloud Native Core Network Repository Function_Install) Version 25.2.202","product":{"name":"Oracle Communications Cloud Native Core Network Repository Function(Oracle Communications Cloud Native Core Network Repository Function_Install) Version 25.2.202","product_id":"P-14118(Oracle Communications Cloud Native Core Network Repository Function_Install)V-25.2.202","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:25.2.202:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Cloud Native Core Network Repository Function(Oracle Communications Cloud Native Core Network Repository Function_Install) Version 26.1.202","product":{"name":"Oracle Communications Cloud Native Core Network Repository Function(Oracle Communications Cloud Native Core Network Repository Function_Install) Version 26.1.202","product_id":"P-14118(Oracle Communications Cloud Native Core Network Repository Function_Install)V-26.1.202","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_network_repository_function:26.1.202:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Communications Cloud Native Core Network Repository Function"},{"branches":[{"category":"product_version","name":"Oracle Communications Cloud Native Core Network Slice Selection Function Version 25.2.200","product":{"name":"Oracle Communications Cloud Native Core Network Slice Selection Function Version 25.2.200","product_id":"P-14130V-25.2.200","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:25.2.200:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Communications Cloud Native Core Network Slice Selection Function"},{"branches":[{"category":"product_version_range","name":">=24.2.4|<=25.2.000","product":{"name":"Oracle Communications Cloud Native Core Policy Version 24.2.4-25.2.000","product_id":"P-14277V-24.2.4-25.2.000","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_policy:24.2.4-25.2.000:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Cloud Native Core Policy Version 25.2.200","product":{"name":"Oracle Communications Cloud Native Core Policy Version 25.2.200","product_id":"P-14277V-25.2.200","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_policy:25.2.200:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Communications Cloud Native Core Policy"},{"branches":[{"category":"product_version","name":"Oracle Communications Cloud Native Core Security Edge Protection Proxy(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework) Version 25.2.200","product":{"name":"Oracle Communications Cloud Native Core Security Edge Protection Proxy(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework) Version 25.2.200","product_id":"P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:25.2.200:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Cloud Native Core Security Edge Protection Proxy(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install) Version 25.2.200","product":{"name":"Oracle Communications Cloud Native Core Security Edge Protection Proxy(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install) Version 25.2.200","product_id":"P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-25.2.200","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:25.2.200:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Cloud Native Core Security Edge Protection Proxy(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling) Version 25.2.200","product":{"name":"Oracle Communications Cloud Native Core Security Edge Protection Proxy(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling) Version 25.2.200","product_id":"P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:25.2.200:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Cloud Native Core Security Edge Protection Proxy(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework) Version 25.2.201","product":{"name":"Oracle Communications Cloud Native Core Security Edge Protection Proxy(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework) Version 25.2.201","product_id":"P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.201","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:25.2.201:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Cloud Native Core Security Edge Protection Proxy(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework) Version 26.1.200","product":{"name":"Oracle Communications Cloud Native Core Security Edge Protection Proxy(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework) Version 26.1.200","product_id":"P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:26.1.200:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Cloud Native Core Security Edge Protection Proxy(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install) Version 26.1.200","product":{"name":"Oracle Communications Cloud Native Core Security Edge Protection Proxy(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install) Version 26.1.200","product_id":"P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-26.1.200","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:26.1.200:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Cloud Native Core Security Edge Protection Proxy(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling) Version 26.1.200","product":{"name":"Oracle Communications Cloud Native Core Security Edge Protection Proxy(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling) Version 26.1.200","product_id":"P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:26.1.200:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Communications Cloud Native Core Security Edge Protection Proxy"},{"branches":[{"category":"product_version","name":"Oracle Communications Cloud Native Core Service Communication Proxy Version 25.1.100","product":{"name":"Oracle Communications Cloud Native Core Service Communication Proxy Version 25.1.100","product_id":"P-14117V-25.1.100","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:25.1.100:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Cloud Native Core Service Communication Proxy Version 25.1.200","product":{"name":"Oracle Communications Cloud Native Core Service Communication Proxy Version 25.1.200","product_id":"P-14117V-25.1.200","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:25.1.200:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Cloud Native Core Service Communication Proxy Version 25.2.100","product":{"name":"Oracle Communications Cloud Native Core Service Communication Proxy Version 25.2.100","product_id":"P-14117V-25.2.100","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:25.2.100:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Cloud Native Core Service Communication Proxy Version 25.2.200","product":{"name":"Oracle Communications Cloud Native Core Service Communication Proxy Version 25.2.200","product_id":"P-14117V-25.2.200","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:25.2.200:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Cloud Native Core Service Communication Proxy Version 26.1.200","product":{"name":"Oracle Communications Cloud Native Core Service Communication Proxy Version 26.1.200","product_id":"P-14117V-26.1.200","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:26.1.200:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Communications Cloud Native Core Service Communication Proxy"},{"branches":[{"category":"product_version","name":"Oracle Communications Cloud Native Core Unified Data Repository Version 25.1.200","product":{"name":"Oracle Communications Cloud Native Core Unified Data Repository Version 25.1.200","product_id":"P-14119V-25.1.200","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:25.1.200:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Cloud Native Core Unified Data Repository Version 25.2.200","product":{"name":"Oracle Communications Cloud Native Core Unified Data Repository Version 25.2.200","product_id":"P-14119V-25.2.200","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:25.2.200:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Cloud Native Core Unified Data Repository Version 26.1.200","product":{"name":"Oracle Communications Cloud Native Core Unified Data Repository Version 26.1.200","product_id":"P-14119V-26.1.200","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:26.1.200:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Communications Cloud Native Core Unified Data Repository"},{"branches":[{"category":"product_version","name":"Oracle Communications EAGLE Element Management System Version 47.0.0.2.0","product":{"name":"Oracle Communications EAGLE Element Management System Version 47.0.0.2.0","product_id":"P-11125V-47.0.0.2.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_eagle_element_management_system:47.0.0.2.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Communications EAGLE Element Management System"},{"branches":[{"category":"product_version","name":"Oracle Communications EAGLE LNP Application Processor Version 11.0","product":{"name":"Oracle Communications EAGLE LNP Application Processor Version 11.0","product_id":"P-11118V-11.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_eagle_lnp_application_processor:11.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Communications EAGLE LNP Application Processor"},{"branches":[{"category":"product_version","name":"Oracle Communications LSMS Version 14.0","product":{"name":"Oracle Communications LSMS Version 14.0","product_id":"P-11114V-14.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_lsms:14.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Communications LSMS"},{"branches":[{"category":"product_version","name":"Oracle Communications Network Analytics Data Director Version 25.1.200","product":{"name":"Oracle Communications Network Analytics Data Director Version 25.1.200","product_id":"P-14547V-25.1.200","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_network_analytics_data_director:25.1.200:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Network Analytics Data Director Version 25.2.100","product":{"name":"Oracle Communications Network Analytics Data Director Version 25.2.100","product_id":"P-14547V-25.2.100","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_network_analytics_data_director:25.2.100:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Network Analytics Data Director Version 25.2.200","product":{"name":"Oracle Communications Network Analytics Data Director Version 25.2.200","product_id":"P-14547V-25.2.200","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_network_analytics_data_director:25.2.200:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Communications Network Analytics Data Director"},{"branches":[{"category":"product_version","name":"Oracle Communications Operations Monitor Version 6.0","product":{"name":"Oracle Communications Operations Monitor Version 6.0","product_id":"P-10761V-6.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_operations_monitor:6.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Operations Monitor Version 6.1","product":{"name":"Oracle Communications Operations Monitor Version 6.1","product_id":"P-10761V-6.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_operations_monitor:6.1:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Communications Operations Monitor"},{"branches":[{"category":"product_version","name":"Oracle Communications Policy Management Version 15.0.0.0.0","product":{"name":"Oracle Communications Policy Management Version 15.0.0.0.0","product_id":"P-10900V-15.0.0.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_policy_management:15.0.0.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Policy Management Version 15.1.0.0.0","product":{"name":"Oracle Communications Policy Management Version 15.1.0.0.0","product_id":"P-10900V-15.1.0.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_policy_management:15.1.0.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Communications Policy Management"},{"branches":[{"category":"product_version_range","name":">=8.0|<=8.1","product":{"name":"Oracle Communications Service Catalog and Design Version 8.0-8.1","product_id":"P-2283V-8.0-8.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_service_catalog_and_design:8.0-8.1:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=8.0|<=8.3","product":{"name":"Oracle Communications Service Catalog and Design Version 8.0-8.3","product_id":"P-2283V-8.0-8.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_service_catalog_and_design:8.0-8.3:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Communications Service Catalog and Design"},{"branches":[{"category":"product_version_range","name":">=6.1.1|<=7.0.0","product":{"name":"Oracle Communications Unified Assurance Version 6.1.1-7.0.0","product_id":"P-14597V-6.1.1-7.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_unified_assurance:6.1.1-7.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Unified Assurance Version 7.0.0","product":{"name":"Oracle Communications Unified Assurance Version 7.0.0","product_id":"P-14597V-7.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_unified_assurance:7.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Communications Unified Assurance"},{"branches":[{"category":"product_version","name":"Oracle Communications Unified Inventory Management Version 7.5.0","product":{"name":"Oracle Communications Unified Inventory Management Version 7.5.0","product_id":"P-4516V-7.5.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_unified_inventory_management:7.5.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Unified Inventory Management Version 7.5.1","product":{"name":"Oracle Communications Unified Inventory Management Version 7.5.1","product_id":"P-4516V-7.5.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_unified_inventory_management:7.5.1:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Unified Inventory Management Version 7.6.0","product":{"name":"Oracle Communications Unified Inventory Management Version 7.6.0","product_id":"P-4516V-7.6.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_unified_inventory_management:7.6.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Unified Inventory Management Version 7.7.0","product":{"name":"Oracle Communications Unified Inventory Management Version 7.7.0","product_id":"P-4516V-7.7.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_unified_inventory_management:7.7.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Unified Inventory Management Version 7.8.0","product":{"name":"Oracle Communications Unified Inventory Management Version 7.8.0","product_id":"P-4516V-7.8.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_unified_inventory_management:7.8.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Communications Unified Inventory Management Version 8.0.1","product":{"name":"Oracle Communications Unified Inventory Management Version 8.0.1","product_id":"P-4516V-8.0.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:communications_unified_inventory_management:8.0.1:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Communications Unified Inventory Management"}],"category":"product_family","name":"Oracle Communications"},{"branches":[{"branches":[{"category":"product_version_range","name":">=21.12.0|<=21.12.18","product":{"name":"Primavera Gateway Version 21.12.0-21.12.18","product_id":"P-10605V-21.12.0-21.12.18","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:primavera_gateway:21.12.0-21.12.18:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Primavera Gateway"},{"branches":[{"category":"product_version_range","name":">=21.12.0.0|<=21.12.21.9","product":{"name":"Primavera P6 Enterprise Project Portfolio Management Version 21.12.0.0-21.12.21.9","product_id":"P-5579V-21.12.0.0-21.12.21.9","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:21.12.0.0-21.12.21.9:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=22.12.0.0|<=22.12.21.4","product":{"name":"Primavera P6 Enterprise Project Portfolio Management Version 22.12.0.0-22.12.21.4","product_id":"P-5579V-22.12.0.0-22.12.21.4","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:22.12.0.0-22.12.21.4:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.12.0|<=23.12.20","product":{"name":"Primavera P6 Enterprise Project Portfolio Management Version 23.12.0-23.12.20","product_id":"P-5579V-23.12.0-23.12.20","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:23.12.0-23.12.20:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=24.12.0|<=24.12.16","product":{"name":"Primavera P6 Enterprise Project Portfolio Management Version 24.12.0-24.12.16","product_id":"P-5579V-24.12.0-24.12.16","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:24.12.0-24.12.16:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=25.12.0|<=25.12.8","product":{"name":"Primavera P6 Enterprise Project Portfolio Management Version 25.12.0-25.12.8","product_id":"P-5579V-25.12.0-25.12.8","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:25.12.0-25.12.8:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Primavera P6 Enterprise Project Portfolio Management"},{"branches":[{"category":"product_version_range","name":">=21.12.0|<=21.12.17","product":{"name":"Primavera Unifier Version 21.12.0-21.12.17","product_id":"P-10354V-21.12.0-21.12.17","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:primavera_unifier:21.12.0-21.12.17:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=22.12.0|<=22.12.15","product":{"name":"Primavera Unifier Version 22.12.0-22.12.15","product_id":"P-10354V-22.12.0-22.12.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:primavera_unifier:22.12.0-22.12.15:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.12.0|<=23.12.16","product":{"name":"Primavera Unifier Version 23.12.0-23.12.16","product_id":"P-10354V-23.12.0-23.12.16","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:primavera_unifier:23.12.0-23.12.16:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=24.12.0|<=24.12.16","product":{"name":"Primavera Unifier Version 24.12.0-24.12.16","product_id":"P-10354V-24.12.0-24.12.16","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:primavera_unifier:24.12.0-24.12.16:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=25.12.0|<=25.12.9","product":{"name":"Primavera Unifier Version 25.12.0-25.12.9","product_id":"P-10354V-25.12.0-25.12.9","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:primavera_unifier:25.12.0-25.12.9:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Primavera Unifier"}],"category":"product_family","name":"Oracle Construction and Engineering"},{"branches":[{"branches":[{"category":"product_version_range","name":">=19.3|<=19.32","product":{"name":"Oracle Database Server(Java VM) Version 19.3-19.32","product_id":"P-5(Java VM)V-19.3-19.32","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_java_vm:19.3-19.32:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=19.3|<=19.32","product":{"name":"Oracle Database Server(RDBMS) Version 19.3-19.32","product_id":"P-5(RDBMS)V-19.3-19.32","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:19.3-19.32:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=19.3|<=19.32","product":{"name":"Oracle Database Server(RDBMS (Apache Log4j)) Version 19.3-19.32","product_id":"P-5(RDBMS-Apache Log4j)V-19.3-19.32","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:19.3-19.32:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=19.3|<=19.32","product":{"name":"Oracle Database Server(RDBMS (DBI)) Version 19.3-19.32","product_id":"P-5(RDBMS-DBI)V-19.3-19.32","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:19.3-19.32:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=19.3|<=19.32","product":{"name":"Oracle Database Server(RDBMS (Micronaut)) Version 19.3-19.32","product_id":"P-5(RDBMS-Micronaut)V-19.3-19.32","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:19.3-19.32:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=19.3|<=19.32","product":{"name":"Oracle Database Server(RDBMS (OpenSSL)) Version 19.3-19.32","product_id":"P-5(RDBMS-OpenSSL)V-19.3-19.32","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:19.3-19.32:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=19.3|<=19.32","product":{"name":"Oracle Database Server(RDBMS (jackson-databind)) Version 19.3-19.32","product_id":"P-5(RDBMS-jackson-databind)V-19.3-19.32","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:19.3-19.32:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=19.3|<=19.32","product":{"name":"Oracle Database Server(RDBMS (jline)) Version 19.3-19.32","product_id":"P-5(RDBMS-jline)V-19.3-19.32","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:19.3-19.32:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=19.3|<=19.32","product":{"name":"Oracle Database Server(RDBMS (jsoup)) Version 19.3-19.32","product_id":"P-5(RDBMS-jsoup)V-19.3-19.32","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:19.3-19.32:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=19.3|<=19.32","product":{"name":"Oracle Database Server(VPD) Version 19.3-19.32","product_id":"P-5(VPD)V-19.3-19.32","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_vpd:19.3-19.32:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=19.3|<=19.32","product":{"name":"Oracle Database Server(Oracle Spatial and Graph (gdal)) Version 19.3-19.32","product_id":"P-619(Oracle Spatial and Graph-gdal)V-19.3-19.32","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_e_spatial_and_graph:19.3-19.32:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=21.3|<=21.23","product":{"name":"Oracle Database Server(Clusterware (Apache MINA SSHD)) Version 21.3-21.23","product_id":"P-5(Clusterware-Apache MINA SSHD)V-21.3-21.23","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_clusterware:21.3-21.23:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=21.3|<=21.23","product":{"name":"Oracle Database Server(Java VM) Version 21.3-21.23","product_id":"P-5(Java VM)V-21.3-21.23","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_java_vm:21.3-21.23:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=21.3|<=21.23","product":{"name":"Oracle Database Server(RDBMS) Version 21.3-21.23","product_id":"P-5(RDBMS)V-21.3-21.23","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:21.3-21.23:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=21.3|<=21.23","product":{"name":"Oracle Database Server(RDBMS (Apache Log4j)) Version 21.3-21.23","product_id":"P-5(RDBMS-Apache Log4j)V-21.3-21.23","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:21.3-21.23:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=21.3|<=21.23","product":{"name":"Oracle Database Server(RDBMS (Apache Tomcat)) Version 21.3-21.23","product_id":"P-5(RDBMS-Apache Tomcat)V-21.3-21.23","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:21.3-21.23:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=21.3|<=21.23","product":{"name":"Oracle Database Server(RDBMS (DBI)) Version 21.3-21.23","product_id":"P-5(RDBMS-DBI)V-21.3-21.23","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:21.3-21.23:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=21.3|<=21.23","product":{"name":"Oracle Database Server(RDBMS (Python)) Version 21.3-21.23","product_id":"P-5(RDBMS-Python)V-21.3-21.23","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:21.3-21.23:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=21.3|<=21.23","product":{"name":"Oracle Database Server(RDBMS (jackson-databind)) Version 21.3-21.23","product_id":"P-5(RDBMS-jackson-databind)V-21.3-21.23","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:21.3-21.23:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=21.3|<=21.23","product":{"name":"Oracle Database Server(RDBMS (jline)) Version 21.3-21.23","product_id":"P-5(RDBMS-jline)V-21.3-21.23","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:21.3-21.23:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=21.3|<=21.23","product":{"name":"Oracle Database Server(RDBMS (jsoup)) Version 21.3-21.23","product_id":"P-5(RDBMS-jsoup)V-21.3-21.23","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:21.3-21.23:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=21.3|<=21.23","product":{"name":"Oracle Database Server(VPD) Version 21.3-21.23","product_id":"P-5(VPD)V-21.3-21.23","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_vpd:21.3-21.23:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=21.3|<=21.23","product":{"name":"Oracle Database Server(Oracle Spatial and Graph (gdal)) Version 21.3-21.23","product_id":"P-619(Oracle Spatial and Graph-gdal)V-21.3-21.23","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_e_spatial_and_graph:21.3-21.23:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.4.0|<=23.26.3","product":{"name":"Oracle Database Server(Clusterware (Apache MINA SSHD)) Version 23.4.0-23.26.3","product_id":"P-5(Clusterware-Apache MINA SSHD)V-23.4.0-23.26.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_clusterware:23.4.0-23.26.3:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.4.0|<=23.26.3","product":{"name":"Oracle Database Server(Java VM) Version 23.4.0-23.26.3","product_id":"P-5(Java VM)V-23.4.0-23.26.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_java_vm:23.4.0-23.26.3:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.4.0|<=23.26.3","product":{"name":"Oracle Database Server(RDBMS) Version 23.4.0-23.26.3","product_id":"P-5(RDBMS)V-23.4.0-23.26.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:23.4.0-23.26.3:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.4.0|<=23.26.3","product":{"name":"Oracle Database Server(RDBMS (Apache Log4j)) Version 23.4.0-23.26.3","product_id":"P-5(RDBMS-Apache Log4j)V-23.4.0-23.26.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:23.4.0-23.26.3:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.4.0|<=23.26.3","product":{"name":"Oracle Database Server(RDBMS (DBI)) Version 23.4.0-23.26.3","product_id":"P-5(RDBMS-DBI)V-23.4.0-23.26.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:23.4.0-23.26.3:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.4.0|<=23.26.3","product":{"name":"Oracle Database Server(RDBMS (Micronaut)) Version 23.4.0-23.26.3","product_id":"P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:23.4.0-23.26.3:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.4.0|<=23.26.3","product":{"name":"Oracle Database Server(RDBMS (OpenSSL)) Version 23.4.0-23.26.3","product_id":"P-5(RDBMS-OpenSSL)V-23.4.0-23.26.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:23.4.0-23.26.3:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.4.0|<=23.26.3","product":{"name":"Oracle Database Server(RDBMS (Python)) Version 23.4.0-23.26.3","product_id":"P-5(RDBMS-Python)V-23.4.0-23.26.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:23.4.0-23.26.3:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.4.0|<=23.26.3","product":{"name":"Oracle Database Server(RDBMS (jackson-databind)) Version 23.4.0-23.26.3","product_id":"P-5(RDBMS-jackson-databind)V-23.4.0-23.26.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:23.4.0-23.26.3:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.4.0|<=23.26.3","product":{"name":"Oracle Database Server(RDBMS (jline)) Version 23.4.0-23.26.3","product_id":"P-5(RDBMS-jline)V-23.4.0-23.26.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:23.4.0-23.26.3:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.4.0|<=23.26.3","product":{"name":"Oracle Database Server(RDBMS (jsoup)) Version 23.4.0-23.26.3","product_id":"P-5(RDBMS-jsoup)V-23.4.0-23.26.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_rdbms:23.4.0-23.26.3:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.4.0|<=23.26.3","product":{"name":"Oracle Database Server(VPD) Version 23.4.0-23.26.3","product_id":"P-5(VPD)V-23.4.0-23.26.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_vpd:23.4.0-23.26.3:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.4.0|<=23.26.3","product":{"name":"Oracle Database Server(Oracle Spatial and Graph (gdal)) Version 23.4.0-23.26.3","product_id":"P-619(Oracle Spatial and Graph-gdal)V-23.4.0-23.26.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:database_-_e_spatial_and_graph:23.4.0-23.26.3:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Database Server"},{"branches":[{"category":"product_version_range","name":">=19.3|<=19.32","product":{"name":"Oracle Net Services Version 19.3-19.32","product_id":"P-115V-19.3-19.32","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:net_services:19.3-19.32:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=21.3|<=21.23","product":{"name":"Oracle Net Services Version 21.3-21.23","product_id":"P-115V-21.3-21.23","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:net_services:21.3-21.23:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.4.0|<=23.26.3","product":{"name":"Oracle Net Services Version 23.4.0-23.26.3","product_id":"P-115V-23.4.0-23.26.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:net_services:23.4.0-23.26.3:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Net Services"},{"branches":[{"category":"product_version_range","name":">=19.3|<=19.32","product":{"name":"Oracle OLAP Version 19.3-19.32","product_id":"P-1163V-19.3-19.32","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:olap:19.3-19.32:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=21.3|<=21.23","product":{"name":"Oracle OLAP Version 21.3-21.23","product_id":"P-1163V-21.3-21.23","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:olap:21.3-21.23:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.4.0|<=23.26.3","product":{"name":"Oracle OLAP Version 23.4.0-23.26.3","product_id":"P-1163V-23.4.0-23.26.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:olap:23.4.0-23.26.3:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle OLAP"},{"branches":[{"category":"product_version_range","name":">=19.3|<=19.32","product":{"name":"Oracle SQLcl Version 19.3-19.32","product_id":"P-13824V-19.3-19.32","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:sqlcl:19.3-19.32:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=21.3|<=21.23","product":{"name":"Oracle SQLcl Version 21.3-21.23","product_id":"P-13824V-21.3-21.23","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:sqlcl:21.3-21.23:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.4.0|<=23.26.3","product":{"name":"Oracle SQLcl Version 23.4.0-23.26.3","product_id":"P-13824V-23.4.0-23.26.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:sqlcl:23.4.0-23.26.3:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle SQLcl"}],"category":"product_family","name":"Oracle Database Server"},{"branches":[{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Applications DBA Version 12.2.3-12.2.15","product_id":"P-166V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:applications_dba:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Applications DBA"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Applications Platform Engineering Version 12.2.3-12.2.15","product_id":"P-4488V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:applications_platform_engineering:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Applications Platform Engineering"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Assets Version 12.2.3-12.2.15","product_id":"P-503V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:assets:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Assets"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Document Management and Collaboration Version 12.2.3-12.2.15","product_id":"P-1314V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:document_management_and_collaboration:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Document Management and Collaboration"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Global Order Promising Version 12.2.3-12.2.15","product_id":"P-729V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:global_order_promising:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Global Order Promising"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Installed Base Version 12.2.3-12.2.15","product_id":"P-1118V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:installed_base:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Installed Base"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Advanced Outbound Telephony Version 12.2.3-12.2.15","product_id":"P-785V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:advanced_outbound_telephony:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Advanced Outbound Telephony"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Application Object Library Version 12.2.3-12.2.15","product_id":"P-510V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:application_object_library:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Application Object Library"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Applications Framework Version 12.2.3-12.2.15","product_id":"P-1472V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:applications_framework:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Applications Framework"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Applications Manager Version 12.2.3-12.2.15","product_id":"P-99V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:applications_manager:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Applications Manager"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Bills of Material Version 12.2.3-12.2.15","product_id":"P-571V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:bills_of_material:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Bills of Material"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Call Center Technology Version 12.2.3-12.2.15","product_id":"P-781V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:call_center_technology:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Call Center Technology"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Capacity Version 12.2.3-12.2.15","product_id":"P-533V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:capacity:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Capacity"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Common Applications Version 12.2.3-12.2.15","product_id":"P-1198V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:common_applications:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Common Applications"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Compensation Workbench Version 12.2.3-12.2.15","product_id":"P-4427V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:compensation_workbench:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Compensation Workbench"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Complex Maintenance, Repair and Overhaul Version 12.2.3-12.2.15","product_id":"P-1184V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:complex_maintenance__repair_and_overhaul:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Complex Maintenance, Repair and Overhaul"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Concurrent Processing Version 12.2.3-12.2.15","product_id":"P-9303V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:concurrent_processing:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Concurrent Processing"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Contract Lifecycle Management for Public Sector Version 12.2.3-12.2.15","product_id":"P-8759V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:contract_lifecycle_management_for_public_sector:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Contract Lifecycle Management for Public Sector"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Cost Management Version 12.2.3-12.2.15","product_id":"P-569V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:cost_management:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Cost Management"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Customer Care Version 12.2.3-12.2.15","product_id":"P-105V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:customer_care:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Customer Care"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle E-Business Suite Integrated SOA Gateway Version 12.2.3-12.2.15","product_id":"P-4569V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:e-business_suite_integrated_soa_gateway:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle E-Business Suite Integrated SOA Gateway"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle EDI Gateway Version 12.2.3-12.2.15","product_id":"P-509V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:edi_gateway:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle EDI Gateway"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Email Center Version 12.2.3-12.2.15","product_id":"P-950V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:email_center:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Email Center"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Engineering Version 12.2.3-12.2.15","product_id":"P-532V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:engineering:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Engineering"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle General Ledger Version 12.2.3-12.2.15","product_id":"P-500V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:general_ledger:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle General Ledger"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle HCM Common Architecture Version 12.2.3-12.2.15","product_id":"P-2021V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:hcm_common_architecture:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle HCM Common Architecture"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle HRMS (India) Version 12.2.3-12.2.15","product_id":"P-1557V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:hrms:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle HRMS (India)"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle HRMS (Norway) Version 12.2.3-12.2.15","product_id":"P-1645V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:hrms:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle HRMS (Norway)"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle HRMS (Republic of Korea) Version 12.2.3-12.2.15","product_id":"P-1565V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:hrms:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle HRMS (Republic of Korea)"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle HRMS (UK) Version 12.2.3-12.2.15","product_id":"P-1001V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:hrms:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle HRMS (UK)"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle HRMS (US) Version 12.2.3-12.2.15","product_id":"P-1000V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:hrms:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle HRMS (US)"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Inventory Management Version 12.2.3-12.2.15","product_id":"P-508V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:inventory_management:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Inventory Management"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Marketing Version 12.2.3-12.2.15","product_id":"P-229V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:marketing:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Marketing"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Materials Requirement Planning Version 12.2.3-12.2.15","product_id":"P-574V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:materials_requirement_planning:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Materials Requirement Planning"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Mobile Application Server Version 12.2.3-12.2.15","product_id":"P-995V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:mobile_application_server:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Mobile Application Server"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Mobile Field Service Version 12.2.3-12.2.15","product_id":"P-753V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:mobile_field_service:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Mobile Field Service"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle One-to-One Fulfillment Version 12.2.3-12.2.15","product_id":"P-1379V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:one-to-one_fulfillment:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle One-to-One Fulfillment"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Order Management Version 12.2.3-12.2.15","product_id":"P-497V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:order_management:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Order Management"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Partner Management Version 12.2.3-12.2.15","product_id":"P-1065V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:partner_management:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Partner Management"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Payroll Version 12.2.3-12.2.15","product_id":"P-506V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:payroll:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Payroll"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Product Hub Version 12.2.3-12.2.15","product_id":"P-1313V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:product_hub:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Product Hub"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Product Workbench Version 12.2.3-12.2.15","product_id":"P-1597V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:product_workbench:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Product Workbench"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Project Contracts Version 12.2.3-12.2.15","product_id":"P-799V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:project_contracts:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Project Contracts"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Public Sector Human Resources Version 12.2.3-12.2.15","product_id":"P-210V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:public_sector_human_resources:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Public Sector Human Resources"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Purchasing Version 12.2.3-12.2.15","product_id":"P-502V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:purchasing:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Purchasing"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Quality Version 12.2.3-12.2.15","product_id":"P-214V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:quality:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Quality"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Report Manager Version 12.2.3-12.2.15","product_id":"P-777V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:report_manager:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Report Manager"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Sales Foundation Version 12.2.3-12.2.15","product_id":"P-576V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:sales_foundation:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Sales Foundation"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Sales Online Version 12.2.3-12.2.15","product_id":"P-758V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:sales_online:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Sales Online"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Shipping Execution Version 12.2.3-12.2.15","product_id":"P-996V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:shipping_execution:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Shipping Execution"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle Trade Management Version 12.2.3-12.2.15","product_id":"P-765V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:trade_management:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Trade Management"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle US Federal Human Resources Version 12.2.3-12.2.15","product_id":"P-899V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:us_federal_human_resources:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle US Federal Human Resources"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Oracle iSetup Version 12.2.3-12.2.15","product_id":"P-841V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:isetup:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle iSetup"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Order Capture Version 12.2.3-12.2.15","product_id":"P-769V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:order_capture:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Order Capture"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Pasta Version 12.2.3-12.2.15","product_id":"P-1195V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:pasta:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Pasta"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Production Scheduling Version 12.2.3-12.2.15","product_id":"P-1983V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:production_scheduling:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Production Scheduling"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Sourcing Version 12.2.3-12.2.15","product_id":"P-1273V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:sourcing:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Sourcing"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Strategic Network Optimization Version 12.2.3-12.2.15","product_id":"P-1981V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:strategic_network_optimization:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Strategic Network Optimization"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"Workflow Version 12.2.3-12.2.15","product_id":"P-174V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:workflow:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Workflow"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"iProcurement Version 12.2.3-12.2.15","product_id":"P-398V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:iprocurement:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"iProcurement"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"iSupplier Portal Version 12.2.3-12.2.15","product_id":"P-208V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:isupplier_portal:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"iSupplier Portal"},{"branches":[{"category":"product_version_range","name":">=12.2.3|<=12.2.15","product":{"name":"iSupport Version 12.2.3-12.2.15","product_id":"P-381V-12.2.3-12.2.15","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:isupport:12.2.3-12.2.15:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"iSupport"}],"category":"product_family","name":"Oracle E-Business Suite"},{"branches":[{"branches":[{"category":"product_version","name":"Oracle Enterprise Manager Base Platform Version 13.5","product":{"name":"Oracle Enterprise Manager Base Platform Version 13.5","product_id":"P-1370V-13.5","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Enterprise Manager Base Platform Version 24.1","product":{"name":"Oracle Enterprise Manager Base Platform Version 24.1","product_id":"P-1370V-24.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:enterprise_manager_base_platform:24.1:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Enterprise Manager Base Platform"},{"branches":[{"category":"product_version","name":"Oracle Enterprise Manager for Oracle Database Version 13.5","product":{"name":"Oracle Enterprise Manager for Oracle Database Version 13.5","product_id":"P-1366V-13.5","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:enterprise_manager_for_oracle_database:13.5:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Enterprise Manager for Oracle Database Version 24.1","product":{"name":"Oracle Enterprise Manager for Oracle Database Version 24.1","product_id":"P-1366V-24.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:enterprise_manager_for_oracle_database:24.1:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Enterprise Manager for Oracle Database"},{"branches":[{"category":"product_version","name":"Oracle Enterprise Manager for Siebel Version 13.5","product":{"name":"Oracle Enterprise Manager for Siebel Version 13.5","product_id":"P-2158V-13.5","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:enterprise_manager_for_siebel:13.5:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Enterprise Manager for Siebel Version 24.1","product":{"name":"Oracle Enterprise Manager for Siebel Version 24.1","product_id":"P-2158V-24.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:enterprise_manager_for_siebel:24.1:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Enterprise Manager for Siebel"},{"branches":[{"category":"product_version","name":"Oracle Enterprise Manager for Virtualization Version 13.5","product":{"name":"Oracle Enterprise Manager for Virtualization Version 13.5","product_id":"P-9586V-13.5","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:enterprise_manager_for_virtualization:13.5:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Enterprise Manager for Virtualization"}],"category":"product_family","name":"Oracle Enterprise Manager"},{"branches":[{"branches":[{"category":"product_version","name":"Oracle Essbase Version 21.8.3.0.0","product":{"name":"Oracle Essbase Version 21.8.3.0.0","product_id":"P-4379V-21.8.3.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:essbase:21.8.3.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Essbase"}],"category":"product_family","name":"Oracle Essbase"},{"branches":[{"branches":[{"category":"product_version","name":"Oracle Financial Services Analytical Applications Infrastructure Version 8.0.7.9","product":{"name":"Oracle Financial Services Analytical Applications Infrastructure Version 8.0.7.9","product_id":"P-5680V-8.0.7.9","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.7.9:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Financial Services Analytical Applications Infrastructure Version 8.0.8.7","product":{"name":"Oracle Financial Services Analytical Applications Infrastructure Version 8.0.8.7","product_id":"P-5680V-8.0.8.7","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.0.8.7:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Financial Services Analytical Applications Infrastructure Version 8.1.2.5","product":{"name":"Oracle Financial Services Analytical Applications Infrastructure Version 8.1.2.5","product_id":"P-5680V-8.1.2.5","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.5:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Financial Services Analytical Applications Infrastructure Version 8.1.2.6","product":{"name":"Oracle Financial Services Analytical Applications Infrastructure Version 8.1.2.6","product_id":"P-5680V-8.1.2.6","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:8.1.2.6:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Financial Services Analytical Applications Infrastructure"},{"branches":[{"category":"product_version","name":"Oracle Financial Services Behavior Detection Platform Version 8.0.8.1","product":{"name":"Oracle Financial Services Behavior Detection Platform Version 8.0.8.1","product_id":"P-9190V-8.0.8.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.0.8.1:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Financial Services Behavior Detection Platform Version 8.1.2.11","product":{"name":"Oracle Financial Services Behavior Detection Platform Version 8.1.2.11","product_id":"P-9190V-8.1.2.11","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.11:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Financial Services Behavior Detection Platform Version 8.1.2.12","product":{"name":"Oracle Financial Services Behavior Detection Platform Version 8.1.2.12","product_id":"P-9190V-8.1.2.12","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:financial_services_behavior_detection_platform:8.1.2.12:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Financial Services Behavior Detection Platform"},{"branches":[{"category":"product_version","name":"Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition Version 8.0.8.0","product":{"name":"Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition Version 8.0.8.0","product_id":"P-13789V-8.0.8.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:financial_services_trade-based_anti_money_laundering:8.0.8.0:*:*:*:enterprise:*:*:*"}}}],"category":"product_name","name":"Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition"}],"category":"product_family","name":"Oracle Financial Services Applications"},{"branches":[{"branches":[{"category":"product_version","name":"Helidon Version 27.0.0","product":{"name":"Helidon Version 27.0.0","product_id":"P-13972V-27.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:helidon:27.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=3.0.0|<=3.2.21","product":{"name":"Helidon Version 3.0.0-3.2.21","product_id":"P-13972V-3.0.0-3.2.21","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:helidon:3.0.0-3.2.21:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=4.0.0|<=4.5.5","product":{"name":"Helidon Version 4.0.0-4.5.5","product_id":"P-13972V-4.0.0-4.5.5","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:helidon:4.0.0-4.5.5:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Helidon"},{"branches":[{"category":"product_version","name":"Oracle Access Manager Version 12.2.1.4.0","product":{"name":"Oracle Access Manager Version 12.2.1.4.0","product_id":"P-5565V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:access_manager:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Access Manager Version 14.1.2.0.0","product":{"name":"Oracle Access Manager Version 14.1.2.0.0","product_id":"P-5565V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:access_manager:14.1.2.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Access Manager(Oracle Access Manager_Authentication Engine) Version 14.1.2.1.0","product":{"name":"Oracle Access Manager(Oracle Access Manager_Authentication Engine) Version 14.1.2.1.0","product_id":"P-5565(Oracle Access Manager_Authentication Engine)V-14.1.2.1.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:access_manager:14.1.2.1.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Access Manager(Oracle Access Manager_Third Party) Version 14.1.2.1.0","product":{"name":"Oracle Access Manager(Oracle Access Manager_Third Party) Version 14.1.2.1.0","product_id":"P-5565(Oracle Access Manager_Third Party)V-14.1.2.1.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:access_manager:14.1.2.1.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Access Manager Version 14.1.2.1.0","product":{"name":"Oracle Access Manager Version 14.1.2.1.0","product_id":"P-5565V-14.1.2.1.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:access_manager:14.1.2.1.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Access Manager"},{"branches":[{"category":"product_version","name":"Oracle Business Process Management Suite Version 12.2.1.4.0","product":{"name":"Oracle Business Process Management Suite Version 12.2.1.4.0","product_id":"P-5325V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Business Process Management Suite Version 14.1.2.0.0","product":{"name":"Oracle Business Process Management Suite Version 14.1.2.0.0","product_id":"P-5325V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:business_process_management_suite:14.1.2.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Business Process Management Suite"},{"branches":[{"category":"product_version","name":"Oracle Coherence Version 12.2.1.4.0","product":{"name":"Oracle Coherence Version 12.2.1.4.0","product_id":"P-2545V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:coherence:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Coherence Version 14.1.1.0.0","product":{"name":"Oracle Coherence Version 14.1.1.0.0","product_id":"P-2545V-14.1.1.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:coherence:14.1.1.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Coherence"},{"branches":[{"category":"product_version","name":"Oracle Data Integrator Version 12.2.1.4.0","product":{"name":"Oracle Data Integrator Version 12.2.1.4.0","product_id":"P-2196V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Data Integrator Version 14.1.2.0.0","product":{"name":"Oracle Data Integrator Version 14.1.2.0.0","product_id":"P-2196V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:data_integrator:14.1.2.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Data Integrator"},{"branches":[{"category":"product_version","name":"Oracle Fusion Middleware Version 12.2.1.4.0","product":{"name":"Oracle Fusion Middleware Version 12.2.1.4.0","product_id":"P-1032V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:fusion_middleware:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Fusion Middleware Version 14.1.2.0.0","product":{"name":"Oracle Fusion Middleware Version 14.1.2.0.0","product_id":"P-1032V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:fusion_middleware:14.1.2.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Fusion Middleware"},{"branches":[{"category":"product_version","name":"Oracle Fusion Middleware Control Version 12.2.1.4.0","product":{"name":"Oracle Fusion Middleware Control Version 12.2.1.4.0","product_id":"P-14309V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:fusion_middleware_control:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Fusion Middleware Control Version 14.1.2.0.0","product":{"name":"Oracle Fusion Middleware Control Version 14.1.2.0.0","product_id":"P-14309V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:fusion_middleware_control:14.1.2.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Fusion Middleware Control"},{"branches":[{"category":"product_version","name":"Oracle Global Lifecycle Management NextGen OUI Framework(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer) Version 12.2.1.4.0","product":{"name":"Oracle Global Lifecycle Management NextGen OUI Framework(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer) Version 12.2.1.4.0","product_id":"P-12738(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer)V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Global Lifecycle Management NextGen OUI Framework Version 12.2.1.4.0","product":{"name":"Oracle Global Lifecycle Management NextGen OUI Framework Version 12.2.1.4.0","product_id":"P-12738V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Global Lifecycle Management NextGen OUI Framework(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer) Version 14.1.1.0.0","product":{"name":"Oracle Global Lifecycle Management NextGen OUI Framework(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer) Version 14.1.1.0.0","product_id":"P-12738(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer)V-14.1.1.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:14.1.1.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Global Lifecycle Management NextGen OUI Framework Version 14.1.1.0.0","product":{"name":"Oracle Global Lifecycle Management NextGen OUI Framework Version 14.1.1.0.0","product_id":"P-12738V-14.1.1.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:14.1.1.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Global Lifecycle Management NextGen OUI Framework(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer) Version 14.1.2.0.0","product":{"name":"Oracle Global Lifecycle Management NextGen OUI Framework(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer) Version 14.1.2.0.0","product_id":"P-12738(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer)V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:14.1.2.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Global Lifecycle Management NextGen OUI Framework Version 14.1.2.0.0","product":{"name":"Oracle Global Lifecycle Management NextGen OUI Framework Version 14.1.2.0.0","product_id":"P-12738V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:14.1.2.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Global Lifecycle Management NextGen OUI Framework(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer) Version 14.1.2.1.0","product":{"name":"Oracle Global Lifecycle Management NextGen OUI Framework(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer) Version 14.1.2.1.0","product_id":"P-12738(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer)V-14.1.2.1.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:14.1.2.1.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Global Lifecycle Management NextGen OUI Framework Version 14.1.2.1.0","product":{"name":"Oracle Global Lifecycle Management NextGen OUI Framework Version 14.1.2.1.0","product_id":"P-12738V-14.1.2.1.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:14.1.2.1.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Global Lifecycle Management NextGen OUI Framework(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer) Version 15.1.1.0.0","product":{"name":"Oracle Global Lifecycle Management NextGen OUI Framework(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer) Version 15.1.1.0.0","product_id":"P-12738(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer)V-15.1.1.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:15.1.1.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Global Lifecycle Management NextGen OUI Framework Version 15.1.1.0.0","product":{"name":"Oracle Global Lifecycle Management NextGen OUI Framework Version 15.1.1.0.0","product_id":"P-12738V-15.1.1.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:global_lifecycle_management_nextgen_oui_framework:15.1.1.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Global Lifecycle Management NextGen OUI Framework"},{"branches":[{"category":"product_version","name":"Oracle HTTP Server(Oracle HTTP Server_OSSL Module) Version 12.2.1.4.0","product":{"name":"Oracle HTTP Server(Oracle HTTP Server_OSSL Module) Version 12.2.1.4.0","product_id":"P-1042(Oracle HTTP Server_OSSL Module)V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle HTTP Server(Oracle HTTP Server_Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server) Version 12.2.1.4.0","product":{"name":"Oracle HTTP Server(Oracle HTTP Server_Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server) Version 12.2.1.4.0","product_id":"P-1042(Oracle HTTP Server_Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server)V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle HTTP Server(Oracle HTTP Server_Web Listener) Version 12.2.1.4.0","product":{"name":"Oracle HTTP Server(Oracle HTTP Server_Web Listener) Version 12.2.1.4.0","product_id":"P-1042(Oracle HTTP Server_Web Listener)V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle HTTP Server(Oracle HTTP Server_OSSL Module) Version 14.1.2.0.0","product":{"name":"Oracle HTTP Server(Oracle HTTP Server_OSSL Module) Version 14.1.2.0.0","product_id":"P-1042(Oracle HTTP Server_OSSL Module)V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:http_server:14.1.2.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle HTTP Server(Oracle HTTP Server_Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server) Version 14.1.2.0.0","product":{"name":"Oracle HTTP Server(Oracle HTTP Server_Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server) Version 14.1.2.0.0","product_id":"P-1042(Oracle HTTP Server_Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server)V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:http_server:14.1.2.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle HTTP Server"},{"branches":[{"category":"product_version","name":"Oracle Identity Manager Version 12.2.1.4.0","product":{"name":"Oracle Identity Manager Version 12.2.1.4.0","product_id":"P-1980V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:identity_manager:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Identity Manager Version 14.1.2.1.0","product":{"name":"Oracle Identity Manager Version 14.1.2.1.0","product_id":"P-1980V-14.1.2.1.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:identity_manager:14.1.2.1.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Identity Manager"},{"branches":[{"category":"product_version","name":"Oracle Identity Manager Connector Version 12.2.1.4.0","product":{"name":"Oracle Identity Manager Connector Version 12.2.1.4.0","product_id":"P-1999V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:identity_manager_connector:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Identity Manager Connector Version 14.1.2.1.0","product":{"name":"Oracle Identity Manager Connector Version 14.1.2.1.0","product_id":"P-1999V-14.1.2.1.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:identity_manager_connector:14.1.2.1.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Identity Manager Connector"},{"branches":[{"category":"product_version","name":"Oracle JDeveloper Version 12.2.1.4.0","product":{"name":"Oracle JDeveloper Version 12.2.1.4.0","product_id":"P-807V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle JDeveloper Version 14.1.2.0.0","product":{"name":"Oracle JDeveloper Version 14.1.2.0.0","product_id":"P-807V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:jdeveloper:14.1.2.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle JDeveloper"},{"branches":[{"category":"product_version","name":"Oracle Managed File Transfer Version 12.2.1.4.0","product":{"name":"Oracle Managed File Transfer Version 12.2.1.4.0","product_id":"P-10198V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:managed_file_transfer:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Managed File Transfer Version 14.1.2.0.0","product":{"name":"Oracle Managed File Transfer Version 14.1.2.0.0","product_id":"P-10198V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:managed_file_transfer:14.1.2.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Managed File Transfer"},{"branches":[{"category":"product_version","name":"Oracle Middleware Common Libraries and Tools(Oracle Middleware Common Libraries and Tools_Third Party) Version 12.2.1.4.0","product":{"name":"Oracle Middleware Common Libraries and Tools(Oracle Middleware Common Libraries and Tools_Third Party) Version 12.2.1.4.0","product_id":"P-4647(Oracle Middleware Common Libraries and Tools_Third Party)V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Middleware Common Libraries and Tools Version 12.2.1.4.0","product":{"name":"Oracle Middleware Common Libraries and Tools Version 12.2.1.4.0","product_id":"P-4647V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Middleware Common Libraries and Tools Version 14.1.1.0.0","product":{"name":"Oracle Middleware Common Libraries and Tools Version 14.1.1.0.0","product_id":"P-4647V-14.1.1.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:middleware_common_libraries_and_tools:14.1.1.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Middleware Common Libraries and Tools(Oracle Middleware Common Libraries and Tools_Third Party) Version 14.1.2.0.0","product":{"name":"Oracle Middleware Common Libraries and Tools(Oracle Middleware Common Libraries and Tools_Third Party) Version 14.1.2.0.0","product_id":"P-4647(Oracle Middleware Common Libraries and Tools_Third Party)V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:middleware_common_libraries_and_tools:14.1.2.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Middleware Common Libraries and Tools Version 14.1.2.0.0","product":{"name":"Oracle Middleware Common Libraries and Tools Version 14.1.2.0.0","product_id":"P-4647V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:middleware_common_libraries_and_tools:14.1.2.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Middleware Common Libraries and Tools Version 15.1.1.0.0","product":{"name":"Oracle Middleware Common Libraries and Tools Version 15.1.1.0.0","product_id":"P-4647V-15.1.1.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:middleware_common_libraries_and_tools:15.1.1.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Middleware Common Libraries and Tools"},{"branches":[{"category":"product_version","name":"Oracle Outside In Technology Version 8.5.8","product":{"name":"Oracle Outside In Technology Version 8.5.8","product_id":"P-2276V-8.5.8","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:outside_in_technology:8.5.8:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Outside In Technology"},{"branches":[{"category":"product_version","name":"Oracle SOA Suite Version 12.2.1.4.0","product":{"name":"Oracle SOA Suite Version 12.2.1.4.0","product_id":"P-1162V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:soa_suite:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle SOA Suite Version 14.1.2.0.0","product":{"name":"Oracle SOA Suite Version 14.1.2.0.0","product_id":"P-1162V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:soa_suite:14.1.2.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle SOA Suite"},{"branches":[{"category":"product_version","name":"Oracle Service Bus Version 12.2.1.4.0","product":{"name":"Oracle Service Bus Version 12.2.1.4.0","product_id":"P-5308V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:service_bus:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Service Bus Version 14.1.2.0.0","product":{"name":"Oracle Service Bus Version 14.1.2.0.0","product_id":"P-5308V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:service_bus:14.1.2.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Service Bus"},{"branches":[{"category":"product_version","name":"Oracle Web Services Manager(Oracle Web Services Manager_Third Party) Version 14.1.2.0.0","product":{"name":"Oracle Web Services Manager(Oracle Web Services Manager_Third Party) Version 14.1.2.0.0","product_id":"P-1775(Oracle Web Services Manager_Third Party)V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:web_services_manager:14.1.2.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Web Services Manager Version 14.1.2.0.0","product":{"name":"Oracle Web Services Manager Version 14.1.2.0.0","product_id":"P-1775V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:web_services_manager:14.1.2.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Web Services Manager"},{"branches":[{"category":"product_version","name":"Oracle WebCenter Content Version 12.2.1.4.0","product":{"name":"Oracle WebCenter Content Version 12.2.1.4.0","product_id":"P-2271V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:webcenter_content:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle WebCenter Content Version 14.1.2.0.0","product":{"name":"Oracle WebCenter Content Version 14.1.2.0.0","product_id":"P-2271V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:webcenter_content:14.1.2.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle WebCenter Content"},{"branches":[{"category":"product_version","name":"Oracle WebCenter Portal Version 12.2.1.4.0","product":{"name":"Oracle WebCenter Portal Version 12.2.1.4.0","product_id":"P-1696V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle WebCenter Portal Version 14.1.2.0.0","product":{"name":"Oracle WebCenter Portal Version 14.1.2.0.0","product_id":"P-1696V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:webcenter_portal:14.1.2.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle WebCenter Portal"},{"branches":[{"category":"product_version","name":"Oracle WebCenter Sites Version 12.2.1.4.0","product":{"name":"Oracle WebCenter Sites Version 12.2.1.4.0","product_id":"P-9617V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle WebCenter Sites Version 14.1.2.0.0","product":{"name":"Oracle WebCenter Sites Version 14.1.2.0.0","product_id":"P-9617V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:webcenter_sites:14.1.2.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle WebCenter Sites"},{"branches":[{"category":"product_version","name":"Oracle WebLogic Server Version 12.2.1.4.0","product":{"name":"Oracle WebLogic Server Version 12.2.1.4.0","product_id":"P-5242V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle WebLogic Server Version 14.1.1.0.0","product":{"name":"Oracle WebLogic Server Version 14.1.1.0.0","product_id":"P-5242V-14.1.1.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle WebLogic Server Version 14.1.2.0.0","product":{"name":"Oracle WebLogic Server Version 14.1.2.0.0","product_id":"P-5242V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:weblogic_server:14.1.2.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle WebLogic Server Version 15.1.1.0.0","product":{"name":"Oracle WebLogic Server Version 15.1.1.0.0","product_id":"P-5242V-15.1.1.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:weblogic_server:15.1.1.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle WebLogic Server"},{"branches":[{"category":"product_version","name":"Oracle Weblogic Server Proxy Plug-in(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers) Version 12.2.1.4.0","product":{"name":"Oracle Weblogic Server Proxy Plug-in(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers) Version 12.2.1.4.0","product_id":"P-1042(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers)V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Weblogic Server Proxy Plug-in(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers) Version 14.1.1.0.0","product":{"name":"Oracle Weblogic Server Proxy Plug-in(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers) Version 14.1.1.0.0","product_id":"P-1042(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers)V-14.1.1.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:14.1.1.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Weblogic Server Proxy Plug-in(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers) Version 14.1.2.0.0","product":{"name":"Oracle Weblogic Server Proxy Plug-in(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers) Version 14.1.2.0.0","product_id":"P-1042(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers)V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:weblogic_server_proxy_plug-in:14.1.2.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Weblogic Server Proxy Plug-in"},{"branches":[{"category":"product_version","name":"WebCenter Content: Imaging Version 12.2.1.4.0","product":{"name":"WebCenter Content: Imaging Version 12.2.1.4.0","product_id":"P-4576V-12.2.1.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:webcenter_content__imaging:12.2.1.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"WebCenter Content: Imaging Version 14.1.2.0.0","product":{"name":"WebCenter Content: Imaging Version 14.1.2.0.0","product_id":"P-4576V-14.1.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:webcenter_content__imaging:14.1.2.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"WebCenter Content: Imaging"}],"category":"product_family","name":"Oracle Fusion Middleware"},{"branches":[{"branches":[{"category":"product_version_range","name":">=12.2.0.1.16|<=12.2.0.1.52","product":{"name":"Oracle Global Lifecycle Management OPatch Version 12.2.0.1.16-12.2.0.1.52","product_id":"P-12753V-12.2.0.1.16-12.2.0.1.52","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:global_lifecycle_management_opatch:12.2.0.1.16-12.2.0.1.52:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Global Lifecycle Management OPatch"},{"branches":[{"category":"product_version_range","name":">=12.2.0.1.16|<=12.2.0.1.52","product":{"name":"Oracle Global Lifecycle Management OPatchAuto Version 12.2.0.1.16-12.2.0.1.52","product_id":"P-12752V-12.2.0.1.16-12.2.0.1.52","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:global_lifecycle_management_opatchauto:12.2.0.1.16-12.2.0.1.52:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Global Lifecycle Management OPatchAuto"}],"category":"product_family","name":"Oracle Global Lifecycle Management"},{"branches":[{"branches":[{"category":"product_version_range","name":">=19.1.0.0.0|<=19.32.0.0","product":{"name":"Oracle GoldenGate Version 19.1.0.0.0-19.32.0.0","product_id":"P-5757V-19.1.0.0.0-19.32.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:goldengate:19.1.0.0.0-19.32.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=21.3|<=21.23","product":{"name":"Oracle GoldenGate Version 21.3-21.23","product_id":"P-5757V-21.3-21.23","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:goldengate:21.3-21.23:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.4|<=23.26.2.0.0","product":{"name":"Oracle GoldenGate Version 23.4-23.26.2.0.0","product_id":"P-5757V-23.4-23.26.2.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:goldengate:23.4-23.26.2.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.4|<=23.26.3.0.0","product":{"name":"Oracle GoldenGate Version 23.4-23.26.3.0.0","product_id":"P-5757V-23.4-23.26.3.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:goldengate:23.4-23.26.3.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle GoldenGate"},{"branches":[{"category":"product_version_range","name":">=21.3|<=21.20","product":{"name":"Oracle GoldenGate Big Data and Application Adapters Version 21.3-21.20","product_id":"P-5760V-21.3-21.20","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:goldengate_big_data_and_application_adapters:21.3-21.20:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.4|<=23.26.1","product":{"name":"Oracle GoldenGate Big Data and Application Adapters Version 23.4-23.26.1","product_id":"P-5760V-23.4-23.26.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:goldengate_big_data_and_application_adapters:23.4-23.26.1:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle GoldenGate Big Data and Application Adapters"},{"branches":[{"category":"product_version_range","name":">=19.1.0.0.0|<=19.1.0.0.16","product":{"name":"Oracle GoldenGate Stream Analytics(Oracle GoldenGate Stream Analytics_General Issues) Version 19.1.0.0.0-19.1.0.0.16","product_id":"P-14015(Oracle GoldenGate Stream Analytics_General Issues)V-19.1.0.0.0-19.1.0.0.16","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:goldengate_stream_analytics:19.1.0.0.0-19.1.0.0.16:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=19.1.0.0.0|<=19.1.0.0.16","product":{"name":"Oracle GoldenGate Stream Analytics(Oracle GoldenGate Stream Analytics_Security) Version 19.1.0.0.0-19.1.0.0.16","product_id":"P-14015(Oracle GoldenGate Stream Analytics_Security)V-19.1.0.0.0-19.1.0.0.16","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:goldengate_stream_analytics:19.1.0.0.0-19.1.0.0.16:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=26.1.0.0.0|<=26.2.0.0.1","product":{"name":"Oracle GoldenGate Stream Analytics(Oracle GoldenGate Stream Analytics_Security) Version 26.1.0.0.0-26.2.0.0.1","product_id":"P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:goldengate_stream_analytics:26.1.0.0.0-26.2.0.0.1:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle GoldenGate Stream Analytics"},{"branches":[{"category":"product_version_range","name":">=13.4.1.0.1|<=13.5.2.0.6","product":{"name":"Oracle Management Pack for Oracle GoldenGate Version 13.4.1.0.1-13.5.2.0.6","product_id":"P-5759V-13.4.1.0.1-13.5.2.0.6","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:management_pack_for_oracle_goldengate:13.4.1.0.1-13.5.2.0.6:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Management Pack for Oracle GoldenGate"}],"category":"product_family","name":"Oracle GoldenGate"},{"branches":[{"branches":[{"category":"product_version","name":"Oracle Graph Server and Client Version 25.4.3","product":{"name":"Oracle Graph Server and Client Version 25.4.3","product_id":"P-14069V-25.4.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:graph_server_and_client:25.4.3:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Graph Server and Client Version 26.2.2","product":{"name":"Oracle Graph Server and Client Version 26.2.2","product_id":"P-14069V-26.2.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:graph_server_and_client:26.2.2:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Graph Server and Client"}],"category":"product_family","name":"Oracle Graph Server and Client"},{"branches":[{"branches":[{"category":"product_version_range","name":">=4.0.0|<=4.0.3","product":{"name":"Oracle Health Sciences Information Manager Version 4.0.0-4.0.3","product_id":"P-9177V-4.0.0-4.0.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:health_sciences_information_manager:4.0.0-4.0.3:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Health Sciences Information Manager"},{"branches":[{"category":"product_version_range","name":">=8.2.0.0|<=8.2.0.8","product":{"name":"Oracle Healthcare Data Repository Version 8.2.0.0-8.2.0.8","product_id":"P-9161V-8.2.0.0-8.2.0.8","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:healthcare_data_repository:8.2.0.0-8.2.0.8:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Healthcare Data Repository"},{"branches":[{"category":"product_version_range","name":">=5.0.0.0|<=5.0.9.7","product":{"name":"Oracle Healthcare Master Person Index Version 5.0.0.0-5.0.9.7","product_id":"P-8575V-5.0.0.0-5.0.9.7","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:healthcare_master_person_index:5.0.0.0-5.0.9.7:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Healthcare Master Person Index"}],"category":"product_family","name":"Oracle HealthCare Applications"},{"branches":[{"branches":[{"category":"product_version","name":"Oracle Hospitality Cruise Shipboard Property Management (SPMS) Version 23.1","product":{"name":"Oracle Hospitality Cruise Shipboard Property Management (SPMS) Version 23.1","product_id":"P-11705V-23.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management:23.1:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Hospitality Cruise Shipboard Property Management (SPMS) Version 23.2","product":{"name":"Oracle Hospitality Cruise Shipboard Property Management (SPMS) Version 23.2","product_id":"P-11705V-23.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management:23.2:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Hospitality Cruise Shipboard Property Management (SPMS) Version 23.3","product":{"name":"Oracle Hospitality Cruise Shipboard Property Management (SPMS) Version 23.3","product_id":"P-11705V-23.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:hospitality_cruise_shipboard_property_management:23.3:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Hospitality Cruise Shipboard Property Management (SPMS)"},{"branches":[{"category":"product_version","name":"Oracle Hospitality OPERA 5 Property Services Version 5.6.28.0","product":{"name":"Oracle Hospitality OPERA 5 Property Services Version 5.6.28.0","product_id":"P-11580V-5.6.28.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:hospitality_opera_5_property_services:5.6.28.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Hospitality OPERA 5 Property Services Version 5.6.28.2","product":{"name":"Oracle Hospitality OPERA 5 Property Services Version 5.6.28.2","product_id":"P-11580V-5.6.28.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:hospitality_opera_5_property_services:5.6.28.2:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Hospitality OPERA 5 Property Services"}],"category":"product_family","name":"Oracle Hospitality Applications"},{"branches":[{"branches":[{"category":"product_version","name":"JD Edwards EnterpriseOne Configurator Version 9.2","product":{"name":"JD Edwards EnterpriseOne Configurator Version 9.2","product_id":"P-4710V-9.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:jd_edwards_enterpriseone_configurator:9.2:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"JD Edwards EnterpriseOne Configurator"},{"branches":[{"category":"product_version","name":"JD Edwards EnterpriseOne General Ledger Version 9.2","product":{"name":"JD Edwards EnterpriseOne General Ledger Version 9.2","product_id":"P-4737V-9.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:jd_edwards_enterpriseone_general_ledger:9.2:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"JD Edwards EnterpriseOne General Ledger"},{"branches":[{"category":"product_version","name":"JD Edwards EnterpriseOne Homebuilder Version 9.2","product":{"name":"JD Edwards EnterpriseOne Homebuilder Version 9.2","product_id":"P-4741V-9.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:jd_edwards_enterpriseone_homebuilder:9.2:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"JD Edwards EnterpriseOne Homebuilder"},{"branches":[{"category":"product_version","name":"JD Edwards EnterpriseOne Human Resources Management Version 9.2","product":{"name":"JD Edwards EnterpriseOne Human Resources Management Version 9.2","product_id":"P-4742V-9.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:jd_edwards_enterpriseone_human_resources_management:9.2:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"JD Edwards EnterpriseOne Human Resources Management"},{"branches":[{"category":"product_version","name":"JD Edwards EnterpriseOne Localizations Version 9.2","product":{"name":"JD Edwards EnterpriseOne Localizations Version 9.2","product_id":"P-9032V-9.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:jd_edwards_enterpriseone_localizations:9.2:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"JD Edwards EnterpriseOne Localizations"},{"branches":[{"category":"product_version","name":"JD Edwards EnterpriseOne Operational Sourcing Version 9.2","product":{"name":"JD Edwards EnterpriseOne Operational Sourcing Version 9.2","product_id":"P-5533V-9.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:jd_edwards_enterpriseone_operational_sourcing:9.2:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"JD Edwards EnterpriseOne Operational Sourcing"},{"branches":[{"category":"product_version_range","name":">=9.2.0.0|<=9.2.26.5","product":{"name":"JD Edwards EnterpriseOne Orchestrator Version 9.2.0.0-9.2.26.5","product_id":"P-11681V-9.2.0.0-9.2.26.5","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:9.2.0.0-9.2.26.5:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"JD Edwards EnterpriseOne Orchestrator"},{"branches":[{"category":"product_version","name":"JD Edwards EnterpriseOne Sales Order Entry Version 9.2","product":{"name":"JD Edwards EnterpriseOne Sales Order Entry Version 9.2","product_id":"P-4769V-9.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:jd_edwards_enterpriseone_sales_order_entry:9.2:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"JD Edwards EnterpriseOne Sales Order Entry"},{"branches":[{"category":"product_version_range","name":">=9.2.0.0|<=9.2.26.4","product":{"name":"JD Edwards EnterpriseOne Tools Version 9.2.0.0-9.2.26.4","product_id":"P-4781V-9.2.0.0-9.2.26.4","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2.0.0-9.2.26.4:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=9.2.0.0|<=9.2.26.5","product":{"name":"JD Edwards EnterpriseOne Tools Version 9.2.0.0-9.2.26.5","product_id":"P-4781V-9.2.0.0-9.2.26.5","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2.0.0-9.2.26.5:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"JD Edwards EnterpriseOne Tools"}],"category":"product_family","name":"Oracle JD Edwards"},{"branches":[{"branches":[{"category":"product_version","name":"Oracle GraalVM Enterprise Edition Version 21.3.19.1.1","product":{"name":"Oracle GraalVM Enterprise Edition Version 21.3.19.1.1","product_id":"P-13497V-21.3.19.1.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:graalvm:21.3.19.1.1:*:*:*:enterprise:*:*:*"}}}],"category":"product_name","name":"Oracle GraalVM Enterprise Edition"},{"branches":[{"category":"product_version","name":"Oracle GraalVM for JDK Version 17.0.20.1","product":{"name":"Oracle GraalVM for JDK Version 17.0.20.1","product_id":"P-13497V-17.0.20.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:graalvm_for_jdk:17.0.20.1:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle GraalVM for JDK Version 21.0.12.1","product":{"name":"Oracle GraalVM for JDK Version 21.0.12.1","product_id":"P-13497V-21.0.12.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:graalvm_for_jdk:21.0.12.1:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle GraalVM for JDK"},{"branches":[{"category":"product_version","name":"Oracle Java SE Version 11.0.32.1","product":{"name":"Oracle Java SE Version 11.0.32.1","product_id":"P-856(Java SE)V-11.0.32.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:java_se:11.0.32.1:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Java SE Version 17.0.20.1","product":{"name":"Oracle Java SE Version 17.0.20.1","product_id":"P-856(Java SE)V-17.0.20.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:java_se:17.0.20.1:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Java SE Version 21.0.12.1","product":{"name":"Oracle Java SE Version 21.0.12.1","product_id":"P-856(Java SE)V-21.0.12.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:java_se:21.0.12.1:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Java SE Version 25.0.4.1","product":{"name":"Oracle Java SE Version 25.0.4.1","product_id":"P-856(Java SE)V-25.0.4.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:java_se:25.0.4.1:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Java SE Version 26.0.2","product":{"name":"Oracle Java SE Version 26.0.2","product_id":"P-856(Java SE)V-26.0.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:java_se:26.0.2:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Java SE Version 27","product":{"name":"Oracle Java SE Version 27","product_id":"P-856(Java SE)V-27","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:java_se:27:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Java SE Version 8u503","product":{"name":"Oracle Java SE Version 8u503","product_id":"P-856(Java SE)V-8u503","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:java_se:8u503:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Java SE Version 8u503-perf","product":{"name":"Oracle Java SE Version 8u503-perf","product_id":"P-856(Java SE)V-8u503-perf","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:java_se:8u503:*:*:*:enterprise_performance:*:*:*"}}}],"category":"product_name","name":"Oracle Java SE"},{"branches":[{"category":"product_version","name":"Oracle JavaFX Version 21.0.12","product":{"name":"Oracle JavaFX Version 21.0.12","product_id":"P-856(JavaFX)V-21.0.12","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:javafx:21.0.12:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle JavaFX Version 25.0.4","product":{"name":"Oracle JavaFX Version 25.0.4","product_id":"P-856(JavaFX)V-25.0.4","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:javafx:25.0.4:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle JavaFX Version 27","product":{"name":"Oracle JavaFX Version 27","product_id":"P-856(JavaFX)V-27","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:javafx:27:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle JavaFX"}],"category":"product_family","name":"Oracle Java SE"},{"branches":[{"branches":[{"category":"product_version_range","name":">=26.7.0|<=26.7.1","product":{"name":"MySQL Cluster Version 26.7.0-26.7.1","product_id":"P-8478(MySQL Cluster)V-26.7.0-26.7.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:mysql_cluster:26.7.0-26.7.1:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=26.7.0|<=26.7.1","product":{"name":"MySQL Cluster Version 26.7.0-26.7.1","product_id":"P-8479(MySQL Cluster)V-26.7.0-26.7.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:mysql_cluster:26.7.0-26.7.1:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=8.0.0|<=8.0.37","product":{"name":"MySQL Cluster Version 8.0.0-8.0.37","product_id":"P-8478(MySQL Cluster)V-8.0.0-8.0.37","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:mysql_cluster:8.0.0-8.0.37:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=8.0.0|<=8.0.49","product":{"name":"MySQL Cluster Version 8.0.0-8.0.49","product_id":"P-8478(MySQL Cluster)V-8.0.0-8.0.49","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:mysql_cluster:8.0.0-8.0.49:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=8.4.0|<=8.4.12","product":{"name":"MySQL Cluster Version 8.4.0-8.4.12","product_id":"P-8478(MySQL Cluster)V-8.4.0-8.4.12","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:mysql_cluster:8.4.0-8.4.12:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=9.7.0|<=9.7.3","product":{"name":"MySQL Cluster Version 9.7.0-9.7.3","product_id":"P-8478(MySQL Cluster)V-9.7.0-9.7.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:mysql_cluster:9.7.0-9.7.3:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"MySQL Cluster Version 9.7.3","product":{"name":"MySQL Cluster Version 9.7.3","product_id":"P-8479(MySQL Cluster)V-9.7.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:mysql_cluster:9.7.3:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"MySQL Cluster"},{"branches":[{"category":"product_version","name":"MySQL Connectors(MySQL Connectors_Connector/J) Version 26.7.0","product":{"name":"MySQL Connectors(MySQL Connectors_Connector/J) Version 26.7.0","product_id":"P-8576(MySQL Connectors_Connector/J)V-26.7.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:mysql_mysql_connectors_connector\\/j:26.7.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"MySQL Connectors(MySQL Connectors_Connector/Net) Version 26.7.0","product":{"name":"MySQL Connectors(MySQL Connectors_Connector/Net) Version 26.7.0","product_id":"P-8576(MySQL Connectors_Connector/Net)V-26.7.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:mysql_mysql_connectors_connector\\/net:26.7.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"MySQL Connectors(MySQL Connectors_Connector/Python) Version 26.7.0","product":{"name":"MySQL Connectors(MySQL Connectors_Connector/Python) Version 26.7.0","product_id":"P-8576(MySQL Connectors_Connector/Python)V-26.7.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:mysql_mysql_connectors_connector\\/python:26.7.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"MySQL Connectors(MySQL Connectors_Connector/ODBC) Version 26.7.1","product":{"name":"MySQL Connectors(MySQL Connectors_Connector/ODBC) Version 26.7.1","product_id":"P-8576(MySQL Connectors_Connector/ODBC)V-26.7.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:mysql_mysql_connectors_connector\\/odbc:26.7.1:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"MySQL Connectors"},{"branches":[{"category":"product_version","name":"MySQL Enterprise Backup Version 26.7.0","product":{"name":"MySQL Enterprise Backup Version 26.7.0","product_id":"P-4629V-26.7.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:mysql_enterprise_backup:26.7.0:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=8.0.0|<=8.0.49","product":{"name":"MySQL Enterprise Backup Version 8.0.0-8.0.49","product_id":"P-4629V-8.0.0-8.0.49","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:mysql_enterprise_backup:8.0.0-8.0.49:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=8.4.0|<=8.4.12","product":{"name":"MySQL Enterprise Backup Version 8.4.0-8.4.12","product_id":"P-4629V-8.4.0-8.4.12","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:mysql_enterprise_backup:8.4.0-8.4.12:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=9.7.0|<=9.7.3","product":{"name":"MySQL Enterprise Backup Version 9.7.0-9.7.3","product_id":"P-4629V-9.7.0-9.7.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:mysql_enterprise_backup:9.7.0-9.7.3:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"MySQL Enterprise Backup"},{"branches":[{"category":"product_version","name":"MySQL Router Version 26.7.0","product":{"name":"MySQL Router Version 26.7.0","product_id":"P-4625V-26.7.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:mysql_router:26.7.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"MySQL Router"},{"branches":[{"category":"product_version_range","name":">=26.7.0|<=26.7.1","product":{"name":"MySQL Server Version 26.7.0-26.7.1","product_id":"P-8478(MySQL Server)V-26.7.0-26.7.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:mysql_server:26.7.0-26.7.1:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=8.4.0|<=8.4.12","product":{"name":"MySQL Server Version 8.4.0-8.4.12","product_id":"P-8478(MySQL Server)V-8.4.0-8.4.12","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:mysql_server:8.4.0-8.4.12:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=9.7.0|<=9.7.3","product":{"name":"MySQL Server Version 9.7.0-9.7.3","product_id":"P-8478(MySQL Server)V-9.7.0-9.7.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:mysql_server:9.7.0-9.7.3:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"MySQL Server"}],"category":"product_family","name":"Oracle MySQL"},{"branches":[{"branches":[{"category":"product_version","name":"Oracle NoSQL Database Version 1.8.0","product":{"name":"Oracle NoSQL Database Version 1.8.0","product_id":"P-13373V-1.8.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:nosql_database:1.8.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle NoSQL Database Version 23.3.41","product":{"name":"Oracle NoSQL Database Version 23.3.41","product_id":"P-13373V-23.3.41","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:nosql_database:23.3.41:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle NoSQL Database Version 24.4.14","product":{"name":"Oracle NoSQL Database Version 24.4.14","product_id":"P-13373V-24.4.14","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:nosql_database:24.4.14:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle NoSQL Database Version 25.3.24","product":{"name":"Oracle NoSQL Database Version 25.3.24","product_id":"P-13373V-25.3.24","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:nosql_database:25.3.24:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle NoSQL Database"}],"category":"product_family","name":"Oracle NoSQL Database"},{"branches":[{"branches":[{"category":"product_version","name":"PeopleSoft Enterprise CC Common Application Objects Version 9.2","product":{"name":"PeopleSoft Enterprise CC Common Application Objects Version 9.2","product_id":"P-8911V-9.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:peoplesoft_enterprise_cc_common_application_objects:9.2:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"PeopleSoft Enterprise CC Common Application Objects"},{"branches":[{"category":"product_version","name":"PeopleSoft Enterprise FIN Cash Management Version 9.2","product":{"name":"PeopleSoft Enterprise FIN Cash Management Version 9.2","product_id":"P-4979V-9.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:peoplesoft_enterprise_fin_cash_management:9.2:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"PeopleSoft Enterprise FIN Cash Management"},{"branches":[{"category":"product_version","name":"PeopleSoft Enterprise FIN Common Objects Argentina Version 9.1","product":{"name":"PeopleSoft Enterprise FIN Common Objects Argentina Version 9.1","product_id":"P-8930V-9.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:peoplesoft_enterprise_fin_common_objects_argentina:9.1:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"PeopleSoft Enterprise FIN Common Objects Argentina"},{"branches":[{"category":"product_version","name":"PeopleSoft Enterprise FIN Common Objects Brazil Version 9.1","product":{"name":"PeopleSoft Enterprise FIN Common Objects Brazil Version 9.1","product_id":"P-8936V-9.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:peoplesoft_enterprise_fin_common_objects_brazil:9.1:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"PeopleSoft Enterprise FIN Common Objects Brazil"},{"branches":[{"category":"product_version","name":"PeopleSoft Enterprise FIN General Ledger Brazil Version 9.1","product":{"name":"PeopleSoft Enterprise FIN General Ledger Brazil Version 9.1","product_id":"P-4994V-9.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:peoplesoft_enterprise_fin_general_ledger_brazil:9.1:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"PeopleSoft Enterprise FIN General Ledger Brazil"},{"branches":[{"category":"product_version","name":"PeopleSoft Enterprise FIN Inventory Brazil Version 9.1","product":{"name":"PeopleSoft Enterprise FIN Inventory Brazil Version 9.1","product_id":"P-4998V-9.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:peoplesoft_enterprise_fin_inventory_brazil:9.1:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"PeopleSoft Enterprise FIN Inventory Brazil"},{"branches":[{"category":"product_version","name":"PeopleSoft Enterprise FIN Manufacturing Brazil Version 9.1","product":{"name":"PeopleSoft Enterprise FIN Manufacturing Brazil Version 9.1","product_id":"P-8867V-9.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:peoplesoft_enterprise_fin_manufacturing_brazil:9.1:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"PeopleSoft Enterprise FIN Manufacturing Brazil"},{"branches":[{"category":"product_version","name":"PeopleSoft Enterprise FIN Product Configurator Brazil Version 9.1","product":{"name":"PeopleSoft Enterprise FIN Product Configurator Brazil Version 9.1","product_id":"P-8870V-9.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:peoplesoft_enterprise_fin_product_configurator_brazil:9.1:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"PeopleSoft Enterprise FIN Product Configurator Brazil"},{"branches":[{"category":"product_version","name":"PeopleSoft Enterprise HCM Global Payroll Switzerland Version 9.2","product":{"name":"PeopleSoft Enterprise HCM Global Payroll Switzerland Version 9.2","product_id":"P-5068V-9.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_global_payroll_switzerland:9.2:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"PeopleSoft Enterprise HCM Global Payroll Switzerland"},{"branches":[{"category":"product_version","name":"PeopleSoft Enterprise HCM Human Resources Version 9.2","product":{"name":"PeopleSoft Enterprise HCM Human Resources Version 9.2","product_id":"P-5071V-9.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:peoplesoft_enterprise_hcm_human_resources:9.2:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"PeopleSoft Enterprise HCM Human Resources"},{"branches":[{"category":"product_version","name":"PeopleSoft Enterprise PeopleTools Version 8.61","product":{"name":"PeopleSoft Enterprise PeopleTools Version 8.61","product_id":"P-5085V-8.61","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=8.61|<=8.63","product":{"name":"PeopleSoft Enterprise PeopleTools Version 8.61-8.63","product_id":"P-5085V-8.61-8.63","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.61-8.63:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"PeopleSoft Enterprise PeopleTools Version 8.62","product":{"name":"PeopleSoft Enterprise PeopleTools Version 8.62","product_id":"P-5085V-8.62","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.62:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"PeopleSoft Enterprise PeopleTools"},{"branches":[{"category":"product_version","name":"PeopleSoft Enterprise SCM Manufacturing Version 9.2","product":{"name":"PeopleSoft Enterprise SCM Manufacturing Version 9.2","product_id":"P-5126V-9.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:peoplesoft_enterprise_scm_manufacturing:9.2:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"PeopleSoft Enterprise SCM Manufacturing"},{"branches":[{"category":"product_version","name":"PeopleSoft Enterprise SCM Purchasing Version 9.2","product":{"name":"PeopleSoft Enterprise SCM Purchasing Version 9.2","product_id":"P-5133V-9.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:peoplesoft_enterprise_scm_purchasing:9.2:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"PeopleSoft Enterprise SCM Purchasing"},{"branches":[{"category":"product_version","name":"PeopleSoft Enterprise SCM Strategic Sourcing Version 9.2","product":{"name":"PeopleSoft Enterprise SCM Strategic Sourcing Version 9.2","product_id":"P-5136V-9.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:peoplesoft_enterprise_scm_strategic_sourcing:9.2:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"PeopleSoft Enterprise SCM Strategic Sourcing"}],"category":"product_family","name":"Oracle PeopleSoft"},{"branches":[{"branches":[{"category":"product_version_range","name":">=24.2.0|<=26.1.0","product":{"name":"Oracle REST Data Services Version 24.2.0-26.1.0","product_id":"P-9456V-24.2.0-26.1.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:rest_data_services:24.2.0-26.1.0:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=24.2.0|<=26.2.1","product":{"name":"Oracle REST Data Services Version 24.2.0-26.2.1","product_id":"P-9456V-24.2.0-26.2.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:rest_data_services:24.2.0-26.2.1:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=24.2.0|<=26.2.2","product":{"name":"Oracle REST Data Services Version 24.2.0-26.2.2","product_id":"P-9456V-24.2.0-26.2.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:rest_data_services:24.2.0-26.2.2:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle REST Data Services"}],"category":"product_family","name":"Oracle REST Data Services"},{"branches":[{"branches":[{"category":"product_version","name":"Oracle Retail Merchandise Financial Planning Version 15.0","product":{"name":"Oracle Retail Merchandise Financial Planning Version 15.0","product_id":"P-1814V-15.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:retail_merchandise_financial_planning:15.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Retail Merchandise Financial Planning Version 16.0","product":{"name":"Oracle Retail Merchandise Financial Planning Version 16.0","product_id":"P-1814V-16.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:retail_merchandise_financial_planning:16.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Retail Merchandise Financial Planning"},{"branches":[{"category":"product_version","name":"Oracle Retail Merchandising System Version 19.0.1.044","product":{"name":"Oracle Retail Merchandising System Version 19.0.1.044","product_id":"P-1816V-19.0.1.044","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:retail_merchandising_system:19.0.1.044:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Retail Merchandising System"},{"branches":[{"category":"product_version","name":"Oracle Retail Predictive Application Server Version 15.0.3.190","product":{"name":"Oracle Retail Predictive Application Server Version 15.0.3.190","product_id":"P-1823V-15.0.3.190","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:retail_predictive_application_server:15.0.3.190:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Retail Predictive Application Server Version 16.0.3.350","product":{"name":"Oracle Retail Predictive Application Server Version 16.0.3.350","product_id":"P-1823V-16.0.3.350","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:retail_predictive_application_server:16.0.3.350:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Retail Predictive Application Server"},{"branches":[{"category":"product_version","name":"Oracle Retail Xstore Point of Service Version 21.0.5","product":{"name":"Oracle Retail Xstore Point of Service Version 21.0.5","product_id":"P-11513V-21.0.5","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:retail_xstore_point_of_service:21.0.5:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Retail Xstore Point of Service Version 22.0.3","product":{"name":"Oracle Retail Xstore Point of Service Version 22.0.3","product_id":"P-11513V-22.0.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:retail_xstore_point_of_service:22.0.3:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Retail Xstore Point of Service Version 23.0.3","product":{"name":"Oracle Retail Xstore Point of Service Version 23.0.3","product_id":"P-11513V-23.0.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:retail_xstore_point_of_service:23.0.3:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Retail Xstore Point of Service Version 24.0.2","product":{"name":"Oracle Retail Xstore Point of Service Version 24.0.2","product_id":"P-11513V-24.0.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:retail_xstore_point_of_service:24.0.2:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Retail Xstore Point of Service Version 25.0.1","product":{"name":"Oracle Retail Xstore Point of Service Version 25.0.1","product_id":"P-11513V-25.0.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:retail_xstore_point_of_service:25.0.1:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Retail Xstore Point of Service Version 26.0.0","product":{"name":"Oracle Retail Xstore Point of Service Version 26.0.0","product_id":"P-11513V-26.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:retail_xstore_point_of_service:26.0.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Retail Xstore Point of Service"}],"category":"product_family","name":"Oracle Retail Applications"},{"branches":[{"branches":[{"category":"product_version_range","name":">=23.1.1|<=26.1.0","product":{"name":"Oracle SQL Developer(Oracle SQL Developer_Infrastructure) Version 23.1.1-26.1.0","product_id":"P-1875(Oracle SQL Developer_Infrastructure)V-23.1.1-26.1.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:sql_developer:23.1.1-26.1.0:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=23.1.1|<=26.1.0","product":{"name":"Oracle SQL Developer(Oracle SQL Developer_Installation) Version 23.1.1-26.1.0","product_id":"P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:sql_developer:23.1.1-26.1.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle SQL Developer"}],"category":"product_family","name":"Oracle SQL Developer"},{"branches":[{"branches":[{"category":"product_version","name":"Oracle Secure Backup Version 19.1.0.0.0","product":{"name":"Oracle Secure Backup Version 19.1.0.0.0","product_id":"P-1522V-19.1.0.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:secure_backup:19.1.0.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Secure Backup Version 19.1.0.1.0","product":{"name":"Oracle Secure Backup Version 19.1.0.1.0","product_id":"P-1522V-19.1.0.1.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:secure_backup:19.1.0.1.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Secure Backup"}],"category":"product_family","name":"Oracle Secure Backup"},{"branches":[{"branches":[{"category":"product_version_range","name":">=17.0|<=26.9","product":{"name":"Siebel Apps - Customer Order Management Version 17.0-26.9","product_id":"P-8967V-17.0-26.9","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:siebel_apps_-_customer_order_management:17.0-26.9:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Siebel Apps - Customer Order Management"},{"branches":[{"category":"product_version_range","name":">=17.0|<=26.9","product":{"name":"Siebel Apps - Field Service Version 17.0-26.9","product_id":"P-8971V-17.0-26.9","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:siebel_apps_-_field_service:17.0-26.9:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Siebel Apps - Field Service"},{"branches":[{"category":"product_version_range","name":">=17.0|<=26.9","product":{"name":"Siebel Apps - Financial Services Version 17.0-26.9","product_id":"P-9170V-17.0-26.9","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:siebel_apps_-_financial_services:17.0-26.9:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Siebel Apps - Financial Services"},{"branches":[{"category":"product_version_range","name":">=17.0|<=26.9","product":{"name":"Siebel Apps - Life Sciences Version 17.0-26.9","product_id":"P-9173V-17.0-26.9","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:siebel_apps_-_life_sciences:17.0-26.9:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Siebel Apps - Life Sciences"},{"branches":[{"category":"product_version_range","name":">=17.0|<=26.9","product":{"name":"Siebel Apps - Marketing Version 17.0-26.9","product_id":"P-8974V-17.0-26.9","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:siebel_apps_-_marketing:17.0-26.9:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Siebel Apps - Marketing"},{"branches":[{"category":"product_version_range","name":">=25.12|<=26.9","product":{"name":"Siebel CRM Administration Version 25.12-26.9","product_id":"P-9747V-25.12-26.9","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:siebel_crm_administration:25.12-26.9:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Siebel CRM Administration"},{"branches":[{"category":"product_version_range","name":">=17.0|<=26.9","product":{"name":"Siebel CRM Cloud Applications Version 17.0-26.9","product_id":"P-14107V-17.0-26.9","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:siebel_crm_cloud_applications:17.0-26.9:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=22.3|<=26.9","product":{"name":"Siebel CRM Cloud Applications Version 22.3-26.9","product_id":"P-14107V-22.3-26.9","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:siebel_crm_cloud_applications:22.3-26.9:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Siebel CRM Cloud Applications"},{"branches":[{"category":"product_version_range","name":">=17.0|<=26.9","product":{"name":"Siebel CRM Deployment(Siebel CRM Deployment_Application Interface) Version 17.0-26.9","product_id":"P-9019(Siebel CRM Deployment_Application Interface)V-17.0-26.9","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:siebel_crm_deployment:17.0-26.9:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=17.0|<=26.9","product":{"name":"Siebel CRM Deployment(Siebel CRM Deployment_Server Infrastructure) Version 17.0-26.9","product_id":"P-9019(Siebel CRM Deployment_Server Infrastructure)V-17.0-26.9","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:siebel_crm_deployment:17.0-26.9:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=17.0|<=26.9","product":{"name":"Siebel CRM Deployment Version 17.0-26.9","product_id":"P-9019V-17.0-26.9","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:siebel_crm_deployment:17.0-26.9:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Siebel CRM Deployment"},{"branches":[{"category":"product_version_range","name":">=17.0|<=26.9","product":{"name":"Siebel CRM Development Version 17.0-26.9","product_id":"P-9001V-17.0-26.9","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:siebel_crm_development:17.0-26.9:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=25.12|<=26.9","product":{"name":"Siebel CRM Development Version 25.12-26.9","product_id":"P-9001V-25.12-26.9","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:siebel_crm_development:25.12-26.9:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Siebel CRM Development"},{"branches":[{"category":"product_version_range","name":">=17.0|<=26.9","product":{"name":"Siebel CRM End User Version 17.0-26.9","product_id":"P-9011V-17.0-26.9","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:siebel_crm_end_user:17.0-26.9:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Siebel CRM End User"},{"branches":[{"category":"product_version_range","name":">=17.0|<=26.9","product":{"name":"Siebel CRM Integration Version 17.0-26.9","product_id":"P-9008V-17.0-26.9","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:siebel_crm_integration:17.0-26.9:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=25.12|<=26.9","product":{"name":"Siebel CRM Integration Version 25.12-26.9","product_id":"P-9008V-25.12-26.9","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:siebel_crm_integration:25.12-26.9:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Siebel CRM Integration"},{"branches":[{"category":"product_version_range","name":">=17.0|<=26.9","product":{"name":"Siebel Life Sciences Version 17.0-26.9","product_id":"P-12576V-17.0-26.9","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:siebel_life_sciences:17.0-26.9:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Siebel Life Sciences"}],"category":"product_family","name":"Oracle Siebel CRM"},{"branches":[{"branches":[{"category":"product_version","name":"Oracle Agile Engineering Data Management Version 6.2.1","product":{"name":"Oracle Agile Engineering Data Management Version 6.2.1","product_id":"P-4436V-6.2.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:agile_engineering_data_management:6.2.1:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Agile Engineering Data Management"},{"branches":[{"category":"product_version","name":"Oracle Agile PLM Version 2.6","product":{"name":"Oracle Agile PLM Version 2.6","product_id":"P-4461V-2.6","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:agile_plm:2.6:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Agile PLM Version 9.3.6","product":{"name":"Oracle Agile PLM Version 9.3.6","product_id":"P-4429V-9.3.6","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Agile PLM Version 9.3.6","product":{"name":"Oracle Agile PLM Version 9.3.6","product_id":"P-4461V-9.3.6","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:agile_plm:9.3.6:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Agile PLM"},{"branches":[{"category":"product_version","name":"Oracle Agile PLM MCAD Connector Version 3.6","product":{"name":"Oracle Agile PLM MCAD Connector Version 3.6","product_id":"P-4440V-3.6","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:agile_plm_mcad_connector:3.6:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Agile PLM MCAD Connector"},{"branches":[{"category":"product_version","name":"Oracle Agile Product Lifecycle Management for Process Version 6.2.4","product":{"name":"Oracle Agile Product Lifecycle Management for Process Version 6.2.4","product_id":"P-4445V-6.2.4","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.4:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Agile Product Lifecycle Management for Process"},{"branches":[{"category":"product_version","name":"Oracle Demand Planning Version 12.1","product":{"name":"Oracle Demand Planning Version 12.1","product_id":"P-723V-12.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:demand_planning:12.1:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Demand Planning Version 12.2","product":{"name":"Oracle Demand Planning Version 12.2","product_id":"P-723V-12.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:demand_planning:12.2:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Demand Planning"},{"branches":[{"category":"product_version","name":"Oracle Product Lifecycle Analytics Version 3.6.1","product":{"name":"Oracle Product Lifecycle Analytics Version 3.6.1","product_id":"P-9387V-3.6.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:product_lifecycle_analytics:3.6.1:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Product Lifecycle Analytics"}],"category":"product_family","name":"Oracle Supply Chain"},{"branches":[{"branches":[{"category":"product_version","name":"Oracle Solaris Version 11.3","product":{"name":"Oracle Solaris Version 11.3","product_id":"P-10006V-11.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:solaris:11.3:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Solaris Version 11.4","product":{"name":"Oracle Solaris Version 11.4","product_id":"P-10006V-11.4","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:solaris:11.4:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Solaris"},{"branches":[{"category":"product_version","name":"Oracle ZFS Storage Appliance Kit Version 8.8","product":{"name":"Oracle ZFS Storage Appliance Kit Version 8.8","product_id":"P-10026V-8.8","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle ZFS Storage Appliance Kit"}],"category":"product_family","name":"Oracle Systems"},{"branches":[{"branches":[{"category":"product_version_range","name":">=22.1|<=22.1.1.41.0","product":{"name":"Oracle TimesTen In-Memory Database Version 22.1-22.1.1.41.0","product_id":"P-1870V-22.1-22.1.1.41.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:timesten_in-memory_database:22.1-22.1.1.41.0:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=22.1|<=22.1.1.43.0","product":{"name":"Oracle TimesTen In-Memory Database Version 22.1-22.1.1.43.0","product_id":"P-1870V-22.1-22.1.1.43.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:timesten_in-memory_database:22.1-22.1.1.43.0:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=22.1|<=22.1.40.0","product":{"name":"Oracle TimesTen In-Memory Database Version 22.1-22.1.40.0","product_id":"P-1870V-22.1-22.1.40.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:timesten_in-memory_database:22.1-22.1.40.0:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=26.1|<=26.1.1.2.0","product":{"name":"Oracle TimesTen In-Memory Database Version 26.1-26.1.1.2.0","product_id":"P-1870V-26.1-26.1.1.2.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:timesten_in-memory_database:26.1-26.1.1.2.0:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=26.1|<=26.1.1.3.0","product":{"name":"Oracle TimesTen In-Memory Database Version 26.1-26.1.1.3.0","product_id":"P-1870V-26.1-26.1.1.3.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:timesten_in-memory_database:26.1-26.1.1.3.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle TimesTen In-Memory Database"}],"category":"product_family","name":"Oracle TimesTen In-Memory Database"},{"branches":[{"branches":[{"category":"product_version","name":"Oracle Trusted Answer Search Version 26.1","product":{"name":"Oracle Trusted Answer Search Version 26.1","product_id":"P-15098V-26.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:trusted_answer_search:26.1:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Trusted Answer Search"}],"category":"product_family","name":"Oracle Trusted Answer Search"},{"branches":[{"branches":[{"category":"product_version","name":"Oracle Utilities Application Framework Version 25.10","product":{"name":"Oracle Utilities Application Framework Version 25.10","product_id":"P-2245V-25.10","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:utilities_application_framework:25.10:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Utilities Application Framework Version 25.4","product":{"name":"Oracle Utilities Application Framework Version 25.4","product_id":"P-2245V-25.4","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:utilities_application_framework:25.4:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Utilities Application Framework Version 26.10","product":{"name":"Oracle Utilities Application Framework Version 26.10","product_id":"P-2245V-26.10","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:utilities_application_framework:26.10:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Utilities Application Framework Version 26.4","product":{"name":"Oracle Utilities Application Framework Version 26.4","product_id":"P-2245V-26.4","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:utilities_application_framework:26.4:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Utilities Application Framework Version 4.4.0.2.0","product":{"name":"Oracle Utilities Application Framework Version 4.4.0.2.0","product_id":"P-2245V-4.4.0.2.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:utilities_application_framework:4.4.0.2.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Utilities Application Framework Version 4.4.0.3.0","product":{"name":"Oracle Utilities Application Framework Version 4.4.0.3.0","product_id":"P-2245V-4.4.0.3.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:utilities_application_framework:4.4.0.3.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Utilities Application Framework Version 4.4.0.4.0","product":{"name":"Oracle Utilities Application Framework Version 4.4.0.4.0","product_id":"P-2245V-4.4.0.4.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:utilities_application_framework:4.4.0.4.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Utilities Application Framework Version 4.5.0.0.0","product":{"name":"Oracle Utilities Application Framework Version 4.5.0.0.0","product_id":"P-2245V-4.5.0.0.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:utilities_application_framework:4.5.0.0.0:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Utilities Application Framework Version 4.5.0.1.1","product":{"name":"Oracle Utilities Application Framework Version 4.5.0.1.1","product_id":"P-2245V-4.5.0.1.1","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:utilities_application_framework:4.5.0.1.1:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Utilities Application Framework Version 4.5.0.1.3","product":{"name":"Oracle Utilities Application Framework Version 4.5.0.1.3","product_id":"P-2245V-4.5.0.1.3","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:utilities_application_framework:4.5.0.1.3:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle Utilities Application Framework Version 4.5.0.2.0","product":{"name":"Oracle Utilities Application Framework Version 4.5.0.2.0","product_id":"P-2245V-4.5.0.2.0","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:utilities_application_framework:4.5.0.2.0:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Utilities Application Framework"},{"branches":[{"category":"product_version_range","name":">=2.4.0.1.0|<=2.4.0.1.33","product":{"name":"Oracle Utilities Network Management System Version 2.4.0.1.0-2.4.0.1.33","product_id":"P-2241V-2.4.0.1.0-2.4.0.1.33","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:utilities_network_management_system:2.4.0.1.0-2.4.0.1.33:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=2.5.0.1.0|<=2.5.0.1.18","product":{"name":"Oracle Utilities Network Management System Version 2.5.0.1.0-2.5.0.1.18","product_id":"P-2241V-2.5.0.1.0-2.5.0.1.18","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:utilities_network_management_system:2.5.0.1.0-2.5.0.1.18:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=2.5.0.2.0|<=2.5.0.2.11","product":{"name":"Oracle Utilities Network Management System Version 2.5.0.2.0-2.5.0.2.11","product_id":"P-2241V-2.5.0.2.0-2.5.0.2.11","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:utilities_network_management_system:2.5.0.2.0-2.5.0.2.11:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=2.6.0.1.0|<=2.6.0.1.12","product":{"name":"Oracle Utilities Network Management System Version 2.6.0.1.0-2.6.0.1.12","product_id":"P-2241V-2.6.0.1.0-2.6.0.1.12","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:utilities_network_management_system:2.6.0.1.0-2.6.0.1.12:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=2.6.0.2.0|<=2.6.0.2.10","product":{"name":"Oracle Utilities Network Management System Version 2.6.0.2.0-2.6.0.2.10","product_id":"P-2241V-2.6.0.2.0-2.6.0.2.10","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:utilities_network_management_system:2.6.0.2.0-2.6.0.2.10:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=2.6.0.2.0|<=2.6.0.2.9","product":{"name":"Oracle Utilities Network Management System Version 2.6.0.2.0-2.6.0.2.9","product_id":"P-2241V-2.6.0.2.0-2.6.0.2.9","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:utilities_network_management_system:2.6.0.2.0-2.6.0.2.9:*:*:*:*:*:*:*"}}},{"category":"product_version_range","name":">=25.12.0.0.0|<=25.12.0.0.2","product":{"name":"Oracle Utilities Network Management System Version 25.12.0.0.0-25.12.0.0.2","product_id":"P-2241V-25.12.0.0.0-25.12.0.0.2","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:utilities_network_management_system:25.12.0.0.0-25.12.0.0.2:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle Utilities Network Management System"}],"category":"product_family","name":"Oracle Utilities Applications"},{"branches":[{"branches":[{"category":"product_version","name":"Oracle VM VirtualBox Version 7.2.16","product":{"name":"Oracle VM VirtualBox Version 7.2.16","product_id":"P-8370V-7.2.16","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:vm_virtualbox:7.2.16:*:*:*:*:*:*:*"}}},{"category":"product_version","name":"Oracle VM VirtualBox Version 7.2.20","product":{"name":"Oracle VM VirtualBox Version 7.2.20","product_id":"P-8370V-7.2.20","product_identification_helper":{"cpe":"cpe:2.3:a:oracle:vm_virtualbox:7.2.20:*:*:*:*:*:*:*"}}}],"category":"product_name","name":"Oracle VM VirtualBox"}],"category":"product_family","name":"Oracle Virtualization"}],"category":"vendor","name":"Oracle"}]},"vulnerabilities":[{"cve":"CVE-2021-42576","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40071405"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (bluemonday)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance. CVSS 3.1 Base Score 6.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-14597V-7.0.0"]}]},{"cve":"CVE-2022-1471","ids":[{"system_name":"Oracle Bug ID of Oracle Data Integrator","text":"39674841"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Repository (SnakeYAML)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Data Integrator executes to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2196V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2196V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2196V-14.1.2.0.0"]}]},{"cve":"CVE-2022-2047","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40063481"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Eclipse Jetty)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2022-2048","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40063481"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Eclipse Jetty)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2022-23181","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068469"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (Apache Tomcat)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2022-25147","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40058726"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Portable Runtime)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2022-28331","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40058726"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Portable Runtime)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2022-34169","ids":[{"system_name":"Oracle Bug ID of Oracle Product Lifecycle Analytics","text":"39530125"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues (Apache Xalan-Java)).   The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product Lifecycle Analytics.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Product Lifecycle Analytics accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9387V-3.6.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9387V-3.6.1"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-9387V-3.6.1"]}]},{"cve":"CVE-2022-41853","ids":[{"system_name":"Oracle Bug ID of Oracle Data Integrator","text":"39674781"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2196V-14.1.2.0.0","P-2196V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2196V-12.2.1.4.0","P-2196V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2022-43552","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40059631"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (libcurl)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2022-45378","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39179722"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC (Apache SOAP)).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2023-23916","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40059631"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (libcurl)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2023-26048","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40063481"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Eclipse Jetty)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2023-26049","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40063481"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Eclipse Jetty)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2023-27535","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40059631"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (libcurl)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2023-27536","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40059631"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (libcurl)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2023-28321","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40059631"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (libcurl)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2023-28322","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40059631"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (libcurl)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2023-35116","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39663592"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure (jackson-databind)).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}]},{"cve":"CVE-2023-38546","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40059631"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (libcurl)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2023-43622","ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39480073"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core (Apache HTTP Server)).  Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5242V-15.1.1.0.0","P-5242V-14.1.2.0.0","P-5242V-14.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-5242V-14.1.1.0.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-5242V-15.1.1.0.0","P-5242V-14.1.1.0.0","P-5242V-14.1.2.0.0"]}]},{"cve":"CVE-2023-44487","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40063481"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Eclipse Jetty)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2023-46218","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40059631"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (libcurl)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2023-49582","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40058726"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Portable Runtime)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2023-52428","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Orchestrator","text":"38712827"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security (Nimbus JOSE+JWT)).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator.  While the vulnerability is in JD Edwards EnterpriseOne Orchestrator, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Orchestrator.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-11681V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11681V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}]},{"cve":"CVE-2024-12798","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2024-20925","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"40057949"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Change Assistant).   The supported version that is affected is 8.61. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61"]}]},{"cve":"CVE-2024-2398","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40059631"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (libcurl)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2024-36137","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2024-38356","ids":[{"system_name":"Oracle Bug ID of Oracle Communications EAGLE Element Management System","text":"37859737"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE Element Management System product of Oracle Communications (component: Platform (TinyMCE)).   The supported version that is affected is 47.0.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications EAGLE Element Management System.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications EAGLE Element Management System, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications EAGLE Element Management System accessible data as well as  unauthorized read access to a subset of Oracle Communications EAGLE Element Management System accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-11125V-47.0.0.2.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11125V-47.0.0.2.0"],"url":"https://support.oracle.com/support/?documentId=CPU399"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-11125V-47.0.0.2.0"]}]},{"cve":"CVE-2024-38357","ids":[{"system_name":"Oracle Bug ID of Oracle Communications EAGLE Element Management System","text":"37859737"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE Element Management System product of Oracle Communications (component: Platform (TinyMCE)).   The supported version that is affected is 47.0.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications EAGLE Element Management System.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Communications EAGLE Element Management System, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications EAGLE Element Management System accessible data as well as  unauthorized read access to a subset of Oracle Communications EAGLE Element Management System accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-11125V-47.0.0.2.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11125V-47.0.0.2.0"],"url":"https://support.oracle.com/support/?documentId=CPU399"}]},{"cve":"CVE-2024-38949","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"38815790"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Search Export SDK (libheif)).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2024-38950","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"38815790"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Search Export SDK (libheif)).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2024-41311","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"38815790"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Search Export SDK (libheif)).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2024-4367","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2024-47072","ids":[{"system_name":"Oracle Bug ID of Oracle Communications EAGLE Element Management System","text":"37509183"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE Element Management System product of Oracle Communications (component: Security (XStream)).   The supported version that is affected is 47.0.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications EAGLE Element Management System.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications EAGLE Element Management System. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-11125V-47.0.0.2.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11125V-47.0.0.2.0"],"url":"https://support.oracle.com/support/?documentId=CPU399"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-11125V-47.0.0.2.0"]}]},{"cve":"CVE-2024-47554","ids":[{"system_name":"Oracle Bug ID of Oracle Hospitality OPERA 5 Property Services","text":"37477119"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: OPERA Login (Apache Commons IO)).   The supported version that is affected is 5.6.28.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hospitality OPERA 5 Property Services. CVSS 3.1 Base Score 4.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-11580V-5.6.28.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11580V-5.6.28.0"],"url":"https://support.oracle.com/support/?documentId=CPU379"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-11580V-5.6.28.0"]}]},{"cve":"CVE-2024-47778","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39416135"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (gstreamer)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle JavaFX accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2024-52316","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068469"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (Apache Tomcat)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2024-53899","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40064509"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (virtualenv)).  Supported versions that are affected are 6.1.1-7.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications Unified Assurance accessible data as well as  unauthorized read access to a subset of Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2024-6763","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39663592"},{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39483415"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Policy","text":"37664990"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40063481"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Alarms, KPI, and Measurements (Eclipse Jetty)).  Supported versions that are affected are 24.2.4-25.2.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications Cloud Native Core Policy accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Eclipse Jetty)).  Supported versions that are affected are 26.1.0.0.0-26.2.0.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GoldenGate Stream Analytics.  While the vulnerability is in Oracle GoldenGate Stream Analytics, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle GoldenGate Stream Analytics accessible data as well as  unauthorized read access to a subset of Oracle GoldenGate Stream Analytics accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure (jackson-databind)).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Eclipse Jetty)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9","P-14277V-24.2.4-25.2.000","P-14597V-7.0.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14277V-24.2.4-25.2.000"],"url":"https://support.oracle.com/support/?documentId=CPU406"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-14277V-24.2.4-25.2.000"]}]},{"cve":"CVE-2025-10148","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2025-10966","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2025-11143","ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39483415"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Eclipse Jetty)).  Supported versions that are affected are 26.1.0.0.0-26.2.0.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GoldenGate Stream Analytics.  While the vulnerability is in Oracle GoldenGate Stream Analytics, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle GoldenGate Stream Analytics accessible data as well as  unauthorized read access to a subset of Oracle GoldenGate Stream Analytics accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2025-12383","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39969457"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Eclipse Jersey)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2025-13034","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2025-13151","ids":[{"system_name":"Oracle Bug ID of Oracle Communications LSMS","text":"38850317"},{"system_name":"Oracle Bug ID of Oracle Communications EAGLE LNP Application Processor","text":"38850316"},{"system_name":"Oracle Bug ID of Oracle Communications Policy Management","text":"38850319"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Network Repository Function","text":"38850307"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Service Communication Proxy","text":"38850311"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Network Repository Function product of Oracle Communications (component: Install (Libtasn1)).  Supported versions that are affected are 25.2.202 and 26.1.202. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Network Repository Function.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Network Repository Function. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Service Communication Proxy product of Oracle Communications (component: Install (Libtasn1)).  Supported versions that are affected are 25.1.100, 25.1.200, 25.2.100 and  25.2.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Service Communication Proxy.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Service Communication Proxy. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE LNP Application Processor product of Oracle Communications (component: Platform (Libtasn1)).   The supported version that is affected is 11.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE LNP Application Processor.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications EAGLE LNP Application Processor. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications LSMS product of Oracle Communications (component: Platform (Libtasn1)).   The supported version that is affected is 14.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications LSMS.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications LSMS. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Policy Management product of Oracle Communications (component: CMP (Libtasn1)).  Supported versions that are affected are 15.0.0.0.0 and  15.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Policy Management. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14117V-25.2.100","P-14117V-25.2.200","P-14117V-25.1.200","P-11118V-11.0","P-10900V-15.0.0.0.0","P-14118(Oracle Communications Cloud Native Core Network Repository Function_Install)V-25.2.202","P-11114V-14.0","P-14117V-25.1.100","P-10900V-15.1.0.0.0","P-14118(Oracle Communications Cloud Native Core Network Repository Function_Install)V-26.1.202"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14118(Oracle Communications Cloud Native Core Network Repository Function_Install)V-25.2.202","P-14118(Oracle Communications Cloud Native Core Network Repository Function_Install)V-26.1.202"],"url":"https://support.oracle.com/support/?documentId=CPU402"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14117V-25.2.100","P-14117V-25.2.200","P-14117V-25.1.200","P-14117V-25.1.100"],"url":"https://support.oracle.com/support/?documentId=CPU404"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11118V-11.0"],"url":"https://support.oracle.com/support/?documentId=CPU409"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11114V-14.0"],"url":"https://support.oracle.com/support/?documentId=CPU408"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10900V-15.0.0.0.0","P-10900V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU403"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-14117V-25.2.100","P-14117V-25.2.200","P-14117V-25.1.200","P-11118V-11.0","P-10900V-15.0.0.0.0","P-14118(Oracle Communications Cloud Native Core Network Repository Function_Install)V-25.2.202","P-11114V-14.0","P-14117V-25.1.100","P-10900V-15.1.0.0.0","P-14118(Oracle Communications Cloud Native Core Network Repository Function_Install)V-26.1.202"]}]},{"cve":"CVE-2025-14017","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2025-14524","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2025-14813","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39989976"},{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39894904"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Bouncy Castle Java Library)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (Bouncy Castle Java Library)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-14.1.2.0.0","P-12738V-15.1.1.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0"],"known_not_affected":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2025-14819","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2025-15079","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2025-15224","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2025-15467","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"38906645"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC (OpenSSL)).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-4781V-9.2.0.0-9.2.26.5","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-4629V-9.7.0-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2025-15661","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39744923"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: File Processing (libssh2)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2025-24813","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068469"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (Apache Tomcat)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2025-25193","ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"40024514"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Netty)).  Supported versions that are affected are 19.1.0.0.0-19.1.0.0.16. Easily exploitable vulnerability allows low privileged attacker with network access via TLS to compromise Oracle GoldenGate Stream Analytics.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle GoldenGate Stream Analytics.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-19.1.0.0.0-19.1.0.0.16"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-19.1.0.0.0-19.1.0.0.16"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2025-27820","ids":[{"system_name":"Oracle Bug ID of Oracle SQLcl (Apache HttpComponents)","text":"39880633"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SQLcl (Apache HttpComponents) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32, 21.3-21.23 and  23.4.0-23.26.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SQLcl (Apache HttpComponents).  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle SQLcl (Apache HttpComponents).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13824V-21.3-21.23","P-13824V-19.3-19.32","P-13824V-23.4.0-23.26.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13824V-21.3-21.23","P-13824V-23.4.0-23.26.3","P-13824V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2025-43857","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2025-48431","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2025-48734","ids":[{"system_name":"Oracle Bug ID of Oracle Enterprise Manager for Virtualization","text":"38722525"},{"system_name":"Oracle Bug ID of Oracle Enterprise Manager Base Platform","text":"38849328"},{"system_name":"Oracle Bug ID of Oracle Communications EAGLE Element Management System","text":"38012253"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE Element Management System product of Oracle Communications (component: Security (Apache Commons BeanUtils)).   The supported version that is affected is 47.0.0.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications EAGLE Element Management System.  Successful attacks of this vulnerability can result in takeover of Oracle Communications EAGLE Element Management System. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Enterprise Manager for Virtualization product of Oracle Enterprise Manager (component: Generic Virtualization (Apache Commons BeanUtils)).   The supported version that is affected is 13.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Virtualization.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Virtualization. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Oracle Management Service (Apache Commons BeanUtils)).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1370V-24.1","P-1370V-13.5","P-11125V-47.0.0.2.0","P-9586V-13.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11125V-47.0.0.2.0"],"url":"https://support.oracle.com/support/?documentId=CPU399"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1370V-24.1","P-9586V-13.5","P-1370V-13.5"],"url":"https://support.oracle.com/support/?documentId=CPU391"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1370V-24.1","P-11125V-47.0.0.2.0","P-9586V-13.5","P-1370V-13.5"]}]},{"cve":"CVE-2025-48924","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"38421267"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Service Communication Proxy","text":"38421268"},{"system_name":"Oracle Bug ID of Oracle Essbase","text":"40003196"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Unified Data Repository","text":"38421269"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Automated Test Suite Framework (Apache Commons Lang)).  Supported versions that are affected are 25.2.201 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Cloud Native Core Security Edge Protection Proxy. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Service Communication Proxy product of Oracle Communications (component: Install (Apache Commons Lang)).  Supported versions that are affected are 25.1.200, 25.2.100 and  25.2.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Service Communication Proxy.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Cloud Native Core Service Communication Proxy. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Unified Data Repository product of Oracle Communications (component: Signaling (Apache Commons Lang)).   The supported version that is affected is 25.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Unified Data Repository.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Cloud Native Core Unified Data Repository. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in Oracle Essbase (component: Infrastructure (Apache Commons Lang)).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.201","P-14117V-25.2.100","P-4379V-21.8.3.0.0","P-14117V-25.2.200","P-14117V-25.1.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200","P-14119V-25.1.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.201","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14117V-25.2.100","P-14117V-25.2.200","P-14117V-25.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU404"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14119V-25.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU407"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.201","P-14117V-25.2.100","P-4379V-21.8.3.0.0","P-14117V-25.2.200","P-14117V-25.1.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200","P-14119V-25.1.200"]}]},{"cve":"CVE-2025-48977","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39951317"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Apache Ignite)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2025-4949","ids":[{"system_name":"Oracle Bug ID of Oracle SQL Developer","text":"38336218"}],"notes":[{"category":"description","text":"Vulnerability in Oracle SQL Developer (component: Infrastructure (Eclipse JGit)).  Supported versions that are affected are 23.1.1-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SQL Developer.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle SQL Developer. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1875(Oracle SQL Developer_Infrastructure)V-23.1.1-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1875(Oracle SQL Developer_Infrastructure)V-23.1.1-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-1875(Oracle SQL Developer_Infrastructure)V-23.1.1-26.1.0"]}]},{"cve":"CVE-2025-49506","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40058726"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Portable Runtime)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2025-53864","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Orchestrator","text":"38712827"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security (Nimbus JOSE+JWT)).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator.  While the vulnerability is in JD Edwards EnterpriseOne Orchestrator, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Orchestrator. CVSS 3.1 Base Score 5.8 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-11681V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11681V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":5.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","version":"3.1"},"products":["P-11681V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2025-61728","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39891512"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager (Golang Go)).  Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2025-61772","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2025-61780","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2025-61919","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2025-64775","ids":[{"system_name":"Oracle Bug ID of Oracle Hospitality OPERA 5 Property Services","text":"38727139"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: OPERA Login (Apache Struts)).   The supported version that is affected is 5.6.28.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Hospitality OPERA 5 Property Services.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hospitality OPERA 5 Property Services. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-11580V-5.6.28.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11580V-5.6.28.2"],"url":"https://support.oracle.com/support/?documentId=CPU379"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-11580V-5.6.28.2"]}]},{"cve":"CVE-2025-67030","ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Big Data and Application Adapters","text":"39247183"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate (component: Java Delivery (Plexus Utils)).  Supported versions that are affected are 21.3-21.20 and   23.4-23.26.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GoldenGate Big Data and Application Adapters.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate Big Data and Application Adapters. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5760V-23.4-23.26.1","P-5760V-21.3-21.20"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5760V-23.4-23.26.1","P-5760V-21.3-21.20"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5760V-23.4-23.26.1","P-5760V-21.3-21.20"]}]},{"cve":"CVE-2025-67721","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_cannot_be_controlled_by_adversary","product_ids":["P-13373V-1.8.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39712485"},{"system_name":"Oracle Bug ID of Oracle NoSQL Database","text":"39712483"}],"notes":[{"category":"description","text":"Security-in-Depth issue in Oracle NoSQL Database (component: Administration (Aircompressor)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: General Issues (Aircompressor)).  Supported versions that are affected are 19.1.0.0.0-19.1.0.0.16. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle GoldenGate Stream Analytics.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle GoldenGate Stream Analytics accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14015(Oracle GoldenGate Stream Analytics_General Issues)V-19.1.0.0.0-19.1.0.0.16"],"known_not_affected":["P-13373V-1.8.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13373V-1.8.0","P-14015(Oracle GoldenGate Stream Analytics_General Issues)V-19.1.0.0.0-19.1.0.0.16"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-13373V-1.8.0"]},{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_General Issues)V-19.1.0.0.0-19.1.0.0.16"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The vulnerable component is present, and the component contains the vulnerable code. However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.","product_ids":["P-13373V-1.8.0"]}]},{"cve":"CVE-2025-68160","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"38906645"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC (OpenSSL)).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-4781V-9.2.0.0-9.2.26.5","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-4629V-9.7.0-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2025-68161","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39399045"},{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39179738"},{"system_name":"Oracle Bug ID of Oracle SQL Developer","text":"39399134"},{"system_name":"Oracle Bug ID of Oracle Hospitality OPERA 5 Property Services","text":"39399054"},{"system_name":"Oracle Bug ID of Oracle Communications EAGLE Element Management System","text":"39398940"},{"system_name":"Oracle Bug ID of Oracle Retail Merchandise Financial Planning","text":"39399104"},{"system_name":"Oracle Bug ID of Oracle WebCenter Sites","text":"39281797"},{"system_name":"Oracle Bug ID of Oracle Retail Merchandising System","text":"39399105"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC (Apache Log4j)).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites (Apache Log4j)).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle WebCenter Sites.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Sites accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE Element Management System product of Oracle Communications (component: Security (Apache Log4j)).   The supported version that is affected is 47.0.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE Element Management System.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications EAGLE Element Management System accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Apache Log4j)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: OPERA Login (Apache Log4j)).   The supported version that is affected is 5.6.28.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality OPERA 5 Property Services accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Merchandise Financial Planning product of Oracle Retail Applications (component: Application Core (Apache Log4j)).  Supported versions that are affected are 15.0 and  16.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Merchandise Financial Planning.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Retail Merchandise Financial Planning accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Merchandising System product of Oracle Retail Applications (component: Security (Apache Log4j)).   The supported version that is affected is 19.0.1.044. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Merchandising System.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Retail Merchandising System accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle SQL Developer (component: Installation (Apache Log4j)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5","P-11580V-5.6.28.2","P-9617V-12.2.1.4.0","P-11125V-47.0.0.2.0","P-1816V-19.0.1.044","P-1814V-16.0","P-1814V-15.0"],"known_not_affected":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9617V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11125V-47.0.0.2.0"],"url":"https://support.oracle.com/support/?documentId=CPU399"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11580V-5.6.28.2"],"url":"https://support.oracle.com/support/?documentId=CPU379"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1816V-19.0.1.044","P-1814V-16.0","P-1814V-15.0"],"url":"https://support.oracle.com/support/?documentId=CPU369"}],"scores":[{"cvss_v3":{"baseScore":4.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]},{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2025-69418","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"38906645"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC (OpenSSL)).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-4781V-9.2.0.0-9.2.26.5","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-4629V-9.7.0-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2025-69419","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"38906645"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC (OpenSSL)).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-4781V-9.2.0.0-9.2.26.5","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-4629V-9.7.0-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2025-69420","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"38906645"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC (OpenSSL)).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-4781V-9.2.0.0-9.2.26.5","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-4629V-9.7.0-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2025-69421","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"38906645"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC (OpenSSL)).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-4781V-9.2.0.0-9.2.26.5","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-4629V-9.7.0-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2025-6965","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-619(Oracle Spatial and Graph-gdal)V-23.4.0-23.26.3","P-619(Oracle Spatial and Graph-gdal)V-19.3-19.32","P-619(Oracle Spatial and Graph-gdal)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"39872089"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle Spatial and Graph (gdal) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-619(Oracle Spatial and Graph-gdal)V-21.3-21.23","P-619(Oracle Spatial and Graph-gdal)V-23.4.0-23.26.3","P-619(Oracle Spatial and Graph-gdal)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-619(Oracle Spatial and Graph-gdal)V-23.4.0-23.26.3","P-619(Oracle Spatial and Graph-gdal)V-19.3-19.32","P-619(Oracle Spatial and Graph-gdal)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-619(Oracle Spatial and Graph-gdal)V-23.4.0-23.26.3","P-619(Oracle Spatial and Graph-gdal)V-19.3-19.32","P-619(Oracle Spatial and Graph-gdal)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-619(Oracle Spatial and Graph-gdal)V-23.4.0-23.26.3","P-619(Oracle Spatial and Graph-gdal)V-19.3-19.32","P-619(Oracle Spatial and Graph-gdal)V-21.3-21.23"]}]},{"cve":"CVE-2025-70873","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-619(Oracle Spatial and Graph-gdal)V-23.4.0-23.26.3","P-619(Oracle Spatial and Graph-gdal)V-19.3-19.32","P-619(Oracle Spatial and Graph-gdal)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"39872089"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle Spatial and Graph (gdal) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-619(Oracle Spatial and Graph-gdal)V-21.3-21.23","P-619(Oracle Spatial and Graph-gdal)V-23.4.0-23.26.3","P-619(Oracle Spatial and Graph-gdal)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-619(Oracle Spatial and Graph-gdal)V-23.4.0-23.26.3","P-619(Oracle Spatial and Graph-gdal)V-19.3-19.32","P-619(Oracle Spatial and Graph-gdal)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-619(Oracle Spatial and Graph-gdal)V-23.4.0-23.26.3","P-619(Oracle Spatial and Graph-gdal)V-19.3-19.32","P-619(Oracle Spatial and Graph-gdal)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-619(Oracle Spatial and Graph-gdal)V-23.4.0-23.26.3","P-619(Oracle Spatial and Graph-gdal)V-19.3-19.32","P-619(Oracle Spatial and Graph-gdal)V-21.3-21.23"]}]},{"cve":"CVE-2025-7962","ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39842247"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars (Jakarta Mail)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0","P-5242V-14.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-14.1.1.0.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-5242V-14.1.1.0.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"]}]},{"cve":"CVE-2025-9086","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2025-9230","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"38906645"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC (OpenSSL)).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-4781V-9.2.0.0-9.2.26.5","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-4629V-9.7.0-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2025-9232","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-0636","ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"40025134"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Bouncy Castle Java Library)).  Supported versions that are affected are 19.1.0.0.0-19.1.0.0.16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle GoldenGate Stream Analytics.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle GoldenGate Stream Analytics accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-19.1.0.0.0-19.1.0.0.16"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-19.1.0.0.0-19.1.0.0.16"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-19.1.0.0.0-19.1.0.0.16"]}]},{"cve":"CVE-2026-10050","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40063481"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Eclipse Jetty)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"products":["P-14597V-7.0.0"]}]},{"cve":"CVE-2026-10051","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40063481"},{"system_name":"Oracle Bug ID of Siebel CRM End User","text":"39657548"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Desktop Integration Siebel Agent (Eclipse Jetty)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM End User accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Eclipse Jetty)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0","P-9011V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9011V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-101359","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226485"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101360","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226501"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101361","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226524"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":4.2,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101362","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226538"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 6.9 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101363","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226546"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Graph QL).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101364","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226548"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Database Actions).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101365","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226550"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Database Actions).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 4.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":4.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101366","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226553"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: ADP).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101367","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226558"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: ADP).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101368","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226560"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101369","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226561"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101370","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226565"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101371","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226570"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101372","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226574"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101373","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226579"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 2.4 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":2.4,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101374","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226585"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service).  Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101375","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226588"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Database Actions).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101376","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226648"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Database Actions).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 4.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":4.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101377","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226650"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Database Actions).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":2.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101378","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226655"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: ADP).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101379","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226659"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: ADP).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101380","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226665"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: ADP).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101381","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226671"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: ADP).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101382","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226674"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":4.2,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101383","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226676"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101384","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226679"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  While the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101385","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226682"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle REST Data Services accessible data. CVSS 3.1 Base Score 4.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101386","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39226689"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":4.2,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.1.0"]}]},{"cve":"CVE-2026-101387","ids":[{"system_name":"Oracle Bug ID of Oracle Capacity","text":"39368724"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Capacity accessible data as well as  unauthorized update, insert or delete access to some of Oracle Capacity accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Capacity. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-533V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-533V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","version":"3.1"},"products":["P-533V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101388","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39286744"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101389","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39286750"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101390","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39286792"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101391","ids":[{"system_name":"Oracle Bug ID of Siebel Apps - Marketing","text":"39288312"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Apps - Marketing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data as well as  unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8974V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8974V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-8974V-17.0-26.9"]}]},{"cve":"CVE-2026-101392","ids":[{"system_name":"Oracle Bug ID of Siebel Apps - Marketing","text":"39288343"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel Apps - Marketing executes to compromise Siebel Apps - Marketing.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8974V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8974V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-8974V-17.0-26.9"]}]},{"cve":"CVE-2026-101393","ids":[{"system_name":"Oracle Bug ID of Siebel Apps - Marketing","text":"39288346"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8974V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8974V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-8974V-17.0-26.9"]}]},{"cve":"CVE-2026-101394","ids":[{"system_name":"Oracle Bug ID of Siebel Apps - Marketing","text":"39288356"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8974V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8974V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-8974V-17.0-26.9"]}]},{"cve":"CVE-2026-101395","ids":[{"system_name":"Oracle Bug ID of Siebel Apps - Marketing","text":"39288362"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Apps - Marketing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data as well as  unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8974V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8974V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-8974V-17.0-26.9"]}]},{"cve":"CVE-2026-101396","ids":[{"system_name":"Oracle Bug ID of Siebel Apps - Marketing","text":"39288383"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Siebel Apps - Marketing executes to compromise Siebel Apps - Marketing.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 4.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8974V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8974V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":4.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-8974V-17.0-26.9"]}]},{"cve":"CVE-2026-101397","ids":[{"system_name":"Oracle Bug ID of Siebel Apps - Marketing","text":"39288396"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel Apps - Marketing.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 2.2 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8974V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8974V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":2.2,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-8974V-17.0-26.9"]}]},{"cve":"CVE-2026-101398","ids":[{"system_name":"Oracle Bug ID of Oracle Capacity","text":"39368726"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Capacity accessible data as well as  unauthorized update, insert or delete access to some of Oracle Capacity accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Capacity. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-533V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-533V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","version":"3.1"},"products":["P-533V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101399","ids":[{"system_name":"Oracle Bug ID of Siebel Apps - Marketing","text":"39288466"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via SMTP to compromise Siebel Apps - Marketing.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Siebel Apps - Marketing. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8974V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8974V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-8974V-17.0-26.9"]}]},{"cve":"CVE-2026-101400","ids":[{"system_name":"Oracle Bug ID of Siebel Apps - Marketing","text":"39288471"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Siebel Apps - Marketing executes to compromise Siebel Apps - Marketing.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Siebel Apps - Marketing. CVSS 3.1 Base Score 2.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8974V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8974V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":2.9,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-8974V-17.0-26.9"]}]},{"cve":"CVE-2026-101401","ids":[{"system_name":"Oracle Bug ID of Siebel Apps - Marketing","text":"39288476"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Siebel Apps - Marketing executes to compromise Siebel Apps - Marketing.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Siebel Apps - Marketing. CVSS 3.1 Base Score 2.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8974V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8974V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":2.9,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-8974V-17.0-26.9"]}]},{"cve":"CVE-2026-101402","ids":[{"system_name":"Oracle Bug ID of Siebel Apps - Marketing","text":"39288482"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Siebel Apps - Marketing. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8974V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8974V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-8974V-17.0-26.9"]}]},{"cve":"CVE-2026-101403","ids":[{"system_name":"Oracle Bug ID of Siebel Apps - Marketing","text":"39288517"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel Apps - Marketing accessible data as well as  unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8974V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8974V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-8974V-17.0-26.9"]}]},{"cve":"CVE-2026-101404","ids":[{"system_name":"Oracle Bug ID of Siebel Apps - Marketing","text":"39288529"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Siebel Apps - Marketing executes to compromise Siebel Apps - Marketing.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data as well as  unauthorized read access to a subset of Siebel Apps - Marketing accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Siebel Apps - Marketing. CVSS 3.1 Base Score 3.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8974V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8974V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":3.9,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-8974V-17.0-26.9"]}]},{"cve":"CVE-2026-101405","ids":[{"system_name":"Oracle Bug ID of Siebel Apps - Marketing","text":"39288532"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel Apps - Marketing.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data as well as  unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8974V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8974V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":4.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-8974V-17.0-26.9"]}]},{"cve":"CVE-2026-101406","ids":[{"system_name":"Oracle Bug ID of Siebel Apps - Marketing","text":"39288535"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8974V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8974V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-8974V-17.0-26.9"]}]},{"cve":"CVE-2026-101407","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39288582"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Change Assistant).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 5.5 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101408","ids":[{"system_name":"Oracle Bug ID of Siebel Apps - Marketing","text":"39288823"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Apps - Marketing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data as well as  unauthorized read access to a subset of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8974V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8974V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-8974V-17.0-26.9"]}]},{"cve":"CVE-2026-101409","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39288867"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101410","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39288880"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101411","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39289703"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101412","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39290097"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Analytic Server).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 5.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":5.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101413","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39290314"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Analytic Server).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101414","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39290317"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Porting).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 2.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":2.9,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101415","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39290607"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Analytic Server).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 3.1 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101416","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39290967"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PsAdmin).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101417","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39291801"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Tuxedo).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101418","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296075"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101419","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296135"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101420","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296143"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":9.6,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101421","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296150"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101422","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296161"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101423","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296192"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101424","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296202"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":5.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101425","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296263"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 2.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":2.5,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101426","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296276"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 6.9 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:H","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101427","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296291"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101428","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296301"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101429","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296302"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":7.0,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101430","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296528"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.2 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.2,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101431","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296543"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101432","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296600"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101433","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296604"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Test Framework).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101434","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296819"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Database Server).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools as well as  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data and  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":7.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101435","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296853"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Porting).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools as well as  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data and  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101436","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39354135"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 4.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":4.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-101437","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39355349"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Cloud Applications accessible data as well as  unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 6.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-101438","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39355504"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications.  While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Cloud Applications accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 8.0 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":8.0,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-101439","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39355565"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via LDAP to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-101440","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39355601"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data as well as  unauthorized update, insert or delete access to some of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-101441","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39356086"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-101442","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39357001"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-101443","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39357047"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-101444","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39357076"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-101445","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39357099"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM Cloud Applications accessible data as well as  unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 3.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":3.6,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-101446","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39357269"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-14107V-17.0-26.9"]}]},{"cve":"CVE-2026-101447","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Development","text":"39413435"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Workflow).  Supported versions that are affected are 25.12-26.9. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Development.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Siebel CRM Development. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9001V-25.12-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9001V-25.12-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-9001V-25.12-26.9"]}]},{"cve":"CVE-2026-101448","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39413472"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Siebel Management Console).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-101449","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39413541"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Siebel Management Console).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows physical access to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 2.4 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":2.4,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-101450","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39424035"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101451","ids":[{"system_name":"Oracle Bug ID of Siebel Life Sciences","text":"39445103"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Life Sciences product of Oracle Siebel CRM (component: Web UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Life Sciences.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Life Sciences, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel Life Sciences accessible data as well as  unauthorized access to critical data or complete access to all Siebel Life Sciences accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12576V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12576V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-12576V-17.0-26.9"]}]},{"cve":"CVE-2026-101452","ids":[{"system_name":"Oracle Bug ID of Oracle Autonomous Health Framework","text":"39455293"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Autonomous Health Framework (component: AHF Instant Diagnostic Replay).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14634V-26.3-26.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14634V-26.3-26.8"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-14634V-26.3-26.8"]}]},{"cve":"CVE-2026-101453","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39471053"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-101454","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Development","text":"39494453"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Configuration Tools).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Development executes to compromise Siebel CRM Development.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Development accessible data as well as  unauthorized read access to a subset of Siebel CRM Development accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9001V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9001V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"products":["P-9001V-17.0-26.9"]}]},{"cve":"CVE-2026-101455","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Development","text":"39494495"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Integration - Scripting).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Development executes to compromise Siebel CRM Development.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Development accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Development accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9001V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9001V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-9001V-17.0-26.9"]}]},{"cve":"CVE-2026-101456","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Development","text":"39494635"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Configuration Tools).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Development executes to compromise Siebel CRM Development.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Development accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Development accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9001V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9001V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-9001V-17.0-26.9"]}]},{"cve":"CVE-2026-101457","ids":[{"system_name":"Oracle Bug ID of Siebel Apps - Life Sciences","text":"39496661"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: eDetailing).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Siebel Apps - Life Sciences.  Successful attacks of this vulnerability can result in takeover of Siebel Apps - Life Sciences. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9173V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9173V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-9173V-17.0-26.9"]}]},{"cve":"CVE-2026-101458","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39496734"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data as well as  unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-101459","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39496747"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":8.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-101460","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39496765"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-101461","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39496805"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-101462","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39496841"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-101463","ids":[{"system_name":"Oracle Bug ID of Siebel CRM End User","text":"39496861"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: UIF Open UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9011V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9011V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-9011V-17.0-26.9"]}]},{"cve":"CVE-2026-101464","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39496889"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-101465","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39496901"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-101466","ids":[{"system_name":"Oracle Bug ID of Oracle EDI Gateway","text":"39382771"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-509V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-509V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-509V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101467","ids":[{"system_name":"Oracle Bug ID of Siebel CRM End User","text":"39496936"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Portal Framework).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM End User accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9011V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9011V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-9011V-17.0-26.9"]}]},{"cve":"CVE-2026-101468","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39499627"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Cloud Gateway).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-101469","ids":[{"system_name":"Oracle Bug ID of Oracle Product Lifecycle Analytics","text":"39529918"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues).   The supported version that is affected is 3.6.1. Difficult to exploit vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Product Lifecycle Analytics.  Successful attacks of this vulnerability can result in takeover of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9387V-3.6.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9387V-3.6.1"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-9387V-3.6.1"]}]},{"cve":"CVE-2026-101470","ids":[{"system_name":"Oracle Bug ID of Oracle Product Lifecycle Analytics","text":"39530016"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues).   The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Product Lifecycle Analytics executes to compromise Oracle Product Lifecycle Analytics.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Product Lifecycle Analytics accessible data as well as  unauthorized access to critical data or complete access to all Oracle Product Lifecycle Analytics accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9387V-3.6.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9387V-3.6.1"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":6.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-9387V-3.6.1"]}]},{"cve":"CVE-2026-101471","ids":[{"system_name":"Oracle Bug ID of Oracle Product Lifecycle Analytics","text":"39530027"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues).   The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Product Lifecycle Analytics executes to compromise Oracle Product Lifecycle Analytics.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Product Lifecycle Analytics accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Product Lifecycle Analytics. CVSS 3.1 Base Score 6.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9387V-3.6.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9387V-3.6.1"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"products":["P-9387V-3.6.1"]}]},{"cve":"CVE-2026-101472","ids":[{"system_name":"Oracle Bug ID of Oracle Product Lifecycle Analytics","text":"39530031"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues).   The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Product Lifecycle Analytics executes to compromise Oracle Product Lifecycle Analytics.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Product Lifecycle Analytics accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9387V-3.6.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9387V-3.6.1"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-9387V-3.6.1"]}]},{"cve":"CVE-2026-101473","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Product Lifecycle Management for Process","text":"39530659"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4445V-6.2.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4445V-6.2.4"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4445V-6.2.4"]}]},{"cve":"CVE-2026-101474","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Product Lifecycle Management for Process","text":"39530664"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4445V-6.2.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4445V-6.2.4"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"products":["P-4445V-6.2.4"]}]},{"cve":"CVE-2026-101475","ids":[{"system_name":"Oracle Bug ID of Primavera Unifier","text":"40061847"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Logging).  Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Primavera Unifier accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"]}]},{"cve":"CVE-2026-101476","ids":[{"system_name":"Oracle Bug ID of Siebel Apps - Marketing","text":"39560954"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel Apps - Marketing accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8974V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8974V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-8974V-17.0-26.9"]}]},{"cve":"CVE-2026-101477","ids":[{"system_name":"Oracle Bug ID of Oracle Autonomous Health Framework","text":"39570336"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14634V-26.3-26.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14634V-26.3-26.8"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-14634V-26.3-26.8"]}]},{"cve":"CVE-2026-101478","ids":[{"system_name":"Oracle Bug ID of Oracle Autonomous Health Framework","text":"39570337"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in takeover of Oracle Autonomous Health Framework. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14634V-26.3-26.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14634V-26.3-26.8"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-14634V-26.3-26.8"]}]},{"cve":"CVE-2026-101479","ids":[{"system_name":"Oracle Bug ID of Oracle Secure Backup","text":"39570847"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Secure Backup (component: Backup and Restore).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup.  While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Secure Backup. CVSS 3.1 Base Score 8.6 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":8.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"products":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}]},{"cve":"CVE-2026-101480","ids":[{"system_name":"Oracle Bug ID of Oracle Secure Backup","text":"39570884"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Secure Backup (component: NDMP daemon).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Secure Backup accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}]},{"cve":"CVE-2026-101481","ids":[{"system_name":"Oracle Bug ID of Oracle Secure Backup","text":"39570891"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Secure Backup (component: Device Management and Support).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup.  While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}]},{"cve":"CVE-2026-101482","ids":[{"system_name":"Oracle Bug ID of Oracle Secure Backup","text":"39570895"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Secure Backup (component: Device Management and Support).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup.  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}]},{"cve":"CVE-2026-101483","ids":[{"system_name":"Oracle Bug ID of Oracle Secure Backup","text":"39570897"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Secure Backup (component: Device Management and Support).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Secure Backup executes to compromise Oracle Secure Backup.  While the vulnerability is in Oracle Secure Backup, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Secure Backup. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"products":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}]},{"cve":"CVE-2026-101484","ids":[{"system_name":"Oracle Bug ID of Oracle Secure Backup","text":"39570901"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Secure Backup (component: Backup and Restore).  Supported versions that are affected are 19.1.0.0.0 and   19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup.  Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}]},{"cve":"CVE-2026-101485","ids":[{"system_name":"Oracle Bug ID of Oracle Autonomous Health Framework","text":"39574519"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise Oracle Autonomous Health Framework.  While the vulnerability is in Oracle Autonomous Health Framework, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Autonomous Health Framework accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14634V-26.3-26.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14634V-26.3-26.8"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-14634V-26.3-26.8"]}]},{"cve":"CVE-2026-101486","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39672860"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101487","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39673197"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101488","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39675626"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101489","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39675667"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"acknowledgments":[{"names":["Lukasz Plonka"]}],"cve":"CVE-2026-101490","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39711646"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101491","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39720076"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":5.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-101492","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Integration","text":"39723987"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).  Supported versions that are affected are 25.12-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM Integration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM Integration accessible data as well as  unauthorized read access to a subset of Siebel CRM Integration accessible data. CVSS 3.1 Base Score 4.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9008V-25.12-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9008V-25.12-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":4.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-9008V-25.12-26.9"]}]},{"cve":"CVE-2026-101493","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39736240"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as  unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.2.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.2.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.2.1"]}]},{"cve":"CVE-2026-101494","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39736749"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Core).  Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  While the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle REST Data Services accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.2.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.2.2"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.2.2"]}]},{"cve":"CVE-2026-101495","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Development","text":"39738886"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval Manager).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Siebel CRM Development. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9001V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9001V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-9001V-17.0-26.9"]}]},{"cve":"CVE-2026-101497","ids":[{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39807279"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Connector Framework).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Identity Manager. CVSS 3.1 Base Score 4.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1980V-12.2.1.4.0","P-1980V-14.1.2.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1980V-14.1.2.1.0","P-1980V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-1980V-14.1.2.1.0","P-1980V-12.2.1.4.0"]}]},{"cve":"CVE-2026-101498","ids":[{"system_name":"Oracle Bug ID of Oracle Trusted Answer Search","text":"39833260"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).   The supported version that is affected is 26.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Trusted Answer Search.  Successful attacks of this vulnerability can result in takeover of Oracle Trusted Answer Search. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-15098V-26.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-15098V-26.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-15098V-26.1"]}]},{"acknowledgments":[{"names":["Co-tang X"]}],"cve":"CVE-2026-101499","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Sites","text":"39838518"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites.  Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9617V-12.2.1.4.0","P-9617V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9617V-12.2.1.4.0","P-9617V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-9617V-12.2.1.4.0","P-9617V-14.1.2.0.0"]}]},{"acknowledgments":[{"names":["Vulcanix"]}],"cve":"CVE-2026-101500","ids":[{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management OPatchAuto","text":"39845110"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management OPatchAuto product of Oracle Global Lifecycle Management (component: Database extensions).  Supported versions that are affected are 12.2.0.1.16-12.2.0.1.52. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Global Lifecycle Management OPatchAuto executes to compromise Oracle Global Lifecycle Management OPatchAuto.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Global Lifecycle Management OPatchAuto. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12752V-12.2.0.1.16-12.2.0.1.52"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12752V-12.2.0.1.16-12.2.0.1.52"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-12752V-12.2.0.1.16-12.2.0.1.52"]}]},{"cve":"CVE-2026-101501","ids":[{"system_name":"Oracle Bug ID of Oracle Trusted Answer Search","text":"39853370"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via Oracle Net to compromise Oracle Trusted Answer Search.  While the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Trusted Answer Search accessible data as well as  unauthorized read access to a subset of Oracle Trusted Answer Search accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Trusted Answer Search. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-15098V-26.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-15098V-26.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H","version":"3.1"},"products":["P-15098V-26.1"]}]},{"cve":"CVE-2026-101502","ids":[{"system_name":"Oracle Bug ID of Oracle Trusted Answer Search","text":"39853372"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).   The supported version that is affected is 26.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Trusted Answer Search executes to compromise Oracle Trusted Answer Search.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Trusted Answer Search accessible data as well as  unauthorized read access to a subset of Oracle Trusted Answer Search accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Trusted Answer Search. CVSS 3.1 Base Score 5.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-15098V-26.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-15098V-26.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"products":["P-15098V-26.1"]}]},{"cve":"CVE-2026-101503","ids":[{"system_name":"Oracle Bug ID of Oracle Trusted Answer Search","text":"39853375"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via Oracle Net to compromise Oracle Trusted Answer Search.  While the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Trusted Answer Search. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-15098V-26.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-15098V-26.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-15098V-26.1"]}]},{"cve":"CVE-2026-101504","ids":[{"system_name":"Oracle Bug ID of Oracle Trusted Answer Search","text":"39853379"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data as well as  unauthorized update, insert or delete access to some of Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-15098V-26.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-15098V-26.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":7.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","version":"3.1"},"products":["P-15098V-26.1"]}]},{"cve":"CVE-2026-101505","ids":[{"system_name":"Oracle Bug ID of Oracle Trusted Answer Search","text":"39853391"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Trusted Answer Search accessible data as well as  unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-15098V-26.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-15098V-26.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-15098V-26.1"]}]},{"cve":"CVE-2026-101506","ids":[{"system_name":"Oracle Bug ID of Oracle Trusted Answer Search","text":"39853392"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Trusted Answer Search (component: Application expert UI).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search.  While the vulnerability is in Oracle Trusted Answer Search, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-15098V-26.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-15098V-26.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-15098V-26.1"]}]},{"cve":"CVE-2026-101507","ids":[{"system_name":"Oracle Bug ID of Oracle Trusted Answer Search","text":"39853394"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Trusted Answer Search (component: PLSQL package).   The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Trusted Answer Search accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-15098V-26.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-15098V-26.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-15098V-26.1"]}]},{"cve":"CVE-2026-101508","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Integration","text":"39861607"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Integration. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9008V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9008V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-9008V-17.0-26.9"]}]},{"acknowledgments":[{"names":["Xiang Chen"]}],"cve":"CVE-2026-101510","ids":[{"system_name":"Oracle Bug ID of Oracle Net Services","text":"39917210"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Net Services component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32, 21.3-21.23 and  23.4.0-23.26.3. Easily exploitable vulnerability allows high privileged attacker having None privilege with logon to the infrastructure where Oracle Net Services executes to compromise Oracle Net Services.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Net Services. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-115V-19.3-19.32","P-115V-21.3-21.23","P-115V-23.4.0-23.26.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-115V-19.3-19.32","P-115V-21.3-21.23","P-115V-23.4.0-23.26.3"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":4.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-115V-19.3-19.32","P-115V-21.3-21.23","P-115V-23.4.0-23.26.3"]}]},{"cve":"CVE-2026-101511","ids":[{"system_name":"Oracle Bug ID of Oracle Enterprise Manager Base Platform","text":"39336391"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1370V-13.5","P-1370V-24.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1370V-24.1","P-1370V-13.5"],"url":"https://support.oracle.com/support/?documentId=CPU391"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-1370V-24.1","P-1370V-13.5"]}]},{"acknowledgments":[{"names":["Amitay Shahar"]}],"cve":"CVE-2026-101512","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"39243425"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS component of Oracle Database Server.  Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having None privilege with network access via HTTP to compromise RDBMS.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all RDBMS accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS)V-23.4.0-23.26.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS)V-23.4.0-23.26.3"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS)V-23.4.0-23.26.3"]}]},{"cve":"CVE-2026-101513","ids":[{"system_name":"Oracle Bug ID of MySQL Cluster","text":"32293182"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.37. Difficult to exploit vulnerability allows physical access to compromise MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster. CVSS 3.1 Base Score 3.8 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.0.0-8.0.37"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.0.0-8.0.37"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":3.8,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:P/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.0.0-8.0.37"]}]},{"cve":"CVE-2026-101515","ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39863250"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5242V-15.1.1.0.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0","P-5242V-14.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-5242V-14.1.1.0.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-5242V-15.1.1.0.0","P-5242V-14.1.1.0.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"]}]},{"cve":"CVE-2026-101516","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39234536"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-101517","ids":[{"system_name":"Oracle Bug ID of Oracle Utilities Network Management System","text":"39739538"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: System Wide).  Supported versions that are affected are 2.4.0.1.0-2.4.0.1.33, 2.5.0.1.0-2.5.0.1.18, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.9 and  25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Utilities Network Management System executes to compromise Oracle Utilities Network Management System.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-2241V-2.4.0.1.0-2.4.0.1.33","P-2241V-2.5.0.1.0-2.5.0.1.18","P-2241V-2.6.0.1.0-2.6.0.1.12","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-2241V-2.4.0.1.0-2.4.0.1.33","P-2241V-2.5.0.1.0-2.5.0.1.18","P-2241V-2.6.0.1.0-2.6.0.1.12","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"],"url":"https://support.oracle.com/support/?documentId=CPU370"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-2241V-2.4.0.1.0-2.4.0.1.33","P-2241V-2.5.0.1.0-2.5.0.1.18","P-2241V-2.6.0.1.0-2.6.0.1.12","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"]}]},{"cve":"CVE-2026-101518","ids":[{"system_name":"Oracle Bug ID of Oracle Enterprise Manager Base Platform","text":"39336407"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1370V-13.5","P-1370V-24.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1370V-24.1","P-1370V-13.5"],"url":"https://support.oracle.com/support/?documentId=CPU391"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1370V-24.1","P-1370V-13.5"]}]},{"cve":"CVE-2026-101519","ids":[{"system_name":"Oracle Bug ID of Oracle EDI Gateway","text":"39382775"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-509V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-509V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-509V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101520","ids":[{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"40002974"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Global Lifecycle Management NextGen OUI Framework. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-14.1.2.0.0","P-12738V-15.1.1.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-12738V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"]}]},{"cve":"CVE-2026-101521","ids":[{"system_name":"Oracle Bug ID of Oracle APEX","text":"40015638"}],"notes":[{"category":"description","text":"Vulnerability in Oracle APEX (component: General).  Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and  26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX.  Successful attacks of this vulnerability can result in takeover of Oracle APEX. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1348V-24.2.0-24.2.20","P-1348V-24.1.0-24.1.21","P-1348V-26.1.0-26.1.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1348V-24.2.0-24.2.20","P-1348V-24.1.0-24.1.21","P-1348V-26.1.0-26.1.4"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1348V-24.2.0-24.2.20","P-1348V-24.1.0-24.1.21","P-1348V-26.1.0-26.1.4"]}]},{"cve":"CVE-2026-101522","ids":[{"system_name":"Oracle Bug ID of Oracle TimesTen In-Memory Database","text":"40035088"}],"notes":[{"category":"description","text":"Vulnerability in Oracle TimesTen In-Memory Database (component: TimesTen IMDB).  Supported versions that are affected are 22.1-22.1.1.43.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle TimesTen In-Memory Database executes to compromise Oracle TimesTen In-Memory Database.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle TimesTen In-Memory Database accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1870V-22.1-22.1.1.43.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1870V-22.1-22.1.1.43.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-1870V-22.1-22.1.1.43.0"]}]},{"cve":"CVE-2026-101524","ids":[{"system_name":"Oracle Bug ID of Oracle Enterprise Manager Base Platform","text":"39343374"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Security Framework).  Supported versions that are affected are 13.5 and  24.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Enterprise Manager Base Platform accessible data as well as  unauthorized read access to a subset of Oracle Enterprise Manager Base Platform accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 5.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1370V-13.5","P-1370V-24.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1370V-24.1","P-1370V-13.5"],"url":"https://support.oracle.com/support/?documentId=CPU391"}],"scores":[{"cvss_v3":{"baseScore":5.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-1370V-24.1","P-1370V-13.5"]}]},{"cve":"CVE-2026-101525","ids":[{"system_name":"Oracle Bug ID of Oracle Enterprise Manager for Siebel","text":"39639521"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Manager (component: Configuration Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Siebel.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Siebel. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2158V-24.1","P-2158V-13.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2158V-13.5","P-2158V-24.1"],"url":"https://support.oracle.com/support/?documentId=CPU391"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2158V-13.5","P-2158V-24.1"]}]},{"cve":"CVE-2026-101526","ids":[{"system_name":"Oracle Bug ID of Oracle Enterprise Manager for Siebel","text":"39639524"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Enterprise Manager for Siebel product of Oracle Enterprise Manager (component: Configuration Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Siebel.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Siebel. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2158V-24.1","P-2158V-13.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2158V-13.5","P-2158V-24.1"],"url":"https://support.oracle.com/support/?documentId=CPU391"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2158V-13.5","P-2158V-24.1"]}]},{"cve":"CVE-2026-101527","ids":[{"system_name":"Oracle Bug ID of Oracle Enterprise Manager Base Platform","text":"39839687"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Enterprise Manager Install).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1370V-13.5","P-1370V-24.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1370V-24.1","P-1370V-13.5"],"url":"https://support.oracle.com/support/?documentId=CPU391"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1370V-24.1","P-1370V-13.5"]}]},{"cve":"CVE-2026-101528","ids":[{"system_name":"Oracle Bug ID of Oracle Enterprise Manager for Oracle Database","text":"39937953"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Oracle Database.  While the vulnerability is in Oracle Enterprise Manager for Oracle Database, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Oracle Database. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1366V-24.1","P-1366V-13.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1366V-24.1","P-1366V-13.5"],"url":"https://support.oracle.com/support/?documentId=CPU391"}],"scores":[{"cvss_v3":{"baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-1366V-24.1","P-1366V-13.5"]}]},{"cve":"CVE-2026-101529","ids":[{"system_name":"Oracle Bug ID of Oracle Enterprise Manager for Oracle Database","text":"39937975"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Data Guard Management).  Supported versions that are affected are 13.5 and  24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager for Oracle Database.  While the vulnerability is in Oracle Enterprise Manager for Oracle Database, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager for Oracle Database. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1366V-24.1","P-1366V-13.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1366V-24.1","P-1366V-13.5"],"url":"https://support.oracle.com/support/?documentId=CPU391"}],"scores":[{"cvss_v3":{"baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-1366V-24.1","P-1366V-13.5"]}]},{"cve":"CVE-2026-101531","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39436464"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"]}]},{"cve":"CVE-2026-101532","ids":[{"system_name":"Oracle Bug ID of Oracle EDI Gateway","text":"39382789"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-509V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-509V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-509V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101533","ids":[{"system_name":"Oracle Bug ID of Oracle EDI Gateway","text":"39382799"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: All Miscellaneous EDI Issues).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle EDI Gateway. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-509V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-509V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-509V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101534","ids":[{"system_name":"Oracle Bug ID of Oracle EDI Gateway","text":"39382832"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite (component: EDI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle EDI Gateway.  While the vulnerability is in Oracle EDI Gateway, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle EDI Gateway accessible data as well as  unauthorized update, insert or delete access to some of Oracle EDI Gateway accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-509V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-509V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"products":["P-509V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101535","ids":[{"system_name":"Oracle Bug ID of Oracle Sales Foundation","text":"39384424"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite (component: Security API).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Foundation.  Successful attacks of this vulnerability can result in takeover of Oracle Sales Foundation. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-576V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-576V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-576V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101536","ids":[{"system_name":"Oracle Bug ID of Oracle Cost Management","text":"39384718"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Maintenance).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management.  Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-569V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-569V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-569V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101537","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39387103"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-101538","ids":[{"system_name":"Oracle Bug ID of Oracle Order Management","text":"39391000"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Order Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-497V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-497V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-497V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101539","ids":[{"system_name":"Oracle Bug ID of Oracle Payroll","text":"39392310"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Payroll accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-506V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-506V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-506V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101540","ids":[{"system_name":"Oracle Bug ID of Oracle Capacity","text":"39393968"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  While the vulnerability is in Oracle Capacity, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Capacity accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-533V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-533V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-533V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101541","ids":[{"system_name":"Oracle Bug ID of Oracle Capacity","text":"39393988"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  While the vulnerability is in Oracle Capacity, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Capacity accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-533V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-533V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-533V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101542","ids":[{"system_name":"Oracle Bug ID of Oracle Capacity","text":"39394100"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in takeover of Oracle Capacity. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-533V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-533V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-533V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101543","ids":[{"system_name":"Oracle Bug ID of Oracle Capacity","text":"39394117"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity.  Successful attacks of this vulnerability can result in takeover of Oracle Capacity. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-533V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-533V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-533V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101544","ids":[{"system_name":"Oracle Bug ID of Oracle Payroll","text":"39394804"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Payroll executes to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-506V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-506V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.0,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-506V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101545","ids":[{"system_name":"Oracle Bug ID of Oracle Inventory Management","text":"39397743"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Inventory Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Inventory Management executes to compromise Oracle Inventory Management.  Successful attacks of this vulnerability can result in takeover of Oracle Inventory Management. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-508V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-508V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.0,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-508V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101546","ids":[{"system_name":"Oracle Bug ID of Oracle Materials Requirement Planning","text":"39398678"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Materials Requirement Planning product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Materials Requirement Planning.  Successful attacks of this vulnerability can result in takeover of Oracle Materials Requirement Planning. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-574V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-574V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-574V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101547","ids":[{"system_name":"Oracle Bug ID of Oracle Demand Planning","text":"39398816"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations).  Supported versions that are affected are 12.1 and  12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Demand Planning.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Demand Planning, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Demand Planning accessible data as well as  unauthorized read access to a subset of Oracle Demand Planning accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-723V-12.2","P-723V-12.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-723V-12.2","P-723V-12.1"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-723V-12.2","P-723V-12.1"]}]},{"cve":"CVE-2026-101548","ids":[{"system_name":"Oracle Bug ID of Oracle Application Testing Suite","text":"39443894"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Application Testing Suite (component: OpenScript).   The supported version that is affected is 13.3.0.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Testing Suite executes to compromise Oracle Application Testing Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4622V-13.3.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4622V-13.3.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU367"}],"scores":[{"cvss_v3":{"baseScore":7.0,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4622V-13.3.0.1"]}]},{"cve":"CVE-2026-101549","ids":[{"system_name":"Oracle Bug ID of Oracle Application Testing Suite","text":"39443899"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Application Testing Suite (component: OpenScript).   The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Testing Suite executes to compromise Oracle Application Testing Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Application Testing Suite. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4622V-13.3.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4622V-13.3.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU367"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4622V-13.3.0.1"]}]},{"cve":"CVE-2026-101551","ids":[{"system_name":"Oracle Bug ID of Oracle Applications Manager","text":"39493785"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-99V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-99V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-99V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101552","ids":[{"system_name":"Oracle Bug ID of Oracle Application Object Library","text":"39494637"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Flexfields).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-510V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-510V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-510V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101553","ids":[{"system_name":"Oracle Bug ID of Oracle Payroll","text":"39495190"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Element Types, Links, Entries).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Payroll accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-506V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-506V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-506V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101554","ids":[{"system_name":"Oracle Bug ID of Oracle Payroll","text":"39495243"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-506V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-506V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-506V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101555","ids":[{"system_name":"Oracle Bug ID of Oracle Payroll","text":"39495335"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-506V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-506V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-506V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101556","ids":[{"system_name":"Oracle Bug ID of Oracle Payroll","text":"39495917"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-506V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-506V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-506V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101557","ids":[{"system_name":"Oracle Bug ID of Oracle Purchasing","text":"39496373"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing.  Successful attacks of this vulnerability can result in takeover of Oracle Purchasing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-502V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-502V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-502V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101558","ids":[{"system_name":"Oracle Bug ID of Oracle Purchasing","text":"39496597"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Approvals).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Purchasing.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Purchasing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Purchasing accessible data as well as  unauthorized read access to a subset of Oracle Purchasing accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-502V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-502V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-502V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101559","ids":[{"system_name":"Oracle Bug ID of Oracle Purchasing","text":"39496796"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: PO View Document).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-502V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-502V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-502V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101560","ids":[{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39504037"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Commerce Server).   The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Platform.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Platform accessible data as well as  unauthorized read access to a subset of Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9348V-11.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"products":["P-9348V-11.4.0"]}]},{"cve":"CVE-2026-101561","ids":[{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"39529354"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-4461V-2.6"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4461V-2.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-4461V-2.6"]}]},{"cve":"CVE-2026-101562","ids":[{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"39529381"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect).   The supported version that is affected is 2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4461V-2.6"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4461V-2.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4461V-2.6"]}]},{"cve":"CVE-2026-101564","ids":[{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"39529487"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Acollect).   The supported version that is affected is 2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4461V-2.6"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4461V-2.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4461V-2.6"]}]},{"cve":"CVE-2026-101565","ids":[{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"39529512"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Import).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Agile PLM executes to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 6.2 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4461V-9.3.6"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4461V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":6.2,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4461V-9.3.6"]}]},{"cve":"CVE-2026-101566","ids":[{"system_name":"Oracle Bug ID of Oracle Application Object Library","text":"39588073"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-510V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-510V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-510V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101567","ids":[{"system_name":"Oracle Bug ID of Oracle Cost Management","text":"39714206"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Cost Management.  Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-569V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-569V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-569V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101568","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39727369"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-health).  Supported versions that are affected are 3.0.0-3.2.21, 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-4.0.0-4.5.5","P-13972V-3.0.0-3.2.21","P-13972V-27.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-4.0.0-4.5.5","P-13972V-3.0.0-3.2.21","P-13972V-27.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-13972V-4.0.0-4.5.5","P-13972V-3.0.0-3.2.21","P-13972V-27.0.0"]}]},{"cve":"CVE-2026-101569","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39727375"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-common-concurrency-limits).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"products":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"]}]},{"cve":"CVE-2026-101570","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39727383"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-http2).  Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-4.0.0-4.5.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-4.0.0-4.5.5"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-13972V-4.0.0-4.5.5"]}]},{"cve":"CVE-2026-101571","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39727397"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-security-providers-idcs-mapper).  Supported versions that are affected are 3.0.0-3.2.21 and 4.0.0-4.5.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Helidon executes to compromise Helidon.  While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 5.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-4.0.0-4.5.5","P-13972V-3.0.0-3.2.21"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-4.0.0-4.5.5","P-13972V-3.0.0-3.2.21"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":5.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-13972V-4.0.0-4.5.5","P-13972V-3.0.0-3.2.21"]}]},{"cve":"CVE-2026-101572","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39727400"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http2).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Helidon. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"]}]},{"cve":"CVE-2026-101573","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39727407"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-security-providers-http-auth).  Supported versions that are affected are 3.0.0-3.2.21, 4.0.0-4.5.5 and 27.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-4.0.0-4.5.5","P-13972V-3.0.0-3.2.21","P-13972V-27.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-4.0.0-4.5.5","P-13972V-3.0.0-3.2.21","P-13972V-27.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-13972V-4.0.0-4.5.5","P-13972V-3.0.0-3.2.21","P-13972V-27.0.0"]}]},{"cve":"CVE-2026-101574","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39727410"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: OIDC).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Helidon accessible data as well as  unauthorized update, insert or delete access to some of Helidon accessible data. CVSS 3.1 Base Score 6.9 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N","version":"3.1"},"products":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"]}]},{"cve":"CVE-2026-101575","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39727411"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: LRA).  Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Helidon accessible data as well as  unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-4.0.0-4.5.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-4.0.0-4.5.5"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L","version":"3.1"},"products":["P-13972V-4.0.0-4.5.5"]}]},{"cve":"CVE-2026-101576","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39727413"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: LRA).  Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-4.0.0-4.5.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-4.0.0-4.5.5"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-13972V-4.0.0-4.5.5"]}]},{"cve":"CVE-2026-101577","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39727427"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-cors).  Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Helidon accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-4.0.0-4.5.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-4.0.0-4.5.5"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-13972V-4.0.0-4.5.5"]}]},{"cve":"CVE-2026-101578","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39727430"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-security-providers-google-login).  Supported versions that are affected are 4.0.0-4.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-4.0.0-4.5.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-4.0.0-4.5.5"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-13972V-4.0.0-4.5.5"]}]},{"cve":"CVE-2026-101579","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39727438"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-grpc-server).  Supported versions that are affected are 3.0.0-3.2.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon.  While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Helidon accessible data as well as  unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-3.0.0-3.2.21"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-3.0.0-3.2.21"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-13972V-3.0.0-3.2.21"]}]},{"cve":"CVE-2026-101580","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39727445"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-security-providers-jwt).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":5.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"products":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"]}]},{"cve":"CVE-2026-101581","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39727449"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-dns-resolver-round-robin).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"products":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"]}]},{"cve":"CVE-2026-101582","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39727451"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-integrations-vault).  Supported versions that are affected are 4.0.0-4.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-4.0.0-4.5.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-4.0.0-4.5.5"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":5.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"products":["P-13972V-4.0.0-4.5.5"]}]},{"cve":"CVE-2026-101583","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39727452"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-common-mapper).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as  unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":7.0,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"products":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"]}]},{"cve":"CVE-2026-101584","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39727454"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-websocket).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"products":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"]}]},{"cve":"CVE-2026-101585","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39727455"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-cors).  Supported versions that are affected are 3.0.0-3.2.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Helidon accessible data as well as  unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-3.0.0-3.2.21"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-3.0.0-3.2.21"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-13972V-3.0.0-3.2.21"]}]},{"cve":"CVE-2026-101586","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39727456"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"]}]},{"cve":"CVE-2026-101587","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39727458"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http1).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"]}]},{"cve":"CVE-2026-101588","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39727480"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: WebSocket).  Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-13972V-4.0.0-4.5.5","P-13972V-27.0.0"]}]},{"cve":"CVE-2026-101589","ids":[{"system_name":"Oracle Bug ID of Oracle Utilities Network Management System","text":"39739569"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: System Wide).  Supported versions that are affected are 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.10 and  25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Utilities Network Management System.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-2241V-2.6.0.1.0-2.6.0.1.12","P-2241V-2.6.0.2.0-2.6.0.2.10"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-2241V-2.6.0.1.0-2.6.0.1.12","P-2241V-2.6.0.2.0-2.6.0.2.10"],"url":"https://support.oracle.com/support/?documentId=CPU370"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-2241V-2.6.0.1.0-2.6.0.1.12","P-2241V-2.6.0.2.0-2.6.0.2.10"]}]},{"cve":"CVE-2026-101590","ids":[{"system_name":"Oracle Bug ID of Helidon","text":"39748580"}],"notes":[{"category":"description","text":"Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security).  Supported versions that are affected are 4.0.0-4.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as  unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13972V-4.0.0-4.5.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13972V-4.0.0-4.5.5"],"url":"https://support.oracle.com/support/?documentId=CPU375"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-13972V-4.0.0-4.5.5"]}]},{"acknowledgments":[{"names":["Minh Nguyen"]}],"cve":"CVE-2026-101591","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Product Lifecycle Management for Process","text":"39807967"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4445V-6.2.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4445V-6.2.4"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-4445V-6.2.4"]}]},{"acknowledgments":[{"names":["Minh Nguyen"]}],"cve":"CVE-2026-101592","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Product Lifecycle Management for Process","text":"39808015"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile Product Lifecycle Management for Process, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized read access to a subset of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4445V-6.2.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4445V-6.2.4"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-4445V-6.2.4"]}]},{"acknowledgments":[{"names":["Dat Hoang Thanh"]}],"cve":"CVE-2026-101593","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Product Lifecycle Management for Process","text":"39827931"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4445V-6.2.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4445V-6.2.4"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":8.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"products":["P-4445V-6.2.4"]}]},{"acknowledgments":[{"names":["Minh Nguyen"]}],"cve":"CVE-2026-101594","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Product Lifecycle Management for Process","text":"39860545"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4445V-6.2.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4445V-6.2.4"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4445V-6.2.4"]}]},{"acknowledgments":[{"names":["Dat Hoang Thanh"]}],"cve":"CVE-2026-101595","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Product Lifecycle Management for Process","text":"39870865"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Supply Chain Relationship Mgmt).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile Product Lifecycle Management for Process, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized read access to a subset of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4445V-6.2.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4445V-6.2.4"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-4445V-6.2.4"]}]},{"acknowledgments":[{"names":["Le Viet Hoang"]}],"cve":"CVE-2026-101596","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Product Lifecycle Management for Process","text":"39871077"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4445V-6.2.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4445V-6.2.4"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4445V-6.2.4"]}]},{"cve":"CVE-2026-101597","ids":[{"system_name":"Oracle Bug ID of Oracle ZFS Storage Appliance Kit","text":"39904951"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core).   The supported version that is affected is 8.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle ZFS Storage Appliance Kit accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10026V-8.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10026V-8.8"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-10026V-8.8"]}]},{"acknowledgments":[{"names":["Equixly"]},{"names":["Equixly"]}],"cve":"CVE-2026-101598","ids":[{"system_name":"Oracle Bug ID of Oracle VM VirtualBox","text":"40028871"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.20. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8370V-7.2.20"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8370V-7.2.20"],"url":"https://support.oracle.com/support/?documentId=CPU414"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-8370V-7.2.20"]}]},{"acknowledgments":[{"names":["Ziad Salah"]}],"cve":"CVE-2026-101599","ids":[{"system_name":"Oracle Bug ID of Oracle VM VirtualBox","text":"40028910"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.20. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8370V-7.2.20"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8370V-7.2.20"],"url":"https://support.oracle.com/support/?documentId=CPU414"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-8370V-7.2.20"]}]},{"cve":"CVE-2026-101600","ids":[{"system_name":"Oracle Bug ID of Oracle TimesTen In-Memory Database","text":"40035089"}],"notes":[{"category":"description","text":"Vulnerability in Oracle TimesTen In-Memory Database (component: TimesTen IMDB).  Supported versions that are affected are 26.1-26.1.1.3.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle TimesTen In-Memory Database executes to compromise Oracle TimesTen In-Memory Database.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle TimesTen In-Memory Database accessible data as well as  unauthorized read access to a subset of Oracle TimesTen In-Memory Database accessible data. CVSS 3.1 Base Score 3.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1870V-26.1-26.1.1.3.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1870V-26.1-26.1.1.3.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":3.6,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-1870V-26.1-26.1.1.3.0"]}]},{"cve":"CVE-2026-101601","ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate","text":"40056123"}],"notes":[{"category":"description","text":"Vulnerability in Oracle GoldenGate (component: Vendor Access Module).  Supported versions that are affected are 21.3-21.23. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5757V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5757V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-5757V-21.3-21.23"]}]},{"acknowledgments":[{"names":["Quang Vũ from Viettel Cyber Security"]}],"cve":"CVE-2026-101602","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Product Lifecycle Management for Process","text":"40061899"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4445V-6.2.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4445V-6.2.4"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":8.0,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4445V-6.2.4"]}]},{"cve":"CVE-2026-101603","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Inventory Management","text":"40089013"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security).  Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Inventory Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4516V-7.7.0","P-4516V-7.8.0","P-4516V-8.0.1","P-4516V-7.5.0","P-4516V-7.5.1","P-4516V-7.6.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4516V-7.7.0","P-4516V-7.8.0","P-4516V-8.0.1","P-4516V-7.5.0","P-4516V-7.5.1","P-4516V-7.6.0"],"url":"https://support.oracle.com/support/?documentId=CPU365"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4516V-7.7.0","P-4516V-7.8.0","P-4516V-8.0.1","P-4516V-7.5.0","P-4516V-7.5.1","P-4516V-7.6.0"]}]},{"cve":"CVE-2026-101604","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Inventory Management","text":"40089043"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security).  Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Inventory Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4516V-7.7.0","P-4516V-7.8.0","P-4516V-8.0.1","P-4516V-7.5.0","P-4516V-7.5.1","P-4516V-7.6.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4516V-7.7.0","P-4516V-7.8.0","P-4516V-8.0.1","P-4516V-7.5.0","P-4516V-7.5.1","P-4516V-7.6.0"],"url":"https://support.oracle.com/support/?documentId=CPU365"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4516V-7.7.0","P-4516V-7.8.0","P-4516V-8.0.1","P-4516V-7.5.0","P-4516V-7.5.1","P-4516V-7.6.0"]}]},{"cve":"CVE-2026-101605","ids":[{"system_name":"Oracle Bug ID of Oracle Utilities Network Management System","text":"39739577"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: System Wide).  Supported versions that are affected are 2.4.0.1.0-2.4.0.1.33, 2.5.0.1.0-2.5.0.1.18, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.10 and  25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Utilities Network Management System.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-2241V-2.4.0.1.0-2.4.0.1.33","P-2241V-2.5.0.1.0-2.5.0.1.18","P-2241V-2.6.0.1.0-2.6.0.1.12","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.10"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-2241V-2.4.0.1.0-2.4.0.1.33","P-2241V-2.5.0.1.0-2.5.0.1.18","P-2241V-2.6.0.1.0-2.6.0.1.12","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.10"],"url":"https://support.oracle.com/support/?documentId=CPU370"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-2241V-2.4.0.1.0-2.4.0.1.33","P-2241V-2.5.0.1.0-2.5.0.1.18","P-2241V-2.6.0.1.0-2.6.0.1.12","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.10"]}]},{"cve":"CVE-2026-101606","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39698565"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications Billing and Revenue Management accessible data as well as  unauthorized read access to a subset of Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]}]},{"cve":"CVE-2026-101607","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"35763384"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101608","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"35902455"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101609","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"36672483"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101610","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"36678321"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101611","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"36999166"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101612","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"37380231"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.0 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101613","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"38305379"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101614","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"38547442"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101615","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"38810796"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101616","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"38973857"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101617","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39091341"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101618","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39123849"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101619","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39134921"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Haogang Mao"],"organization":"SKLCCSE Lab at Beihang University"}],"cve":"CVE-2026-101620","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39136916"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 9.7.0-9.7.3; MySQL Cluster: 9.7.0-9.7.3. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-9.7.0-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-9.7.0-9.7.3"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-9.7.0-9.7.3"]}]},{"cve":"CVE-2026-101621","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39147834"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101622","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39147848"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101623","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39197517"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Anas Cherni"],"organization":"Calif.io"}],"cve":"CVE-2026-101624","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39234789"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101625","ids":[{"system_name":"Oracle Bug ID of MySQL Connectors","text":"39261524"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8576(MySQL Connectors_Connector/Net)V-26.7.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8576(MySQL Connectors_Connector/Net)V-26.7.0"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-8576(MySQL Connectors_Connector/Net)V-26.7.0"]}]},{"cve":"CVE-2026-101626","ids":[{"system_name":"Oracle Bug ID of MySQL Connectors","text":"39261868"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8576(MySQL Connectors_Connector/Net)V-26.7.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8576(MySQL Connectors_Connector/Net)V-26.7.0"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-8576(MySQL Connectors_Connector/Net)V-26.7.0"]}]},{"cve":"CVE-2026-101627","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39295605"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101628","ids":[{"system_name":"Oracle Bug ID of MySQL Cluster","text":"39311051"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator).   The supported version that is affected is 9.7.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8479(MySQL Cluster)V-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8479(MySQL Cluster)V-9.7.3"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8479(MySQL Cluster)V-9.7.3"]}]},{"cve":"CVE-2026-101629","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39348620"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]}]},{"cve":"CVE-2026-101630","ids":[{"system_name":"Oracle Bug ID of Oracle Advanced Outbound Telephony","text":"39355629"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Advanced Outbound Telephony, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Advanced Outbound Telephony accessible data as well as  unauthorized read access to a subset of Oracle Advanced Outbound Telephony accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-785V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-785V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-785V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101631","ids":[{"system_name":"Oracle Bug ID of MySQL Router","text":"39363481"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Router.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Router accessible data as well as  unauthorized access to critical data or complete access to all MySQL Router accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4625V-26.7.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4625V-26.7.0"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-4625V-26.7.0"]}]},{"cve":"CVE-2026-101632","ids":[{"system_name":"Oracle Bug ID of MySQL Router","text":"39363968"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Router.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Router accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4625V-26.7.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4625V-26.7.0"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-4625V-26.7.0"]}]},{"cve":"CVE-2026-101633","ids":[{"system_name":"Oracle Bug ID of MySQL Router","text":"39364214"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise MySQL Router.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Router accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4625V-26.7.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4625V-26.7.0"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-4625V-26.7.0"]}]},{"cve":"CVE-2026-101634","ids":[{"system_name":"Oracle Bug ID of Oracle Mobile Field Service","text":"39367871"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Mobile Field Service. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-753V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-753V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"products":["P-753V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101635","ids":[{"system_name":"Oracle Bug ID of Oracle Mobile Field Service","text":"39367876"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-753V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-753V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-753V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101636","ids":[{"system_name":"Oracle Bug ID of Oracle Mobile Field Service","text":"39367933"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-753V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-753V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-753V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101637","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39372294"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster as well as  unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"products":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]}]},{"cve":"CVE-2026-101638","ids":[{"system_name":"Oracle Bug ID of Applications DBA","text":"39383412"}],"notes":[{"category":"description","text":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-166V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-166V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-166V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101639","ids":[{"system_name":"Oracle Bug ID of Oracle Marketing","text":"39383777"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Marketing.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Marketing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Marketing accessible data as well as  unauthorized read access to a subset of Oracle Marketing accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-229V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-229V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-229V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101640","ids":[{"system_name":"Oracle Bug ID of Oracle Marketing","text":"39383834"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Marketing accessible data as well as  unauthorized update, insert or delete access to some of Oracle Marketing accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-229V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-229V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-229V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101641","ids":[{"system_name":"Oracle Bug ID of Oracle Report Manager","text":"39384064"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Report Manager accessible data as well as  unauthorized update, insert or delete access to some of Oracle Report Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Report Manager. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-777V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-777V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","version":"3.1"},"products":["P-777V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101642","ids":[{"system_name":"Oracle Bug ID of Oracle Report Manager","text":"39384070"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Report Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Report Manager. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-777V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-777V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"products":["P-777V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101643","ids":[{"system_name":"Oracle Bug ID of Oracle Sales Online","text":"39384136"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Online.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Sales Online accessible data as well as  unauthorized read access to a subset of Oracle Sales Online accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-758V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-758V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"products":["P-758V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101644","ids":[{"system_name":"Oracle Bug ID of Oracle Mobile Field Service","text":"39384193"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-753V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-753V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-753V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101645","ids":[{"system_name":"Oracle Bug ID of Oracle iSetup","text":"39384471"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSetup.  Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-841V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-841V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-841V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101646","ids":[{"system_name":"Oracle Bug ID of Oracle iSetup","text":"39384493"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSetup.  Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-841V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-841V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-841V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101647","ids":[{"system_name":"Oracle Bug ID of Oracle iSetup","text":"39384499"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSetup.  Successful attacks of this vulnerability can result in takeover of Oracle iSetup. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-841V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-841V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-841V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101648","ids":[{"system_name":"Oracle Bug ID of Oracle Partner Management","text":"39390392"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Partner Management.  While the vulnerability is in Oracle Partner Management, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1065V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1065V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},"products":["P-1065V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101649","ids":[{"system_name":"Oracle Bug ID of Oracle Partner Management","text":"39390410"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Partner Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1065V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1065V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"products":["P-1065V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101650","ids":[{"system_name":"Oracle Bug ID of Oracle Partner Management","text":"39390434"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Partner Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Partner Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Partner Management. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1065V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1065V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"products":["P-1065V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101651","ids":[{"system_name":"Oracle Bug ID of Oracle Partner Management","text":"39390454"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Partner Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Partner Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1065V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1065V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-1065V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101653","ids":[{"system_name":"Oracle Bug ID of Oracle Mobile Field Service","text":"39390480"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-753V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-753V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-753V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101654","ids":[{"system_name":"Oracle Bug ID of Oracle Mobile Field Service","text":"39390498"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-753V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-753V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-753V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101655","ids":[{"system_name":"Oracle Bug ID of Oracle Mobile Field Service","text":"39390507"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-753V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-753V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-753V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101656","ids":[{"system_name":"Oracle Bug ID of Oracle Mobile Field Service","text":"39390527"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-753V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-753V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-753V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101658","ids":[{"system_name":"Oracle Bug ID of Oracle Mobile Field Service","text":"39390627"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-753V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-753V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-753V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101660","ids":[{"system_name":"Oracle Bug ID of Oracle Mobile Field Service","text":"39390770"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-753V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-753V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-753V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101661","ids":[{"system_name":"Oracle Bug ID of Oracle Mobile Field Service","text":"39390950"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-753V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-753V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-753V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101662","ids":[{"system_name":"Oracle Bug ID of Oracle Mobile Field Service","text":"39390963"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized read access to a subset of Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-753V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-753V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"products":["P-753V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101664","ids":[{"system_name":"Oracle Bug ID of Oracle Mobile Field Service","text":"39391082"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-753V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-753V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-753V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101665","ids":[{"system_name":"Oracle Bug ID of Oracle Mobile Field Service","text":"39391092"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Field Service accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Field Service accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-753V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-753V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-753V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101666","ids":[{"system_name":"Oracle Bug ID of Oracle Trade Management","text":"39391588"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LOV).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trade Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Trade Management accessible data as well as  unauthorized read access to a subset of Oracle Trade Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-765V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-765V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-765V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101667","ids":[{"system_name":"Oracle Bug ID of Oracle Trade Management","text":"39391617"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: Claim LOV).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Trade Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Trade Management accessible data as well as  unauthorized read access to a subset of Oracle Trade Management accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-765V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-765V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-765V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101668","ids":[{"system_name":"Oracle Bug ID of Oracle Customer Care","text":"39393945"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Customer Care.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Customer Care, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Customer Care accessible data as well as  unauthorized read access to a subset of Oracle Customer Care accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-105V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-105V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-105V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101669","ids":[{"system_name":"Oracle Bug ID of Oracle Public Sector Human Resources","text":"39395733"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite (component: Regression Testing).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public Sector Human Resources.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Public Sector Human Resources accessible data as well as  unauthorized access to critical data or complete access to all Oracle Public Sector Human Resources accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-210V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-210V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-210V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101670","ids":[{"system_name":"Oracle Bug ID of Oracle Email Center","text":"39396226"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Component).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Email Center.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Email Center accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-950V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-950V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-950V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101671","ids":[{"system_name":"Oracle Bug ID of Oracle Email Center","text":"39396267"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Component).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Email Center.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Email Center, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Email Center accessible data as well as  unauthorized read access to a subset of Oracle Email Center accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-950V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-950V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-950V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101672","ids":[{"system_name":"Oracle Bug ID of Oracle Call Center Technology","text":"39396409"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Call Center Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Call Center Technology. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-781V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-781V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-781V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101673","ids":[{"system_name":"Oracle Bug ID of Oracle US Federal Human Resources","text":"39396509"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle US Federal Human Resources product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle US Federal Human Resources.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle US Federal Human Resources accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-899V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-899V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-899V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101674","ids":[{"system_name":"Oracle Bug ID of Oracle Mobile Field Service","text":"39398393"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Mobile Field Service executes to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-753V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-753V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-753V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101675","ids":[{"system_name":"Oracle Bug ID of Oracle Mobile Field Service","text":"39398407"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Mobile Field Service executes to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-753V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-753V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-753V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101676","ids":[{"system_name":"Oracle Bug ID of Oracle Concurrent Processing","text":"39446788"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Concurrent Processing executes to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9303V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9303V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-9303V-12.2.3-12.2.15"]}]},{"acknowledgments":[{"names":["Yuval Fradkin"]}],"cve":"CVE-2026-101677","ids":[{"system_name":"Oracle Bug ID of MySQL Connectors","text":"39449398"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8576(MySQL Connectors_Connector/J)V-26.7.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8576(MySQL Connectors_Connector/J)V-26.7.0"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-8576(MySQL Connectors_Connector/J)V-26.7.0"]}]},{"acknowledgments":[{"names":["Yuval Fradkin"]}],"cve":"CVE-2026-101678","ids":[{"system_name":"Oracle Bug ID of MySQL Connectors","text":"39455455"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 4.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8576(MySQL Connectors_Connector/J)V-26.7.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8576(MySQL Connectors_Connector/J)V-26.7.0"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-8576(MySQL Connectors_Connector/J)V-26.7.0"]}]},{"cve":"CVE-2026-101679","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39472263"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101680","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39487836"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Billing and Revenue Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.1.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.2.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.1.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.2.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.1.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.2.0.0.0"]}]},{"cve":"CVE-2026-101681","ids":[{"system_name":"Oracle Bug ID of Applications DBA","text":"39488410"}],"notes":[{"category":"description","text":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-166V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-166V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.0,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-166V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101682","ids":[{"system_name":"Oracle Bug ID of Applications DBA","text":"39488638"}],"notes":[{"category":"description","text":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-166V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-166V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-166V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101683","ids":[{"system_name":"Oracle Bug ID of Applications DBA","text":"39488642"}],"notes":[{"category":"description","text":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-166V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-166V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.0,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-166V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101684","ids":[{"system_name":"Oracle Bug ID of Oracle E-Business Suite Integrated SOA Gateway","text":"39491813"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle E-Business Suite Integrated SOA Gateway accessible data as well as  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4569V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4569V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"products":["P-4569V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101685","ids":[{"system_name":"Oracle Bug ID of Oracle E-Business Suite Integrated SOA Gateway","text":"39491854"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4569V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4569V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4569V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101686","ids":[{"system_name":"Oracle Bug ID of Oracle E-Business Suite Integrated SOA Gateway","text":"39491863"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4569V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4569V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4569V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101687","ids":[{"system_name":"Oracle Bug ID of Oracle E-Business Suite Integrated SOA Gateway","text":"39491878"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in takeover of Oracle E-Business Suite Integrated SOA Gateway. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4569V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4569V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4569V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101688","ids":[{"system_name":"Oracle Bug ID of Oracle E-Business Suite Integrated SOA Gateway","text":"39491889"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  While the vulnerability is in Oracle E-Business Suite Integrated SOA Gateway, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4569V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4569V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-4569V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101689","ids":[{"system_name":"Oracle Bug ID of Oracle E-Business Suite Integrated SOA Gateway","text":"39491904"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  While the vulnerability is in Oracle E-Business Suite Integrated SOA Gateway, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4569V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4569V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-4569V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101690","ids":[{"system_name":"Oracle Bug ID of Oracle E-Business Suite Integrated SOA Gateway","text":"39491911"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Suite Integrated SOA Gateway.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle E-Business Suite Integrated SOA Gateway accessible data as well as  unauthorized update, insert or delete access to some of Oracle E-Business Suite Integrated SOA Gateway accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4569V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4569V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-4569V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101692","ids":[{"system_name":"Oracle Bug ID of Oracle Mobile Field Service","text":"39492215"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-753V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-753V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-753V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101694","ids":[{"system_name":"Oracle Bug ID of Oracle Mobile Field Service","text":"39492256"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Admin UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Service.  Successful attacks of this vulnerability can result in takeover of Oracle Mobile Field Service. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-753V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-753V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-753V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101695","ids":[{"system_name":"Oracle Bug ID of Oracle One-to-One Fulfillment","text":"39493792"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle One-to-One Fulfillment accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 6.8 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1379V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1379V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"products":["P-1379V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101696","ids":[{"system_name":"Oracle Bug ID of Oracle Application Object Library","text":"39493822"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Application Object Library accessible data as well as  unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-510V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-510V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-510V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101697","ids":[{"system_name":"Oracle Bug ID of Oracle One-to-One Fulfillment","text":"39493826"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Admin Console UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle One-to-One Fulfillment, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle One-to-One Fulfillment accessible data as well as  unauthorized read access to a subset of Oracle One-to-One Fulfillment accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1379V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1379V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-1379V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101698","ids":[{"system_name":"Oracle Bug ID of Oracle One-to-One Fulfillment","text":"39493880"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Java Server Issues).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment.  Successful attacks of this vulnerability can result in takeover of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1379V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1379V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1379V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101699","ids":[{"system_name":"Oracle Bug ID of Oracle One-to-One Fulfillment","text":"39493897"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment.  Successful attacks of this vulnerability can result in takeover of Oracle One-to-One Fulfillment. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1379V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1379V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1379V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101700","ids":[{"system_name":"Oracle Bug ID of Oracle Application Object Library","text":"39493918"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-510V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-510V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-510V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101701","ids":[{"system_name":"Oracle Bug ID of Oracle Concurrent Processing","text":"39494168"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Request Submission and Scheduling).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Concurrent Processing executes to compromise Oracle Concurrent Processing.  While the vulnerability is in Oracle Concurrent Processing, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Concurrent Processing accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9303V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9303V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-9303V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101703","ids":[{"system_name":"Oracle Bug ID of Pasta","text":"39494246"}],"notes":[{"category":"description","text":"Vulnerability in the Pasta product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Pasta.  Successful attacks of this vulnerability can result in takeover of Pasta. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1195V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1195V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1195V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101704","ids":[{"system_name":"Oracle Bug ID of Oracle Concurrent Processing","text":"39494261"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Concurrent Processing executes to compromise Oracle Concurrent Processing.  While the vulnerability is in Oracle Concurrent Processing, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9303V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9303V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-9303V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101705","ids":[{"system_name":"Oracle Bug ID of Oracle Common Applications","text":"39494300"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: Role Summary).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Common Applications.  While the vulnerability is in Oracle Common Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Common Applications accessible data as well as  unauthorized access to critical data or complete access to all Oracle Common Applications accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1198V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1198V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-1198V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101706","ids":[{"system_name":"Oracle Bug ID of Oracle One-to-One Fulfillment","text":"39494589"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle One-to-One Fulfillment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle One-to-One Fulfillment accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1379V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1379V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-1379V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101707","ids":[{"system_name":"Oracle Bug ID of Oracle Concurrent Processing","text":"39494651"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Other Issues).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Concurrent Processing accessible data as well as  unauthorized access to critical data or complete access to all Oracle Concurrent Processing accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9303V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9303V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-9303V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101708","ids":[{"system_name":"Oracle Bug ID of Oracle Payroll","text":"39495238"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-506V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-506V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-506V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101709","ids":[{"system_name":"Oracle Bug ID of Oracle Payroll","text":"39495329"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Payroll, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Payroll accessible data as well as  unauthorized read access to a subset of Oracle Payroll accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-506V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-506V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-506V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101710","ids":[{"system_name":"Oracle Bug ID of Oracle Payroll","text":"39495348"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Payroll accessible data as well as  unauthorized access to critical data or complete access to all Oracle Payroll accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-506V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-506V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-506V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101711","ids":[{"system_name":"Oracle Bug ID of Oracle Payroll","text":"39495397"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Payroll).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-506V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-506V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-506V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101712","ids":[{"system_name":"Oracle Bug ID of Oracle Payroll","text":"39495930"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-506V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-506V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-506V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101713","ids":[{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"39529477"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data as well as  unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4461V-9.3.6"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4461V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-4461V-9.3.6"]}]},{"cve":"CVE-2026-101714","ids":[{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"39529503"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Web Client).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data as well as  unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4461V-9.3.6"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4461V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-4461V-9.3.6"]}]},{"cve":"CVE-2026-101715","ids":[{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"39529567"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server).   The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data as well as  unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4461V-9.3.6"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4461V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-4461V-9.3.6"]}]},{"cve":"CVE-2026-101716","ids":[{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"39529662"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Web Client).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Agile PLM accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4461V-9.3.6"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4461V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-4461V-9.3.6"]}]},{"cve":"CVE-2026-101717","ids":[{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"39529693"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security).   The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM executes to compromise Oracle Agile PLM.  While the vulnerability is in Oracle Agile PLM, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data as well as  unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4461V-9.3.6"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4461V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":6.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"products":["P-4461V-9.3.6"]}]},{"cve":"CVE-2026-101718","ids":[{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"39529704"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server).   The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data as well as  unauthorized update, insert or delete access to some of Oracle Agile PLM accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4461V-9.3.6"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4461V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-4461V-9.3.6"]}]},{"cve":"CVE-2026-101719","ids":[{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"39529707"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server).   The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4461V-9.3.6"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4461V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4461V-9.3.6"]}]},{"cve":"CVE-2026-101720","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39539681"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling).  Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-26.7.0-26.7.1"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]}]},{"acknowledgments":[{"names":["Yuelin Wang"],"organization":"Violin0613"}],"cve":"CVE-2026-101721","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39564040"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Yuelin Wang"],"organization":"Violin0613"}],"cve":"CVE-2026-101722","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39564049"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling).  Supported versions that are affected are MySQL Server: 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]}]},{"cve":"CVE-2026-101723","ids":[{"system_name":"Oracle Bug ID of Oracle Agile PLM MCAD Connector","text":"39579651"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client).   The supported version that is affected is 3.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM MCAD Connector executes to compromise Oracle Agile PLM MCAD Connector.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM MCAD Connector. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4440V-3.6"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4440V-3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":6.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4440V-3.6"]}]},{"cve":"CVE-2026-101724","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39593341"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["4ra1n, pyn3rd and unam4"]}],"cve":"CVE-2026-101725","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39603337"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["4ra1n, pyn3rd and unam4"]}],"cve":"CVE-2026-101726","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39603346"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["4ra1n, pyn3rd and unam4"]}],"cve":"CVE-2026-101727","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39603354"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["4ra1n, pyn3rd and unam4"]}],"cve":"CVE-2026-101728","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39603366"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["4ra1n, pyn3rd and unam4"]}],"cve":"CVE-2026-101729","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39603374"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Haogang Mao"],"organization":"SKLCCSE Lab at Beihang University"},{"names":["Jie Liang"],"organization":"SKLCCSE Lab at Beihang University"}],"cve":"CVE-2026-101730","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39603575"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Haogang Mao"],"organization":"SKLCCSE Lab at Beihang University"},{"names":["Jie Liang"],"organization":"SKLCCSE Lab at Beihang University"}],"cve":"CVE-2026-101731","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39603649"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Haogang Mao"],"organization":"SKLCCSE Lab at Beihang University"},{"names":["Jie Liang"],"organization":"SKLCCSE Lab at Beihang University"}],"cve":"CVE-2026-101732","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39603658"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101733","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39616228"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101734","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Engineering Data Management","text":"39616268"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).   The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4436V-6.2.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4436V-6.2.1"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-4436V-6.2.1"]}]},{"acknowledgments":[{"names":["Alexandre Cornet"]}],"cve":"CVE-2026-101735","ids":[{"system_name":"Oracle Bug ID of Primavera Unifier","text":"40061925"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Project Control).  Supported versions that are affected are 23.12.0-23.12.16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Primavera Unifier accessible data as well as  unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-23.12.0-23.12.16"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-23.12.0-23.12.16"],"url":"https://support.oracle.com/support/?documentId=CPU415"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"products":["P-10354V-23.12.0-23.12.16"]}]},{"cve":"CVE-2026-101736","ids":[{"system_name":"Oracle Bug ID of Primavera Unifier","text":"40135955"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core).  Supported versions that are affected are 21.12.0-21.12.17. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Primavera Unifier accessible data as well as  unauthorized access to critical data or complete access to all Primavera Unifier accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-21.12.0-21.12.17"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-21.12.0-21.12.17"],"url":"https://support.oracle.com/support/?documentId=CPU415"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-10354V-21.12.0-21.12.17"]}]},{"cve":"CVE-2026-101737","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39532363"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Java SE (component: Compiler).   The supported version that is affected is Oracle Java SE: 26.0.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE.  Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-26.0.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-26.0.2"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-856(Java SE)V-26.0.2"]}]},{"cve":"CVE-2026-101738","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Engineering Data Management","text":"39616284"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).   The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4436V-6.2.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4436V-6.2.1"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-4436V-6.2.1"]}]},{"cve":"CVE-2026-101739","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Engineering Data Management","text":"39616290"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).   The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4436V-6.2.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4436V-6.2.1"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":7.0,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4436V-6.2.1"]}]},{"cve":"CVE-2026-101740","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Engineering Data Management","text":"39616291"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).   The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Agile Engineering Data Management accessible data as well as  unauthorized read access to a subset of Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 3.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4436V-6.2.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4436V-6.2.1"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":3.6,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-4436V-6.2.1"]}]},{"cve":"CVE-2026-101741","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Engineering Data Management","text":"39616301"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).   The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4436V-6.2.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4436V-6.2.1"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4436V-6.2.1"]}]},{"cve":"CVE-2026-101742","ids":[{"system_name":"Oracle Bug ID of Oracle Applications Manager","text":"38816173"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-99V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-99V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-99V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101743","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39616304"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: GIS).  Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-26.7.0-26.7.1"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]}]},{"cve":"CVE-2026-101744","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Engineering Data Management","text":"39616313"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).   The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management.  While the vulnerability is in Oracle Agile Engineering Data Management, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Engineering Data Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Engineering Data Management. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4436V-6.2.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4436V-6.2.1"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},"products":["P-4436V-6.2.1"]}]},{"cve":"CVE-2026-101745","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Engineering Data Management","text":"39616314"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).   The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Engineering Data Management.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4436V-6.2.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4436V-6.2.1"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-4436V-6.2.1"]}]},{"cve":"CVE-2026-101746","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Engineering Data Management","text":"39616320"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Install).   The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Agile Engineering Data Management executes to compromise Oracle Agile Engineering Data Management.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Engineering Data Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Engineering Data Management accessible data. CVSS 3.1 Base Score 7.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4436V-6.2.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4436V-6.2.1"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-4436V-6.2.1"]}]},{"cve":"CVE-2026-101747","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39632565"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101748","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39633136"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Audit).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101749","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39633350"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption).  Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-26.7.0-26.7.1"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]}]},{"cve":"CVE-2026-101750","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39633821"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101751","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39654054"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101752","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39659472"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]}]},{"cve":"CVE-2026-101753","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39659642"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: RAPID).  Supported versions that are affected are MySQL Server: 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]}]},{"cve":"CVE-2026-101754","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39659682"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101755","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39665344"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-26.7.0-26.7.1"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]}]},{"acknowledgments":[{"names":["Haogang Mao"],"organization":"SKLCCSE Lab at Beihang University"}],"cve":"CVE-2026-101756","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39679888"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: GIS).  Supported versions that are affected are MySQL Server: 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]}]},{"cve":"CVE-2026-101757","ids":[{"system_name":"Oracle Bug ID of Oracle Application Object Library","text":"39695355"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application Object Library executes to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-510V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-510V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-510V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101758","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39698537"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data as well as  unauthorized update, insert or delete access to some of Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"}],"scores":[{"cvss_v3":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]}]},{"cve":"CVE-2026-101759","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39698553"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]}]},{"cve":"CVE-2026-101760","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39729888"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Yuelin Wang"],"organization":"Violin0613"}],"cve":"CVE-2026-101761","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39740347"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Yuelin Wang"],"organization":"Violin0613"}],"cve":"CVE-2026-101762","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39740351"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101763","ids":[{"system_name":"Oracle Bug ID of Oracle Communications BRM - Elastic Charging Engine","text":"39745252"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Cloud native deployment).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Communications BRM - Elastic Charging Engine.  Successful attacks of this vulnerability can result in takeover of Oracle Communications BRM - Elastic Charging Engine. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9742V-15.2.0.0.0","P-9742V-15.0.1.0.0","P-9742V-15.0.0.0.0","P-9742V-15.1.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9742V-15.0.0.0.0","P-9742V-15.2.0.0.0","P-9742V-15.0.1.0.0","P-9742V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU413"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-9742V-15.0.0.0.0","P-9742V-15.2.0.0.0","P-9742V-15.0.1.0.0","P-9742V-15.1.0.0.0"]}]},{"cve":"CVE-2026-101764","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39784401"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]}]},{"cve":"CVE-2026-101765","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39784407"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Billing and Revenue Management accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]}]},{"acknowledgments":[{"names":["Omkhar Arasaratnam"],"organization":"Linkedin"}],"cve":"CVE-2026-101766","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39784720"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Brandon Peterson"],"organization":"Horizon3.ai"},{"names":["Jimi Sebree"],"organization":"Horizon3.ai"},{"names":["Noah King"],"organization":"Horizon3.ai"}],"cve":"CVE-2026-101767","ids":[{"system_name":"Oracle Bug ID of Oracle Application Object Library","text":"39800355"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-510V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-510V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-510V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101768","ids":[{"system_name":"Oracle Bug ID of MySQL Connectors","text":"39806615"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8576(MySQL Connectors_Connector/J)V-26.7.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8576(MySQL Connectors_Connector/J)V-26.7.0"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-8576(MySQL Connectors_Connector/J)V-26.7.0"]}]},{"acknowledgments":[{"names":["David Korczynski"],"organization":"ADA Logics"}],"cve":"CVE-2026-101769","ids":[{"system_name":"Oracle Bug ID of MySQL Cluster","text":"39832141"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).  Supported versions that are affected are 26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Cluster as well as  unauthorized update, insert or delete access to some of MySQL Cluster accessible data and  unauthorized read access to a subset of MySQL Cluster accessible data. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8479(MySQL Cluster)V-26.7.0-26.7.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8479(MySQL Cluster)V-26.7.0-26.7.1"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":7.0,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"products":["P-8479(MySQL Cluster)V-26.7.0-26.7.1"]}]},{"acknowledgments":[{"names":["David Korczynski"],"organization":"ADA Logics"}],"cve":"CVE-2026-101770","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39832176"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["David Korczynski"],"organization":"ADA Logics"}],"cve":"CVE-2026-101771","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39832186"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["David Korczynski"],"organization":"ADA Logics"}],"cve":"CVE-2026-101772","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39832202"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["David Korczynski"],"organization":"ADA Logics"}],"cve":"CVE-2026-101773","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39832216"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster as well as  unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["David Korczynski"],"organization":"ADA Logics"}],"cve":"CVE-2026-101774","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39832236"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster as well as  unauthorized update, insert or delete access to some of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["David Korczynski"],"organization":"ADA Logics"}],"cve":"CVE-2026-101775","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39832258"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.4 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Yuelin Wang"],"organization":"Violin0613"}],"cve":"CVE-2026-101776","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39838541"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Yuelin Wang"],"organization":"Violin0613"}],"cve":"CVE-2026-101777","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39838747"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Encryption).  Supported versions that are affected are MySQL Server: 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]}]},{"acknowledgments":[{"names":["Yuelin Wang"],"organization":"Violin0613"}],"cve":"CVE-2026-101778","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39838999"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Yuelin Wang"],"organization":"Violin0613"}],"cve":"CVE-2026-101779","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39839041"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Telemetry).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":2.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Yuelin Wang"],"organization":"Violin0613"}],"cve":"CVE-2026-101780","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39839185"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Cheonwoong Park"]}],"cve":"CVE-2026-101781","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39851456"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101782","ids":[{"system_name":"Oracle Bug ID of Oracle Applications Manager","text":"39856594"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-99V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-99V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-99V-12.2.3-12.2.15"]}]},{"acknowledgments":[{"names":["Muntadher Hasan (Dark River)"]}],"cve":"CVE-2026-101783","ids":[{"system_name":"Oracle Bug ID of MySQL Router","text":"39866456"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Router.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Router accessible data as well as  unauthorized access to critical data or complete access to all MySQL Router accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4625V-26.7.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4625V-26.7.0"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-4625V-26.7.0"]}]},{"cve":"CVE-2026-101784","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39867741"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Mrraul124"]}],"cve":"CVE-2026-101785","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39872033"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data as well as  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":8.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Zheng Yu"],"organization":"depthfirst"}],"cve":"CVE-2026-101786","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39882731"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 26.7.0-26.7.1; MySQL Cluster: 26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-26.7.0-26.7.1"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-26.7.0-26.7.1"]}]},{"acknowledgments":[{"names":["Feng Xue"]}],"cve":"CVE-2026-101787","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39882926"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Feng Xue"]}],"cve":"CVE-2026-101788","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39883040"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Feng Xue"]}],"cve":"CVE-2026-101789","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39883066"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101790","ids":[{"system_name":"Oracle Bug ID of Oracle Communications BRM - Elastic Charging Engine","text":"39899326"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Security).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications BRM - Elastic Charging Engine executes to compromise Oracle Communications BRM - Elastic Charging Engine.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9742V-15.2.0.0.0","P-9742V-15.0.1.0.0","P-9742V-15.0.0.0.0","P-9742V-15.1.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9742V-15.0.0.0.0","P-9742V-15.2.0.0.0","P-9742V-15.0.1.0.0","P-9742V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU413"}],"scores":[{"cvss_v3":{"baseScore":3.3,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-9742V-15.0.0.0.0","P-9742V-15.2.0.0.0","P-9742V-15.0.1.0.0","P-9742V-15.1.0.0.0"]}]},{"cve":"CVE-2026-101791","ids":[{"system_name":"Oracle Bug ID of Oracle Communications BRM - Elastic Charging Engine","text":"39899328"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Security).   The supported version that is affected is 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via TLS to compromise Oracle Communications BRM - Elastic Charging Engine.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications BRM - Elastic Charging Engine accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9742V-15.2.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9742V-15.2.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU413"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-9742V-15.2.0.0.0"]}]},{"cve":"CVE-2026-101792","ids":[{"system_name":"Oracle Bug ID of Oracle Communications BRM - Elastic Charging Engine","text":"39899330"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Security).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Communications BRM - Elastic Charging Engine executes to compromise Oracle Communications BRM - Elastic Charging Engine.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications BRM - Elastic Charging Engine accessible data as well as  unauthorized read access to a subset of Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9742V-15.2.0.0.0","P-9742V-15.0.1.0.0","P-9742V-15.0.0.0.0","P-9742V-15.1.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9742V-15.0.0.0.0","P-9742V-15.2.0.0.0","P-9742V-15.0.1.0.0","P-9742V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU413"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"products":["P-9742V-15.0.0.0.0","P-9742V-15.2.0.0.0","P-9742V-15.0.1.0.0","P-9742V-15.1.0.0.0"]}]},{"cve":"CVE-2026-101793","ids":[{"system_name":"Oracle Bug ID of Oracle Communications BRM - Elastic Charging Engine","text":"39899386"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Core).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications BRM - Elastic Charging Engine executes to compromise Oracle Communications BRM - Elastic Charging Engine.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9742V-15.2.0.0.0","P-9742V-15.0.1.0.0","P-9742V-15.0.0.0.0","P-9742V-15.1.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9742V-15.0.0.0.0","P-9742V-15.2.0.0.0","P-9742V-15.0.1.0.0","P-9742V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU413"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-9742V-15.0.0.0.0","P-9742V-15.2.0.0.0","P-9742V-15.0.1.0.0","P-9742V-15.1.0.0.0"]}]},{"acknowledgments":[{"names":["Binbin Xu"],"organization":"Tencent YUNDING LAB CodeBuddy Security"}],"cve":"CVE-2026-101794","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39905057"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Binbin Xu"],"organization":"Tencent YUNDING LAB CodeBuddy Security"}],"cve":"CVE-2026-101795","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39905086"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Binbin Xu"],"organization":"Tencent YUNDING LAB CodeBuddy Security"}],"cve":"CVE-2026-101796","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39905157"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Binbin Xu"],"organization":"Tencent YUNDING LAB CodeBuddy Security"}],"cve":"CVE-2026-101797","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39905165"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Binbin Xu"],"organization":"Tencent YUNDING LAB CodeBuddy Security"}],"cve":"CVE-2026-101798","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39905175"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Binbin Xu"],"organization":"Tencent YUNDING LAB CodeBuddy Security"}],"cve":"CVE-2026-101799","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39905199"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Siddharth Shubham Pal"]}],"cve":"CVE-2026-101800","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39911722"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Privileges).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data as well as  unauthorized access to critical data or complete access to all MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-101801","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39919455"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Muhammad Daffa"]}],"cve":"CVE-2026-101802","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39925442"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Parser).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["h1ei1"]}],"cve":"CVE-2026-101803","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"39938954"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"acknowledgments":[{"names":["Suraj Theekshana (株式会社CyberCrew)"]}],"cve":"CVE-2026-101804","ids":[{"system_name":"Oracle Bug ID of MySQL Connectors","text":"39938996"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC).   The supported version that is affected is 26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 2.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8576(MySQL Connectors_Connector/ODBC)V-26.7.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8576(MySQL Connectors_Connector/ODBC)V-26.7.1"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":2.5,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-8576(MySQL Connectors_Connector/ODBC)V-26.7.1"]}]},{"cve":"CVE-2026-101805","ids":[{"system_name":"Oracle Bug ID of Oracle Applications Manager","text":"39299476"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Applications Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Applications Manager. CVSS 3.1 Base Score 3.3 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-99V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-99V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":3.3,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"products":["P-99V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101806","ids":[{"system_name":"Oracle Bug ID of MySQL Connectors","text":"40010434"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC).   The supported version that is affected is 26.7.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as  unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8576(MySQL Connectors_Connector/ODBC)V-26.7.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8576(MySQL Connectors_Connector/ODBC)V-26.7.1"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-8576(MySQL Connectors_Connector/ODBC)V-26.7.1"]}]},{"cve":"CVE-2026-101807","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"40023914"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications Billing and Revenue Management accessible data as well as  unauthorized read access to a subset of Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"}],"scores":[{"cvss_v3":{"baseScore":4.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]}]},{"cve":"CVE-2026-101808","ids":[{"system_name":"Oracle Bug ID of Oracle Product Workbench","text":"40030831"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Product Workbench.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Product Workbench accessible data as well as  unauthorized access to critical data or complete access to all Oracle Product Workbench accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1597V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1597V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-1597V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101809","ids":[{"system_name":"Oracle Bug ID of Workflow","text":"40030901"}],"notes":[{"category":"description","text":"Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow.  While the vulnerability is in Workflow, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-174V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-174V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":10.0,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-174V-12.2.3-12.2.15"]}]},{"acknowledgments":[{"names":["Dhanush Arvind"]}],"cve":"CVE-2026-101810","ids":[{"system_name":"Oracle Bug ID of MySQL Router","text":"40061704"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Router.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4625V-26.7.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4625V-26.7.0"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-4625V-26.7.0"]}]},{"cve":"CVE-2026-101812","ids":[{"system_name":"Oracle Bug ID of Oracle Complex Maintenance, Repair and Overhaul","text":"39351491"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: LOV).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Complex Maintenance, Repair and Overhaul.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Complex Maintenance, Repair and Overhaul accessible data as well as  unauthorized access to critical data or complete access to all Oracle Complex Maintenance, Repair and Overhaul accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1184V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1184V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-1184V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101813","ids":[{"system_name":"Oracle Bug ID of Oracle Engineering","text":"39357753"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Engineering.  Successful attacks of this vulnerability can result in takeover of Oracle Engineering. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-532V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-532V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-532V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101814","ids":[{"system_name":"Oracle Bug ID of Oracle Engineering","text":"39382542"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Engineering.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Engineering accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-532V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-532V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-532V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101815","ids":[{"system_name":"Oracle Bug ID of Assets","text":"39382593"}],"notes":[{"category":"description","text":"Vulnerability in the Assets product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Assets.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Assets as well as  unauthorized update, insert or delete access to some of Assets accessible data and  unauthorized read access to a subset of Assets accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-503V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-503V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"products":["P-503V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101816","ids":[{"system_name":"Oracle Bug ID of Oracle Product Hub","text":"39382596"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1313V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1313V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1313V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101818","ids":[{"system_name":"Oracle Bug ID of Oracle Product Hub","text":"39382684"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  While the vulnerability is in Oracle Product Hub, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Product Hub accessible data as well as  unauthorized update, insert or delete access to some of Oracle Product Hub accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Product Hub. CVSS 3.1 Base Score 7.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1313V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1313V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L","version":"3.1"},"products":["P-1313V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101819","ids":[{"system_name":"Oracle Bug ID of Oracle General Ledger","text":"39383493"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle General Ledger accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-500V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-500V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-500V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101820","ids":[{"system_name":"Oracle Bug ID of Oracle General Ledger","text":"39383548"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: ADADMIN).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger.  Successful attacks of this vulnerability can result in takeover of Oracle General Ledger. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-500V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-500V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-500V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101821","ids":[{"system_name":"Oracle Bug ID of Oracle Compensation Workbench","text":"39384521"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Compensation Workbench product of Oracle E-Business Suite (component: Total Compensation Statement).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Compensation Workbench.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Compensation Workbench, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Compensation Workbench accessible data as well as  unauthorized read access to a subset of Oracle Compensation Workbench accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4427V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4427V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-4427V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101822","ids":[{"system_name":"Oracle Bug ID of Oracle Bills of Material","text":"39384699"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Bills of Material.  While the vulnerability is in Oracle Bills of Material, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Bills of Material accessible data as well as  unauthorized read access to a subset of Oracle Bills of Material accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Bills of Material. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-571V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-571V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:H/A:L","version":"3.1"},"products":["P-571V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101823","ids":[{"system_name":"Oracle Bug ID of Oracle Bills of Material","text":"39384723"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material.  Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-571V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-571V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-571V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101824","ids":[{"system_name":"Oracle Bug ID of Document Management and Collaboration","text":"39389009"}],"notes":[{"category":"description","text":"Vulnerability in the Document Management and Collaboration product of Oracle E-Business Suite (component: Attachments).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Document Management and Collaboration.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Document Management and Collaboration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Document Management and Collaboration accessible data as well as  unauthorized access to critical data or complete access to all Document Management and Collaboration accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1314V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1314V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-1314V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101825","ids":[{"system_name":"Oracle Bug ID of Oracle HCM Common Architecture","text":"39389170"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture.  Successful attacks of this vulnerability can result in takeover of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2021V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2021V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2021V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101826","ids":[{"system_name":"Oracle Bug ID of Oracle HCM Common Architecture","text":"39389179"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture.  Successful attacks of this vulnerability can result in takeover of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2021V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2021V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2021V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101827","ids":[{"system_name":"Oracle Bug ID of Oracle HCM Common Architecture","text":"39389183"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HCM Common Architecture.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HCM Common Architecture accessible data as well as  unauthorized access to critical data or complete access to all Oracle HCM Common Architecture accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle HCM Common Architecture. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2021V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2021V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","version":"3.1"},"products":["P-2021V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101828","ids":[{"system_name":"Oracle Bug ID of Oracle Mobile Application Server","text":"39390200"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Application Server.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-995V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-995V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-995V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101829","ids":[{"system_name":"Oracle Bug ID of Oracle Mobile Application Server","text":"39390206"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Application Server.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Mobile Application Server accessible data as well as  unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-995V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-995V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-995V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101830","ids":[{"system_name":"Oracle Bug ID of Oracle Project Contracts","text":"39390409"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Contracts.  While the vulnerability is in Oracle Project Contracts, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Project Contracts accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-799V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-799V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-799V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101831","ids":[{"system_name":"Oracle Bug ID of Oracle Quality","text":"39390624"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Quality.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Quality accessible data as well as  unauthorized access to critical data or complete access to all Oracle Quality accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-214V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-214V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-214V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101832","ids":[{"system_name":"Oracle Bug ID of Oracle Order Management","text":"39391357"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Order Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-497V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-497V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-497V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101833","ids":[{"system_name":"Oracle Bug ID of Oracle Shipping Execution","text":"39393715"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data as well as  unauthorized update, insert or delete access to some of Oracle Shipping Execution accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Shipping Execution. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-996V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-996V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","version":"3.1"},"products":["P-996V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101834","ids":[{"system_name":"Oracle Bug ID of Oracle Shipping Execution","text":"39393749"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in takeover of Oracle Shipping Execution. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-996V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-996V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-996V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101835","ids":[{"system_name":"Oracle Bug ID of Oracle Shipping Execution","text":"39393779"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-996V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-996V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-996V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101836","ids":[{"system_name":"Oracle Bug ID of iSupplier Portal","text":"39393914"}],"notes":[{"category":"description","text":"Vulnerability in the iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupplier Portal.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all iSupplier Portal accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-208V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-208V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-208V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101837","ids":[{"system_name":"Oracle Bug ID of Oracle Shipping Execution","text":"39394107"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Shipping Execution.  While the vulnerability is in Oracle Shipping Execution, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Shipping Execution as well as  unauthorized update, insert or delete access to some of Oracle Shipping Execution accessible data and  unauthorized read access to a subset of Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-996V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-996V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H","version":"3.1"},"products":["P-996V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101840","ids":[{"system_name":"Oracle Bug ID of Oracle Contract Lifecycle Management for Public Sector","text":"39395484"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector.  Successful attacks of this vulnerability can result in takeover of Oracle Contract Lifecycle Management for Public Sector. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8759V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8759V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-8759V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101841","ids":[{"system_name":"Oracle Bug ID of Global Order Promising","text":"39398599"}],"notes":[{"category":"description","text":"Vulnerability in the Global Order Promising product of Oracle E-Business Suite (component: Web Service).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Global Order Promising.  While the vulnerability is in Global Order Promising, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Global Order Promising accessible data as well as  unauthorized access to critical data or complete access to all Global Order Promising accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-729V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-729V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-729V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101842","ids":[{"system_name":"Oracle Bug ID of Strategic Network Optimization","text":"39399181"}],"notes":[{"category":"description","text":"Vulnerability in the Strategic Network Optimization product of Oracle E-Business Suite (component: Installation of SNO).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Strategic Network Optimization.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Strategic Network Optimization. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1981V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1981V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1981V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101843","ids":[{"system_name":"Oracle Bug ID of Production Scheduling","text":"39399198"}],"notes":[{"category":"description","text":"Vulnerability in the Production Scheduling product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Production Scheduling executes to compromise Production Scheduling.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Production Scheduling accessible data as well as  unauthorized read access to a subset of Production Scheduling accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Production Scheduling. CVSS 3.1 Base Score 4.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1983V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1983V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":4.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-1983V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101844","ids":[{"system_name":"Oracle Bug ID of Oracle Concurrent Processing","text":"39407561"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: Concurrent Requests).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Concurrent Processing.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Concurrent Processing accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9303V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9303V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-9303V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101845","ids":[{"system_name":"Oracle Bug ID of Oracle Purchasing","text":"39408597"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Purchasing accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-502V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-502V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-502V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101846","ids":[{"system_name":"Oracle Bug ID of Oracle Purchasing","text":"39447208"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Purchasing accessible data. CVSS 3.1 Base Score 3.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-502V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-502V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":3.5,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-502V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101847","ids":[{"system_name":"Oracle Bug ID of Oracle Bills of Material","text":"39491582"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material.  Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-571V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-571V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-571V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101849","ids":[{"system_name":"Oracle Bug ID of Installed Base","text":"39492085"}],"notes":[{"category":"description","text":"Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Create Item Instance).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Installed Base.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Installed Base, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Installed Base accessible data as well as  unauthorized update, insert or delete access to some of Installed Base accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1118V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1118V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N","version":"3.1"},"products":["P-1118V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101850","ids":[{"system_name":"Oracle Bug ID of Installed Base","text":"39492103"}],"notes":[{"category":"description","text":"Vulnerability in the Installed Base product of Oracle E-Business Suite (component: HTML UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Installed Base.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Installed Base, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Installed Base accessible data as well as  unauthorized read access to a subset of Installed Base accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1118V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1118V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-1118V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101851","ids":[{"system_name":"Oracle Bug ID of Installed Base","text":"39492234"}],"notes":[{"category":"description","text":"Vulnerability in the Installed Base product of Oracle E-Business Suite (component: Data Provider UI).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Installed Base.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Installed Base accessible data as well as  unauthorized update, insert or delete access to some of Installed Base accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1118V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1118V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-1118V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101852","ids":[{"system_name":"Oracle Bug ID of Oracle Product Hub","text":"39492504"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1313V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1313V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1313V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101853","ids":[{"system_name":"Oracle Bug ID of Oracle Product Hub","text":"39492507"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1313V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1313V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1313V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101854","ids":[{"system_name":"Oracle Bug ID of Oracle Product Hub","text":"39492533"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1313V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1313V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1313V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101855","ids":[{"system_name":"Oracle Bug ID of Oracle Product Hub","text":"39492555"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Product Hub accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1313V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1313V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-1313V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101856","ids":[{"system_name":"Oracle Bug ID of Oracle Order Management","text":"39493919"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Order Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-497V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-497V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-497V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-101857","ids":[{"system_name":"Oracle Bug ID of Oracle Order Management","text":"39493988"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Order Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-497V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-497V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-497V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-10536","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-10723","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Console","text":"40113780"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Console product of Oracle Communications (component: Console (BIND)).  Supported versions that are affected are 25.2.202 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Oracle Communications Cloud Native Core Console.  While the vulnerability is in Oracle Communications Cloud Native Core Console, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Console accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14250V-26.1.200","P-14250V-25.2.202"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14250V-25.2.202","P-14250V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU405"}]},{"cve":"CVE-2026-11331","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"40119470"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Console","text":"40113780"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Console product of Oracle Communications (component: Console (BIND)).  Supported versions that are affected are 25.2.202 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Oracle Communications Cloud Native Core Console.  While the vulnerability is in Oracle Communications Cloud Native Core Console, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Console accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Install (BIND)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  While the vulnerability is in Oracle Communications Cloud Native Core Security Edge Protection Proxy, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Security Edge Protection Proxy accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-26.1.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-25.2.200","P-14250V-25.2.202","P-14250V-26.1.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14250V-25.2.202","P-14250V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU405"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-26.1.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"}]},{"cve":"CVE-2026-11332","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39889584"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager (Ansible)).  Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-11622","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Console","text":"40113780"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Console product of Oracle Communications (component: Console (BIND)).  Supported versions that are affected are 25.2.202 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Oracle Communications Cloud Native Core Console.  While the vulnerability is in Oracle Communications Cloud Native Core Console, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Console accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14250V-26.1.200","P-14250V-25.2.202"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14250V-25.2.202","P-14250V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU405"}]},{"cve":"CVE-2026-11721","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Console","text":"40113780"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Console product of Oracle Communications (component: Console (BIND)).  Supported versions that are affected are 25.2.202 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Oracle Communications Cloud Native Core Console.  While the vulnerability is in Oracle Communications Cloud Native Core Console, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Console accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14250V-26.1.200","P-14250V-25.2.202"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14250V-25.2.202","P-14250V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU405"}]},{"cve":"CVE-2026-11822","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-619(Oracle Spatial and Graph-gdal)V-23.4.0-23.26.3","P-619(Oracle Spatial and Graph-gdal)V-19.3-19.32","P-619(Oracle Spatial and Graph-gdal)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"39872089"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle Spatial and Graph (gdal) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-619(Oracle Spatial and Graph-gdal)V-21.3-21.23","P-619(Oracle Spatial and Graph-gdal)V-23.4.0-23.26.3","P-619(Oracle Spatial and Graph-gdal)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-619(Oracle Spatial and Graph-gdal)V-23.4.0-23.26.3","P-619(Oracle Spatial and Graph-gdal)V-19.3-19.32","P-619(Oracle Spatial and Graph-gdal)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-619(Oracle Spatial and Graph-gdal)V-23.4.0-23.26.3","P-619(Oracle Spatial and Graph-gdal)V-19.3-19.32","P-619(Oracle Spatial and Graph-gdal)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-619(Oracle Spatial and Graph-gdal)V-23.4.0-23.26.3","P-619(Oracle Spatial and Graph-gdal)V-19.3-19.32","P-619(Oracle Spatial and Graph-gdal)V-21.3-21.23"]}]},{"cve":"CVE-2026-11824","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-619(Oracle Spatial and Graph-gdal)V-23.4.0-23.26.3","P-619(Oracle Spatial and Graph-gdal)V-19.3-19.32","P-619(Oracle Spatial and Graph-gdal)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"39872089"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle Spatial and Graph (gdal) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-619(Oracle Spatial and Graph-gdal)V-21.3-21.23","P-619(Oracle Spatial and Graph-gdal)V-23.4.0-23.26.3","P-619(Oracle Spatial and Graph-gdal)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-619(Oracle Spatial and Graph-gdal)V-23.4.0-23.26.3","P-619(Oracle Spatial and Graph-gdal)V-19.3-19.32","P-619(Oracle Spatial and Graph-gdal)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-619(Oracle Spatial and Graph-gdal)V-23.4.0-23.26.3","P-619(Oracle Spatial and Graph-gdal)V-19.3-19.32","P-619(Oracle Spatial and Graph-gdal)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-619(Oracle Spatial and Graph-gdal)V-23.4.0-23.26.3","P-619(Oracle Spatial and Graph-gdal)V-19.3-19.32","P-619(Oracle Spatial and Graph-gdal)V-21.3-21.23"]}]},{"cve":"CVE-2026-11856","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-11979","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Certificate Management","text":"40119487"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Certificate Management product of Oracle Communications (component: Configuration (libxml2)).   The supported version that is affected is 26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Certificate Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Certificate Management.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14868V-26.1.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14868V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU411"}]},{"cve":"CVE-2026-12064","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-12185","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39989976"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (Bouncy Castle Java Library)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-1225","ids":[{"system_name":"Oracle Bug ID of Oracle Enterprise Manager Base Platform","text":"39893148"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: API Gateway (jackson-core)).   The supported version that is affected is 24.1. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 1.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1370V-24.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1370V-24.1"],"url":"https://support.oracle.com/support/?documentId=CPU391"}],"scores":[{"cvss_v3":{"baseScore":1.9,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-1370V-24.1"]}]},{"cve":"CVE-2026-12802","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4647V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4647V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-12803","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39989976"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (Bouncy Castle Java Library)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-12816","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39989976"},{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39877106"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security (Bouncy Castle Java Library)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (Bouncy Castle Java Library)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-5085V-8.61-8.63","P-12738V-15.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-12817","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"},{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"40052139"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars (Bouncy Castle Java Library)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server as well as  unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data and  unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4647V-14.1.2.0.0","P-5242V-14.1.1.0.0","P-5242V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4647V-14.1.2.0.0","P-5242V-14.1.1.0.0","P-5242V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"products":["P-5242V-14.1.1.0.0","P-5242V-12.2.1.4.0"]}]},{"cve":"CVE-2026-12860","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39989976"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (Bouncy Castle Java Library)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-13204","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Console","text":"40113780"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Console product of Oracle Communications (component: Console (BIND)).  Supported versions that are affected are 25.2.202 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Oracle Communications Cloud Native Core Console.  While the vulnerability is in Oracle Communications Cloud Native Core Console, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Console accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14250V-26.1.200","P-14250V-25.2.202"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14250V-25.2.202","P-14250V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU405"}]},{"cve":"CVE-2026-13221","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"39861227"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Perl)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"products":["P-14597V-6.1.1-7.0.0"]}]},{"cve":"CVE-2026-13321","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"40119470"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Console","text":"40113780"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Console product of Oracle Communications (component: Console (BIND)).  Supported versions that are affected are 25.2.202 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Oracle Communications Cloud Native Core Console.  While the vulnerability is in Oracle Communications Cloud Native Core Console, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Console accessible data. CVSS 3.1 Base Score 8.6 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Install (BIND)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  While the vulnerability is in Oracle Communications Cloud Native Core Security Edge Protection Proxy, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Security Edge Protection Proxy accessible data. CVSS 3.1 Base Score 8.6 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-26.1.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-25.2.200","P-14250V-25.2.202","P-14250V-26.1.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14250V-25.2.202","P-14250V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU405"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-26.1.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"}],"scores":[{"cvss_v3":{"baseScore":8.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"products":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-26.1.200","P-14250V-25.2.202","P-14250V-26.1.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-25.2.200"]}]},{"cve":"CVE-2026-13506","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"40115141"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39989976"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Unified Data Repository","text":"40120457"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (Bouncy Castle Java Library)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Signaling (Bouncy Castle Java Library)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Security Edge Protection Proxy accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Security Edge Protection Proxy accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Unified Data Repository product of Oracle Communications (component: Configuration (Bouncy Castle Java Library)).  Supported versions that are affected are 25.2.200 and 26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications Cloud Native Core Unified Data Repository.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Unified Data Repository accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Unified Data Repository accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-14.1.2.0.0","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-14119V-26.1.200","P-12738V-15.1.1.0.0","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200","P-14119V-25.2.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14119V-26.1.200","P-14119V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU407"}]},{"cve":"CVE-2026-13586","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39989976"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (Bouncy Castle Java Library)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-13608","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-14456","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Certificate Management","text":"40119533"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40009481"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (OpenSSL) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise RDBMS (OpenSSL).  Successful attacks of this vulnerability can result in takeover of RDBMS (OpenSSL).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Certificate Management product of Oracle Communications (component: Configuration (OpenSSL)).  Supported versions that are affected are 25.2.201 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications Cloud Native Core Certificate Management.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Certificate Management.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14868V-26.1.200","P-14868V-25.2.201","P-5(RDBMS-OpenSSL)V-23.4.0-23.26.3","P-5(RDBMS-OpenSSL)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-OpenSSL)V-23.4.0-23.26.3","P-5(RDBMS-OpenSSL)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14868V-25.2.201","P-14868V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU411"}]},{"cve":"CVE-2026-14457","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Certificate Management","text":"40119533"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40009481"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (OpenSSL) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise RDBMS (OpenSSL).  Successful attacks of this vulnerability can result in takeover of RDBMS (OpenSSL).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Certificate Management product of Oracle Communications (component: Configuration (OpenSSL)).  Supported versions that are affected are 25.2.201 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications Cloud Native Core Certificate Management.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Certificate Management.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14868V-26.1.200","P-14868V-25.2.201","P-5(RDBMS-OpenSSL)V-23.4.0-23.26.3","P-5(RDBMS-OpenSSL)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-OpenSSL)V-23.4.0-23.26.3","P-5(RDBMS-OpenSSL)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14868V-25.2.201","P-14868V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU411"}]},{"cve":"CVE-2026-14682","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39989976"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (Bouncy Castle Java Library)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-15055","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4647V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4647V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-1703","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39953623"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server (pip)).  Supported versions that are affected are 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Billing and Revenue Management accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"}]},{"cve":"CVE-2026-18477","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Console","text":"40113889"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Console product of Oracle Communications (component: Configuration (node-tar)).  Supported versions that are affected are 25.2.202 and  26.1.200. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Cloud Native Core Console executes to compromise Oracle Communications Cloud Native Core Console.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Console accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14250V-26.1.200","P-14250V-25.2.202"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14250V-25.2.202","P-14250V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU405"}]},{"cve":"CVE-2026-18508","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Console","text":"40113889"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Console product of Oracle Communications (component: Configuration (node-tar)).  Supported versions that are affected are 25.2.202 and  26.1.200. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Cloud Native Core Console executes to compromise Oracle Communications Cloud Native Core Console.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Console accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14250V-26.1.200","P-14250V-25.2.202"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14250V-25.2.202","P-14250V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU405"}]},{"cve":"CVE-2026-18798","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Certificate Management","text":"40119533"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40009481"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (OpenSSL) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise RDBMS (OpenSSL).  Successful attacks of this vulnerability can result in takeover of RDBMS (OpenSSL).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Certificate Management product of Oracle Communications (component: Configuration (OpenSSL)).  Supported versions that are affected are 25.2.201 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications Cloud Native Core Certificate Management.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Certificate Management.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14868V-26.1.200","P-14868V-25.2.201","P-5(RDBMS-OpenSSL)V-23.4.0-23.26.3","P-5(RDBMS-OpenSSL)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-OpenSSL)V-23.4.0-23.26.3","P-5(RDBMS-OpenSSL)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14868V-25.2.201","P-14868V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU411"}]},{"cve":"CVE-2026-18924","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-19032","ids":[{"system_name":"Oracle Bug ID of Oracle Utilities Application Framework","text":"39970746"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39935172"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform (jackson-databind)).  Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: Security (jackson-databind)).  Supported versions that are affected are 4.4.0.2.0, 4.4.0.3.0, 4.4.0.4.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 4.5.0.2.0, 25.4, 25.10, 26.4 and  26.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Application Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Application Framework.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-4.5.0.0.0","P-2245V-4.4.0.2.0","P-10354V-24.12.0-24.12.16","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-2245V-4.5.0.1.3","P-2245V-25.4","P-2245V-26.4","P-2245V-25.10","P-2245V-26.10","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU370"}]},{"cve":"CVE-2026-1940","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39416135"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (gstreamer)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle JavaFX accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-1965","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-19931","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-20060","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40064509"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (virtualenv)).  Supported versions that are affected are 6.1.1-7.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications Unified Assurance accessible data as well as  unauthorized read access to a subset of Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-20643","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-20664","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-20665","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-20691","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-21441","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Network Slice Selection Function","text":"39145780"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Network Slice Selection Function product of Oracle Communications (component: Install (urllib3)).   The supported version that is affected is 25.2.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Network Slice Selection Function.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Network Slice Selection Function. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14130V-25.2.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14130V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU412"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-14130V-25.2.200"]}]},{"cve":"CVE-2026-21710","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-21712","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-21713","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-21714","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-21715","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-21716","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data. CVSS 3.1 Base Score 8.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-14597V-6.1.1-7.0.0"]}]},{"cve":"CVE-2026-21717","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-22702","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40064509"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (virtualenv)).  Supported versions that are affected are 6.1.1-7.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications Unified Assurance accessible data as well as  unauthorized read access to a subset of Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Unified Assurance. CVSS 3.1 Base Score 4.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-14597V-6.1.1-7.0.0"]}]},{"cve":"CVE-2026-22735","ids":[{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"}]},{"cve":"CVE-2026-22737","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"component_not_present","product_ids":["P-9348V-11.4.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39711683"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (Spring Framework)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"known_not_affected":["P-9348V-11.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-9348V-11.4.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The software is not affected because the vulnerable component is not in the product.","product_ids":["P-9348V-11.4.0"]}]},{"cve":"CVE-2026-22740","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"component_not_present","product_ids":["P-9348V-11.4.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39711683"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39562499"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Thirdparty Patch (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (Spring Framework)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-4647V-14.1.2.0.0","P-4647V-12.2.1.4.0","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"known_not_affected":["P-9348V-11.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4647V-14.1.2.0.0","P-4647V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-9348V-11.4.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The software is not affected because the vulnerable component is not in the product.","product_ids":["P-9348V-11.4.0"]}]},{"cve":"CVE-2026-22741","ids":[{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39562499"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Thirdparty Patch (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-4647V-14.1.2.0.0","P-4647V-12.2.1.4.0","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4647V-14.1.2.0.0","P-4647V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"}]},{"cve":"CVE-2026-22745","ids":[{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39562499"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Thirdparty Patch (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-4647V-14.1.2.0.0","P-4647V-12.2.1.4.0","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4647V-14.1.2.0.0","P-4647V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"}]},{"cve":"CVE-2026-22746","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Development","text":"39682313"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval Manager (Spring Framework)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM Development accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9001V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9001V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}]},{"cve":"CVE-2026-22751","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Development","text":"39682313"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval Manager (Spring Framework)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM Development accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9001V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9001V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}]},{"cve":"CVE-2026-22795","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"38906645"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC (OpenSSL)).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-4781V-9.2.0.0-9.2.26.5","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-4629V-9.7.0-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-22796","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"38906645"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC (OpenSSL)).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-4781V-9.2.0.0-9.2.26.5","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-4629V-9.7.0-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-22860","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-2332","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39663592"},{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39483415"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Eclipse Jetty)).  Supported versions that are affected are 26.1.0.0.0-26.2.0.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GoldenGate Stream Analytics.  While the vulnerability is in Oracle GoldenGate Stream Analytics, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle GoldenGate Stream Analytics accessible data as well as  unauthorized read access to a subset of Oracle GoldenGate Stream Analytics accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure (jackson-databind)).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2026-24733","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068469"},{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39760530"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface (Apache Tomcat)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (Apache Tomcat)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0","P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-24880","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068469"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (Apache Tomcat)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-25500","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-2673","ids":[{"system_name":"Oracle Bug ID of Oracle Autonomous Health Framework","text":"40013468"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Autonomous Health Framework (component: AHFCOMMON (OpenSSL)).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Autonomous Health Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Autonomous Health Framework accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14634V-26.3-26.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14634V-26.3-26.8"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-26961","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-27171","ids":[{"system_name":"Oracle Bug ID of Oracle Fusion Middleware","text":"39400046"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Fusion Middleware (component: Centralized Thirdparty Jars (Perl)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Fusion Middleware.  Successful attacks of this vulnerability can result in takeover of Oracle Fusion Middleware.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1032V-12.2.1.4.0","P-1032V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1032V-12.2.1.4.0","P-1032V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-27601","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Operations Monitor","text":"40106802"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Operations Monitor product of Oracle Communications (component: Front-end (underscore)).  Supported versions that are affected are 6.0 and  6.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications Operations Monitor.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Operations Monitor. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10761V-6.0","P-10761V-6.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10761V-6.0","P-10761V-6.1"],"url":"https://support.oracle.com/support/?documentId=CPU398"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-10761V-6.0","P-10761V-6.1"]}]},{"cve":"CVE-2026-28367","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Binding Support Function","text":"39710892"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Policy","text":"39710896"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Binding Support Function product of Oracle Communications (component: Install/Upgrade (Undertow)).   The supported version that is affected is 25.2.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Binding Support Function.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Binding Support Function accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Binding Support Function accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Alarms, KPI, and Measurements (Undertow)).   The supported version that is affected is 25.2.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Policy accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Policy accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14121V-25.2.200","P-14277V-25.2.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14121V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU401"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14277V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU406"}]},{"cve":"CVE-2026-28368","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Binding Support Function","text":"39710892"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Policy","text":"39710896"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Binding Support Function product of Oracle Communications (component: Install/Upgrade (Undertow)).   The supported version that is affected is 25.2.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Binding Support Function.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Binding Support Function accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Binding Support Function accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Alarms, KPI, and Measurements (Undertow)).   The supported version that is affected is 25.2.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Policy accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Policy accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14121V-25.2.200","P-14277V-25.2.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14121V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU401"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14277V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU406"}]},{"cve":"CVE-2026-28369","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Binding Support Function","text":"39710892"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Policy","text":"39710896"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Binding Support Function product of Oracle Communications (component: Install/Upgrade (Undertow)).   The supported version that is affected is 25.2.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Binding Support Function.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Binding Support Function accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Binding Support Function accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Alarms, KPI, and Measurements (Undertow)).   The supported version that is affected is 25.2.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Policy accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Policy accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14121V-25.2.200","P-14277V-25.2.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14121V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU401"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14277V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU406"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-14121V-25.2.200","P-14277V-25.2.200"]}]},{"cve":"CVE-2026-28387","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39362143"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"},{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39525775"},{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39525502"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Visual Analyzer (OpenSSL)).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Foundation (OpenSSL)).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security (OpenSSL)).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Business Intelligence Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-2025V-8.2.0.0.0","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-2025V-26.01.0.0.0","P-4629V-9.7.0-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"]}]},{"cve":"CVE-2026-28388","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39362143"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Visual Analyzer (OpenSSL)).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-2025V-8.2.0.0.0","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-2025V-26.01.0.0.0","P-4629V-9.7.0-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-28389","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39362143"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"},{"system_name":"Oracle Bug ID of Oracle Autonomous Health Framework","text":"40013468"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Visual Analyzer (OpenSSL)).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in Oracle Autonomous Health Framework (component: AHFCOMMON (OpenSSL)).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Autonomous Health Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Autonomous Health Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-2025V-8.2.0.0.0","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-2025V-26.01.0.0.0","P-4629V-9.7.0-9.7.3","P-14634V-26.3-26.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14634V-26.3-26.8"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-28390","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39362143"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Visual Analyzer (OpenSSL)).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-2025V-8.2.0.0.0","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-2025V-26.01.0.0.0","P-4629V-9.7.0-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-28847","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-28857","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-28859","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-28861","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-28871","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-28883","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-28901","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-28902","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-28903","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-28904","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-28905","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-28907","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-28942","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-28946","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-28947","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-28953","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-28955","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-28958","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-28984","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-29167","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications Policy Management","text":"39692059"},{"system_name":"Oracle Bug ID of Oracle Secure Backup","text":"39692067"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"39692055"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Automated Test Suite Framework (Apache HTTP Server)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Security Edge Protection Proxy. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Policy Management product of Oracle Communications (component: CMP (Apache HTTP Server)).  Supported versions that are affected are 15.0.0.0.0 and  15.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Policy Management. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle Secure Backup (component: Secure Backup (Apache HTTP Server)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200","P-10900V-15.1.0.0.0","P-10900V-15.0.0.0.0"],"known_not_affected":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10900V-15.0.0.0.0","P-10900V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU403"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-10900V-15.0.0.0.0","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200","P-10900V-15.1.0.0.0"]},{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}]},{"cve":"CVE-2026-29170","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications Policy Management","text":"39692059"},{"system_name":"Oracle Bug ID of Oracle Secure Backup","text":"39692067"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"39692055"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Automated Test Suite Framework (Apache HTTP Server)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Policy Management product of Oracle Communications (component: CMP (Apache HTTP Server)).  Supported versions that are affected are 15.0.0.0.0 and  15.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Policy Management.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle Secure Backup (component: Secure Backup (Apache HTTP Server)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200","P-10900V-15.1.0.0.0","P-10900V-15.0.0.0.0"],"known_not_affected":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10900V-15.0.0.0.0","P-10900V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU403"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}]},{"cve":"CVE-2026-2921","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39416135"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (gstreamer)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle JavaFX accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-2950","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"39790206"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Lodash)).   The supported version that is affected is 7.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-31789","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39362143"},{"system_name":"Oracle Bug ID of Oracle Autonomous Health Framework","text":"40013468"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Visual Analyzer (OpenSSL)).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in Oracle Autonomous Health Framework (component: AHFCOMMON (OpenSSL)).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Autonomous Health Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Autonomous Health Framework accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0","P-14634V-26.3-26.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14634V-26.3-26.8"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-31790","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39362143"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"},{"system_name":"Oracle Bug ID of Oracle Autonomous Health Framework","text":"40013468"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Visual Analyzer (OpenSSL)).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in Oracle Autonomous Health Framework (component: AHFCOMMON (OpenSSL)).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Autonomous Health Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Autonomous Health Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-2025V-8.2.0.0.0","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-2025V-26.01.0.0.0","P-4629V-9.7.0-9.7.3","P-14634V-26.3-26.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14634V-26.3-26.8"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"]}]},{"cve":"CVE-2026-3219","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39953623"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server (pip)).  Supported versions that are affected are 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Billing and Revenue Management accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"}]},{"cve":"CVE-2026-32327","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40058726"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Portable Runtime)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"products":["P-14597V-6.1.1-7.0.0"]}]},{"cve":"CVE-2026-32762","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-33227","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39894835"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Apache ActiveMQ)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2026-33466","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-33701","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Binding Support Function","text":"40044535"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Binding Support Function product of Oracle Communications (component: Configuration (glibc)).   The supported version that is affected is 25.2.201. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications Cloud Native Core Binding Support Function.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Binding Support Function.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14121V-25.2.201"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14121V-25.2.201"],"url":"https://support.oracle.com/support/?documentId=CPU401"}]},{"cve":"CVE-2026-3381","ids":[{"system_name":"Oracle Bug ID of Oracle Fusion Middleware","text":"39400046"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Fusion Middleware (component: Centralized Thirdparty Jars (Perl)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Fusion Middleware.  Successful attacks of this vulnerability can result in takeover of Oracle Fusion Middleware.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1032V-12.2.1.4.0","P-1032V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1032V-12.2.1.4.0","P-1032V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-33870","ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"40024514"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Netty)).  Supported versions that are affected are 19.1.0.0.0-19.1.0.0.16. Easily exploitable vulnerability allows low privileged attacker with network access via TLS to compromise Oracle GoldenGate Stream Analytics.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle GoldenGate Stream Analytics.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-19.1.0.0.0-19.1.0.0.16"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-19.1.0.0.0-19.1.0.0.16"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-33937","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39384806"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Database Actions (handlebars)).  Supported versions that are affected are 24.2.0-26.2.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle REST Data Services executes to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.2.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.2.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-33938","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39384806"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Database Actions (handlebars)).  Supported versions that are affected are 24.2.0-26.2.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle REST Data Services executes to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.2.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.2.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-33939","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39384806"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Database Actions (handlebars)).  Supported versions that are affected are 24.2.0-26.2.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle REST Data Services executes to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.2.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.2.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-33940","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39384806"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Database Actions (handlebars)).  Supported versions that are affected are 24.2.0-26.2.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle REST Data Services executes to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.2.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.2.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-33941","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39384806"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Database Actions (handlebars)).  Supported versions that are affected are 24.2.0-26.2.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle REST Data Services executes to compromise Oracle REST Data Services.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.2.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.2.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-9456V-24.2.0-26.2.1"]}]},{"cve":"CVE-2026-34073","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068780"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (pyca-cryptography)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-34180","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"},{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39442783"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068780"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security (OpenSSL)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (pyca-cryptography)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-5085V-8.61-8.63","P-4629V-9.7.0-9.7.3","P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-34181","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39442783"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security (OpenSSL)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-34182","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"},{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39442783"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security (OpenSSL)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-5085V-8.61-8.63","P-4629V-9.7.0-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-34183","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39442783"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security (OpenSSL)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-34230","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-34355","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications Policy Management","text":"39692059"},{"system_name":"Oracle Bug ID of Oracle Secure Backup","text":"39692067"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"39692055"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Automated Test Suite Framework (Apache HTTP Server)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Policy Management product of Oracle Communications (component: CMP (Apache HTTP Server)).  Supported versions that are affected are 15.0.0.0.0 and  15.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Policy Management.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle Secure Backup (component: Secure Backup (Apache HTTP Server)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200","P-10900V-15.1.0.0.0","P-10900V-15.0.0.0.0"],"known_not_affected":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10900V-15.0.0.0.0","P-10900V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU403"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}]},{"cve":"CVE-2026-34356","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications Policy Management","text":"39692059"},{"system_name":"Oracle Bug ID of Oracle Secure Backup","text":"39692067"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"39692055"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Automated Test Suite Framework (Apache HTTP Server)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Policy Management product of Oracle Communications (component: CMP (Apache HTTP Server)).  Supported versions that are affected are 15.0.0.0.0 and  15.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Policy Management.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle Secure Backup (component: Secure Backup (Apache HTTP Server)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200","P-10900V-15.1.0.0.0","P-10900V-15.0.0.0.0"],"known_not_affected":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10900V-15.0.0.0.0","P-10900V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU403"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}]},{"cve":"CVE-2026-34477","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39399045"},{"system_name":"Oracle Bug ID of Oracle SQL Developer","text":"39399134"},{"system_name":"Oracle Bug ID of Siebel CRM Development","text":"39689129"},{"system_name":"Oracle Bug ID of Oracle Hospitality OPERA 5 Property Services","text":"39399054"},{"system_name":"Oracle Bug ID of Oracle Communications EAGLE Element Management System","text":"39398940"},{"system_name":"Oracle Bug ID of Oracle Retail Merchandise Financial Planning","text":"39399104"},{"system_name":"Oracle Bug ID of Oracle WebCenter Sites","text":"39281797"},{"system_name":"Oracle Bug ID of Oracle Retail Merchandising System","text":"39399105"},{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39760530"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites (Apache Log4j)).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle WebCenter Sites.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE Element Management System product of Oracle Communications (component: Security (Apache Log4j)).   The supported version that is affected is 47.0.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE Element Management System.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications EAGLE Element Management System accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Apache Log4j)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: OPERA Login (Apache Log4j)).   The supported version that is affected is 5.6.28.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality OPERA 5 Property Services accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Merchandise Financial Planning product of Oracle Retail Applications (component: Application Core (Apache Log4j)).  Supported versions that are affected are 15.0 and  16.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Merchandise Financial Planning.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Retail Merchandise Financial Planning accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Merchandising System product of Oracle Retail Applications (component: Security (Apache Log4j)).   The supported version that is affected is 19.0.1.044. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Merchandising System.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Retail Merchandising System accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle SQL Developer (component: Installation (Apache Log4j)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval Manager (Apache Log4j)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via SYSLOG to compromise Siebel CRM Development.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Development accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface (Apache Tomcat)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-11580V-5.6.28.2","P-9001V-17.0-26.9","P-9617V-12.2.1.4.0","P-11125V-47.0.0.2.0","P-1816V-19.0.1.044","P-1814V-16.0","P-1814V-15.0","P-9019V-17.0-26.9"],"known_not_affected":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9617V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11125V-47.0.0.2.0"],"url":"https://support.oracle.com/support/?documentId=CPU399"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11580V-5.6.28.2"],"url":"https://support.oracle.com/support/?documentId=CPU379"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1816V-19.0.1.044","P-1814V-16.0","P-1814V-15.0"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9001V-17.0-26.9","P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-9617V-12.2.1.4.0"]},{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2026-34478","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39399045"},{"system_name":"Oracle Bug ID of Oracle SQL Developer","text":"39399134"},{"system_name":"Oracle Bug ID of Siebel CRM Development","text":"39689129"},{"system_name":"Oracle Bug ID of Oracle Hospitality OPERA 5 Property Services","text":"39399054"},{"system_name":"Oracle Bug ID of Oracle Communications EAGLE Element Management System","text":"39398940"},{"system_name":"Oracle Bug ID of Oracle Retail Merchandise Financial Planning","text":"39399104"},{"system_name":"Oracle Bug ID of Oracle Retail Merchandising System","text":"39399105"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE Element Management System product of Oracle Communications (component: Security (Apache Log4j)).   The supported version that is affected is 47.0.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE Element Management System.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications EAGLE Element Management System accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Apache Log4j)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: OPERA Login (Apache Log4j)).   The supported version that is affected is 5.6.28.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality OPERA 5 Property Services accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Merchandise Financial Planning product of Oracle Retail Applications (component: Application Core (Apache Log4j)).  Supported versions that are affected are 15.0 and  16.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Merchandise Financial Planning.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Retail Merchandise Financial Planning accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Merchandising System product of Oracle Retail Applications (component: Security (Apache Log4j)).   The supported version that is affected is 19.0.1.044. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Merchandising System.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Retail Merchandising System accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle SQL Developer (component: Installation (Apache Log4j)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval Manager (Apache Log4j)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via SYSLOG to compromise Siebel CRM Development.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Development accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-11580V-5.6.28.2","P-9001V-17.0-26.9","P-11125V-47.0.0.2.0","P-1816V-19.0.1.044","P-1814V-16.0","P-1814V-15.0"],"known_not_affected":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11125V-47.0.0.2.0"],"url":"https://support.oracle.com/support/?documentId=CPU399"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11580V-5.6.28.2"],"url":"https://support.oracle.com/support/?documentId=CPU379"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1816V-19.0.1.044","P-1814V-16.0","P-1814V-15.0"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9001V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2026-34479","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39399045"},{"system_name":"Oracle Bug ID of Oracle SQL Developer","text":"39399134"},{"system_name":"Oracle Bug ID of Oracle Hospitality OPERA 5 Property Services","text":"39399054"},{"system_name":"Oracle Bug ID of Oracle Communications EAGLE Element Management System","text":"39398940"},{"system_name":"Oracle Bug ID of Oracle Retail Merchandise Financial Planning","text":"39399104"},{"system_name":"Oracle Bug ID of Oracle Retail Merchandising System","text":"39399105"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE Element Management System product of Oracle Communications (component: Security (Apache Log4j)).   The supported version that is affected is 47.0.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE Element Management System.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications EAGLE Element Management System accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Apache Log4j)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: OPERA Login (Apache Log4j)).   The supported version that is affected is 5.6.28.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality OPERA 5 Property Services accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Merchandise Financial Planning product of Oracle Retail Applications (component: Application Core (Apache Log4j)).  Supported versions that are affected are 15.0 and  16.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Merchandise Financial Planning.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Retail Merchandise Financial Planning accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Merchandising System product of Oracle Retail Applications (component: Security (Apache Log4j)).   The supported version that is affected is 19.0.1.044. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Merchandising System.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Retail Merchandising System accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle SQL Developer (component: Installation (Apache Log4j)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1814V-16.0","P-1814V-15.0","P-11580V-5.6.28.2","P-11125V-47.0.0.2.0","P-1816V-19.0.1.044"],"known_not_affected":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11125V-47.0.0.2.0"],"url":"https://support.oracle.com/support/?documentId=CPU399"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11580V-5.6.28.2"],"url":"https://support.oracle.com/support/?documentId=CPU379"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1816V-19.0.1.044","P-1814V-16.0","P-1814V-15.0"],"url":"https://support.oracle.com/support/?documentId=CPU369"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2026-34480","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39399045"},{"system_name":"Oracle Bug ID of Oracle SQL Developer","text":"39399134"},{"system_name":"Oracle Bug ID of Siebel CRM Development","text":"39689129"},{"system_name":"Oracle Bug ID of Oracle Hospitality OPERA 5 Property Services","text":"39399054"},{"system_name":"Oracle Bug ID of Oracle Communications EAGLE Element Management System","text":"39398940"},{"system_name":"Oracle Bug ID of Oracle Retail Merchandise Financial Planning","text":"39399104"},{"system_name":"Oracle Bug ID of Oracle Retail Merchandising System","text":"39399105"},{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39760530"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE Element Management System product of Oracle Communications (component: Security (Apache Log4j)).   The supported version that is affected is 47.0.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE Element Management System.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications EAGLE Element Management System accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Apache Log4j)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: OPERA Login (Apache Log4j)).   The supported version that is affected is 5.6.28.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality OPERA 5 Property Services accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Merchandise Financial Planning product of Oracle Retail Applications (component: Application Core (Apache Log4j)).  Supported versions that are affected are 15.0 and  16.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Merchandise Financial Planning.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Retail Merchandise Financial Planning accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Merchandising System product of Oracle Retail Applications (component: Security (Apache Log4j)).   The supported version that is affected is 19.0.1.044. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Merchandising System.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Retail Merchandising System accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle SQL Developer (component: Installation (Apache Log4j)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval Manager (Apache Log4j)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via SYSLOG to compromise Siebel CRM Development.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Development accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface (Apache Tomcat)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-11580V-5.6.28.2","P-9001V-17.0-26.9","P-11125V-47.0.0.2.0","P-1816V-19.0.1.044","P-1814V-16.0","P-1814V-15.0","P-9019V-17.0-26.9"],"known_not_affected":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11125V-47.0.0.2.0"],"url":"https://support.oracle.com/support/?documentId=CPU399"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11580V-5.6.28.2"],"url":"https://support.oracle.com/support/?documentId=CPU379"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1816V-19.0.1.044","P-1814V-16.0","P-1814V-15.0"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9001V-17.0-26.9","P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0"]},{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-9001V-17.0-26.9"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2026-34481","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39399045"},{"system_name":"Oracle Bug ID of Oracle SQL Developer","text":"39399134"},{"system_name":"Oracle Bug ID of Oracle Hospitality OPERA 5 Property Services","text":"39399054"},{"system_name":"Oracle Bug ID of Oracle Communications EAGLE Element Management System","text":"39398940"},{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39860594"},{"system_name":"Oracle Bug ID of Oracle Retail Merchandise Financial Planning","text":"39399104"},{"system_name":"Oracle Bug ID of Oracle Retail Merchandising System","text":"39399105"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE Element Management System product of Oracle Communications (component: Security (Apache Log4j)).   The supported version that is affected is 47.0.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE Element Management System.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications EAGLE Element Management System accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Apache Log4j)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: OPERA Login (Apache Log4j)).   The supported version that is affected is 5.6.28.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality OPERA 5 Property Services.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Hospitality OPERA 5 Property Services accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Merchandise Financial Planning product of Oracle Retail Applications (component: Application Core (Apache Log4j)).  Supported versions that are affected are 15.0 and  16.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Merchandise Financial Planning.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Retail Merchandise Financial Planning accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Merchandising System product of Oracle Retail Applications (component: Security (Apache Log4j)).   The supported version that is affected is 19.0.1.044. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Merchandising System.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Retail Merchandising System accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle SQL Developer (component: Installation (Apache Log4j)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (Apache Log4j)).   The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Platform accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1814V-16.0","P-9348V-11.4.0","P-1814V-15.0","P-11580V-5.6.28.2","P-11125V-47.0.0.2.0","P-1816V-19.0.1.044"],"known_not_affected":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11125V-47.0.0.2.0"],"url":"https://support.oracle.com/support/?documentId=CPU399"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11580V-5.6.28.2"],"url":"https://support.oracle.com/support/?documentId=CPU379"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1816V-19.0.1.044","P-1814V-16.0","P-1814V-15.0"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-11580V-5.6.28.2","P-11125V-47.0.0.2.0","P-1816V-19.0.1.044","P-1814V-16.0","P-1814V-15.0"]},{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-1875(Oracle SQL Developer_Installation)V-23.1.1-26.1.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2026-34483","ids":[{"system_name":"Oracle Bug ID of Oracle Communications EAGLE Element Management System","text":"39261455"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE Element Management System product of Oracle Communications (component: Security (Apache Tomcat)).   The supported version that is affected is 47.0.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE Element Management System.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications EAGLE Element Management System accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-11125V-47.0.0.2.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11125V-47.0.0.2.0"],"url":"https://support.oracle.com/support/?documentId=CPU399"}]},{"cve":"CVE-2026-34486","ids":[{"system_name":"Oracle Bug ID of Oracle Communications EAGLE Element Management System","text":"39261455"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE Element Management System product of Oracle Communications (component: Security (Apache Tomcat)).   The supported version that is affected is 47.0.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE Element Management System.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications EAGLE Element Management System accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-11125V-47.0.0.2.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11125V-47.0.0.2.0"],"url":"https://support.oracle.com/support/?documentId=CPU399"}]},{"cve":"CVE-2026-34487","ids":[{"system_name":"Oracle Bug ID of Oracle Communications EAGLE Element Management System","text":"39261455"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE Element Management System product of Oracle Communications (component: Security (Apache Tomcat)).   The supported version that is affected is 47.0.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE Element Management System.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications EAGLE Element Management System accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-11125V-47.0.0.2.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11125V-47.0.0.2.0"],"url":"https://support.oracle.com/support/?documentId=CPU399"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-11125V-47.0.0.2.0"]}]},{"cve":"CVE-2026-34500","ids":[{"system_name":"Oracle Bug ID of Oracle Communications EAGLE Element Management System","text":"39261455"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE Element Management System product of Oracle Communications (component: Security (Apache Tomcat)).   The supported version that is affected is 47.0.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE Element Management System.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications EAGLE Element Management System accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-11125V-47.0.0.2.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11125V-47.0.0.2.0"],"url":"https://support.oracle.com/support/?documentId=CPU399"}]},{"cve":"CVE-2026-34502","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40058726"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Portable Runtime)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-34763","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-34785","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-34786","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-34826","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-34827","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-34829","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-34830","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-34831","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-34835","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-3783","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-3784","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-3805","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-39044","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39416135"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (gstreamer)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle JavaFX accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-39304","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39894835"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Apache ActiveMQ)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2026-39822","ids":[{"system_name":"Oracle Bug ID of Oracle TimesTen In-Memory Database","text":"39818301"}],"notes":[{"category":"description","text":"Vulnerability in Oracle TimesTen In-Memory Database (component: EM TimesTen plug-in (Golang Go)).  Supported versions that are affected are 26.1-26.1.1.3.0 and   22.1-22.1.1.41.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle TimesTen In-Memory Database executes to compromise Oracle TimesTen In-Memory Database.  Successful attacks of this vulnerability can result in takeover of Oracle TimesTen In-Memory Database. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1870V-26.1-26.1.1.3.0","P-1870V-22.1-22.1.1.41.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1870V-26.1-26.1.1.3.0","P-1870V-22.1-22.1.1.41.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1870V-26.1-26.1.1.3.0","P-1870V-22.1-22.1.1.41.0"]}]},{"cve":"CVE-2026-39872","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-39892","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068780"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (pyca-cryptography)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-14597V-6.1.1-7.0.0"]}]},{"cve":"CVE-2026-40542","ids":[{"system_name":"Oracle Bug ID of Oracle SQLcl (Apache HttpComponents)","text":"39880633"},{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39663555"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure (Apache HttpClient)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data as well as  unauthorized read access to a subset of Siebel CRM Deployment accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle SQLcl (Apache HttpComponents) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32, 21.3-21.23 and  23.4.0-23.26.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SQLcl (Apache HttpComponents).  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle SQLcl (Apache HttpComponents).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9","P-13824V-21.3-21.23","P-13824V-19.3-19.32","P-13824V-23.4.0-23.26.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13824V-21.3-21.23","P-13824V-23.4.0-23.26.3","P-13824V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-40992","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40039566"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Spring Boot)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications Unified Assurance accessible data as well as  unauthorized read access to a subset of Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41001","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40039566"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Spring Boot)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications Unified Assurance accessible data as well as  unauthorized read access to a subset of Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Unified Assurance. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-14597V-6.1.1-7.0.0"]}]},{"cve":"CVE-2026-41238","ids":[{"system_name":"Oracle Bug ID of Oracle Utilities Application Framework","text":"39822337"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: Security (DOMPurify)).  Supported versions that are affected are 4.4.0.2.0, 4.4.0.3.0, 4.4.0.4.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 4.5.0.2.0, 25.4, 25.10, 26.4 and  26.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Application Framework.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Utilities Application Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Utilities Application Framework accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU370"}]},{"cve":"CVE-2026-41239","ids":[{"system_name":"Oracle Bug ID of Oracle Utilities Application Framework","text":"39822337"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: Security (DOMPurify)).  Supported versions that are affected are 4.4.0.2.0, 4.4.0.3.0, 4.4.0.4.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 4.5.0.2.0, 25.4, 25.10, 26.4 and  26.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Application Framework.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Utilities Application Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Utilities Application Framework accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU370"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"]}]},{"cve":"CVE-2026-41284","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068469"},{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39760530"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface (Apache Tomcat)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (Apache Tomcat)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0","P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41409","ids":[{"system_name":"Oracle Bug ID of Oracle Managed File Transfer","text":"39877573"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server (Apache Mina)).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Managed File Transfer.  Successful attacks of this vulnerability can result in takeover of Oracle Managed File Transfer.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10198V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10198V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-41417","ids":[{"system_name":"Oracle Bug ID of Oracle Utilities Network Management System","text":"39429006"},{"system_name":"Oracle Bug ID of Oracle NoSQL Database","text":"39429000"}],"notes":[{"category":"description","text":"Vulnerability in Oracle NoSQL Database (component: Administration (Netty)).  Supported versions that are affected are 23.3.41,   24.4.14 and   25.3.24. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle NoSQL Database.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle NoSQL Database.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Third Party (Netty)).  Supported versions that are affected are 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.9 and  25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle Utilities Network Management System.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Network Management System.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-13373V-24.4.14","P-13373V-23.3.41","P-2241V-2.6.0.1.0-2.6.0.1.12","P-13373V-25.3.24","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13373V-24.4.14","P-13373V-23.3.41","P-13373V-25.3.24"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-2241V-2.6.0.1.0-2.6.0.1.12","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"],"url":"https://support.oracle.com/support/?documentId=CPU370"}]},{"cve":"CVE-2026-41602","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41604","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41605","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41606","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41607","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41608","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41635","ids":[{"system_name":"Oracle Bug ID of Oracle Managed File Transfer","text":"39877573"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server (Apache Mina)).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Managed File Transfer.  Successful attacks of this vulnerability can result in takeover of Oracle Managed File Transfer. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10198V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10198V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-10198V-12.2.1.4.0"]}]},{"cve":"CVE-2026-41636","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-4176","ids":[{"system_name":"Oracle Bug ID of Oracle Fusion Middleware","text":"39400046"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"39861227"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Fusion Middleware (component: Centralized Thirdparty Jars (Perl)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Fusion Middleware.  Successful attacks of this vulnerability can result in takeover of Oracle Fusion Middleware. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Perl)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1032V-12.2.1.4.0","P-14597V-6.1.1-7.0.0","P-1032V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1032V-12.2.1.4.0","P-1032V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1032V-12.2.1.4.0","P-1032V-14.1.2.0.0"]}]},{"cve":"CVE-2026-41838","ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39562570"},{"system_name":"Oracle Bug ID of Oracle Healthcare Data Repository","text":"39562550"},{"system_name":"Oracle Bug ID of Primavera Gateway","text":"39562572"},{"system_name":"Oracle Bug ID of Oracle Financial Services Analytical Applications Infrastructure","text":"39562540"},{"system_name":"Oracle Bug ID of Oracle Healthcare Master Person Index","text":"39562551"},{"system_name":"Oracle Bug ID of Oracle Financial Services Behavior Detection Platform","text":"39562541"},{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39562552"},{"system_name":"Oracle Bug ID of Oracle Retail Predictive Application Server","text":"39562564"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39562499"},{"system_name":"Oracle Bug ID of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition","text":"39562546"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038132"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Thirdparty Patch (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Others (Spring Framework)).  Supported versions that are affected are 8.0.7.9, 8.0.8.7, 8.1.2.5 and  8.1.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Third Party (Spring Framework)).  Supported versions that are affected are 8.0.8.1, 8.1.2.11 and  8.1.2.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Behavior Detection Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Behavior Detection Platform.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition product of Oracle Financial Services Applications (component: User Interface (Spring Framework)).   The supported version that is affected is 8.0.8.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Data Repository product of Oracle HealthCare Applications (component: FHIR Server (Spring Framework)).  Supported versions that are affected are 8.2.0.0-8.2.0.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Data Repository.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Data Repository.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Master Person Index product of Oracle HealthCare Applications (component: Master Index Data Manager (Spring Framework)).  Supported versions that are affected are 5.0.0.0-5.0.9.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Master Person Index.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Master Person Index.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer (Spring Framework)).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Predictive Application Server product of Oracle Retail Applications (component: RPAS Server (Spring Framework)).  Supported versions that are affected are 15.0.3.190 and  16.0.3.350. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Predictive Application Server.  Successful attacks of this vulnerability can result in takeover of Oracle Retail Predictive Application Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin (Spring Framework)).  Supported versions that are affected are 21.12.0-21.12.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway.  Successful attacks of this vulnerability can result in takeover of Primavera Gateway.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Spring Framework)).  Supported versions that are affected are 6.1.1-7.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1823V-16.0.3.350","P-1823V-15.0.3.190","P-9190V-8.1.2.12","P-9190V-8.1.2.11","P-1980V-12.2.1.4.0","P-9190V-8.0.8.1","P-5242V-12.2.1.4.0","P-14597V-6.1.1-7.0.0","P-4647V-14.1.2.0.0","P-5242V-14.1.2.0.0","P-8575V-5.0.0.0-5.0.9.7","P-10354V-24.12.0-24.12.16","P-5680V-8.1.2.5","P-5242V-15.1.1.0.0","P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-5680V-8.1.2.6","P-9161V-8.2.0.0-8.2.0.8","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5680V-8.0.7.9","P-5680V-8.0.8.7","P-13789V-8.0.8.0","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-1980V-12.2.1.4.0","P-4647V-14.1.2.0.0","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5680V-8.1.2.5","P-5680V-8.1.2.6","P-5680V-8.0.7.9","P-5680V-8.0.8.7"],"url":"https://support.oracle.com/support/?documentId=CPU421"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9190V-8.0.8.1","P-9190V-8.1.2.12","P-9190V-8.1.2.11"],"url":"https://support.oracle.com/support/?documentId=CPU389"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13789V-8.0.8.0"],"url":"https://support.oracle.com/support/?documentId=CPU390"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9161V-8.2.0.0-8.2.0.8","P-8575V-5.0.0.0-5.0.9.7"],"url":"https://support.oracle.com/support/?documentId=CPU377"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1823V-16.0.3.350","P-1823V-15.0.3.190"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41839","ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39562570"},{"system_name":"Oracle Bug ID of Oracle Healthcare Data Repository","text":"39562550"},{"system_name":"Oracle Bug ID of Primavera Gateway","text":"39562572"},{"system_name":"Oracle Bug ID of Oracle Financial Services Analytical Applications Infrastructure","text":"39562540"},{"system_name":"Oracle Bug ID of Oracle Healthcare Master Person Index","text":"39562551"},{"system_name":"Oracle Bug ID of Oracle Financial Services Behavior Detection Platform","text":"39562541"},{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39562552"},{"system_name":"Oracle Bug ID of Oracle Retail Predictive Application Server","text":"39562564"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39562499"},{"system_name":"Oracle Bug ID of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition","text":"39562546"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038132"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Thirdparty Patch (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Others (Spring Framework)).  Supported versions that are affected are 8.0.7.9, 8.0.8.7, 8.1.2.5 and  8.1.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Third Party (Spring Framework)).  Supported versions that are affected are 8.0.8.1, 8.1.2.11 and  8.1.2.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Behavior Detection Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Behavior Detection Platform.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition product of Oracle Financial Services Applications (component: User Interface (Spring Framework)).   The supported version that is affected is 8.0.8.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Data Repository product of Oracle HealthCare Applications (component: FHIR Server (Spring Framework)).  Supported versions that are affected are 8.2.0.0-8.2.0.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Data Repository.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Data Repository.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Master Person Index product of Oracle HealthCare Applications (component: Master Index Data Manager (Spring Framework)).  Supported versions that are affected are 5.0.0.0-5.0.9.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Master Person Index.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Master Person Index.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer (Spring Framework)).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Predictive Application Server product of Oracle Retail Applications (component: RPAS Server (Spring Framework)).  Supported versions that are affected are 15.0.3.190 and  16.0.3.350. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Predictive Application Server.  Successful attacks of this vulnerability can result in takeover of Oracle Retail Predictive Application Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin (Spring Framework)).  Supported versions that are affected are 21.12.0-21.12.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway.  Successful attacks of this vulnerability can result in takeover of Primavera Gateway.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Spring Framework)).  Supported versions that are affected are 6.1.1-7.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1823V-16.0.3.350","P-1823V-15.0.3.190","P-9190V-8.1.2.12","P-9190V-8.1.2.11","P-1980V-12.2.1.4.0","P-9190V-8.0.8.1","P-5242V-12.2.1.4.0","P-14597V-6.1.1-7.0.0","P-4647V-14.1.2.0.0","P-5242V-14.1.2.0.0","P-8575V-5.0.0.0-5.0.9.7","P-10354V-24.12.0-24.12.16","P-5680V-8.1.2.5","P-5242V-15.1.1.0.0","P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-5680V-8.1.2.6","P-9161V-8.2.0.0-8.2.0.8","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5680V-8.0.7.9","P-5680V-8.0.8.7","P-13789V-8.0.8.0","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-1980V-12.2.1.4.0","P-4647V-14.1.2.0.0","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5680V-8.1.2.5","P-5680V-8.1.2.6","P-5680V-8.0.7.9","P-5680V-8.0.8.7"],"url":"https://support.oracle.com/support/?documentId=CPU421"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9190V-8.0.8.1","P-9190V-8.1.2.12","P-9190V-8.1.2.11"],"url":"https://support.oracle.com/support/?documentId=CPU389"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13789V-8.0.8.0"],"url":"https://support.oracle.com/support/?documentId=CPU390"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9161V-8.2.0.0-8.2.0.8","P-8575V-5.0.0.0-5.0.9.7"],"url":"https://support.oracle.com/support/?documentId=CPU377"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1823V-16.0.3.350","P-1823V-15.0.3.190"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41840","ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39562570"},{"system_name":"Oracle Bug ID of Oracle Healthcare Data Repository","text":"39562550"},{"system_name":"Oracle Bug ID of Primavera Gateway","text":"39562572"},{"system_name":"Oracle Bug ID of Oracle Financial Services Analytical Applications Infrastructure","text":"39562540"},{"system_name":"Oracle Bug ID of Oracle Healthcare Master Person Index","text":"39562551"},{"system_name":"Oracle Bug ID of Oracle Financial Services Behavior Detection Platform","text":"39562541"},{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39562552"},{"system_name":"Oracle Bug ID of Oracle Retail Predictive Application Server","text":"39562564"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39562499"},{"system_name":"Oracle Bug ID of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition","text":"39562546"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038132"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Thirdparty Patch (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Others (Spring Framework)).  Supported versions that are affected are 8.0.7.9, 8.0.8.7, 8.1.2.5 and  8.1.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Third Party (Spring Framework)).  Supported versions that are affected are 8.0.8.1, 8.1.2.11 and  8.1.2.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Behavior Detection Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Behavior Detection Platform.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition product of Oracle Financial Services Applications (component: User Interface (Spring Framework)).   The supported version that is affected is 8.0.8.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Data Repository product of Oracle HealthCare Applications (component: FHIR Server (Spring Framework)).  Supported versions that are affected are 8.2.0.0-8.2.0.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Data Repository.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Data Repository.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Master Person Index product of Oracle HealthCare Applications (component: Master Index Data Manager (Spring Framework)).  Supported versions that are affected are 5.0.0.0-5.0.9.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Master Person Index.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Master Person Index.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer (Spring Framework)).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Predictive Application Server product of Oracle Retail Applications (component: RPAS Server (Spring Framework)).  Supported versions that are affected are 15.0.3.190 and  16.0.3.350. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Predictive Application Server.  Successful attacks of this vulnerability can result in takeover of Oracle Retail Predictive Application Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin (Spring Framework)).  Supported versions that are affected are 21.12.0-21.12.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway.  Successful attacks of this vulnerability can result in takeover of Primavera Gateway.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Spring Framework)).  Supported versions that are affected are 6.1.1-7.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1823V-16.0.3.350","P-1823V-15.0.3.190","P-9190V-8.1.2.12","P-9190V-8.1.2.11","P-1980V-12.2.1.4.0","P-9190V-8.0.8.1","P-5242V-12.2.1.4.0","P-14597V-6.1.1-7.0.0","P-4647V-14.1.2.0.0","P-5242V-14.1.2.0.0","P-8575V-5.0.0.0-5.0.9.7","P-10354V-24.12.0-24.12.16","P-5680V-8.1.2.5","P-5242V-15.1.1.0.0","P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-5680V-8.1.2.6","P-9161V-8.2.0.0-8.2.0.8","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5680V-8.0.7.9","P-5680V-8.0.8.7","P-13789V-8.0.8.0","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-1980V-12.2.1.4.0","P-4647V-14.1.2.0.0","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5680V-8.1.2.5","P-5680V-8.1.2.6","P-5680V-8.0.7.9","P-5680V-8.0.8.7"],"url":"https://support.oracle.com/support/?documentId=CPU421"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9190V-8.0.8.1","P-9190V-8.1.2.12","P-9190V-8.1.2.11"],"url":"https://support.oracle.com/support/?documentId=CPU389"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13789V-8.0.8.0"],"url":"https://support.oracle.com/support/?documentId=CPU390"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9161V-8.2.0.0-8.2.0.8","P-8575V-5.0.0.0-5.0.9.7"],"url":"https://support.oracle.com/support/?documentId=CPU377"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1823V-16.0.3.350","P-1823V-15.0.3.190"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41841","ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39562570"},{"system_name":"Oracle Bug ID of Oracle Healthcare Data Repository","text":"39562550"},{"system_name":"Oracle Bug ID of Primavera Gateway","text":"39562572"},{"system_name":"Oracle Bug ID of Oracle Financial Services Analytical Applications Infrastructure","text":"39562540"},{"system_name":"Oracle Bug ID of Oracle Healthcare Master Person Index","text":"39562551"},{"system_name":"Oracle Bug ID of Oracle Financial Services Behavior Detection Platform","text":"39562541"},{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39562552"},{"system_name":"Oracle Bug ID of Oracle Retail Predictive Application Server","text":"39562564"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39562499"},{"system_name":"Oracle Bug ID of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition","text":"39562546"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038132"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Thirdparty Patch (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Others (Spring Framework)).  Supported versions that are affected are 8.0.7.9, 8.0.8.7, 8.1.2.5 and  8.1.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Third Party (Spring Framework)).  Supported versions that are affected are 8.0.8.1, 8.1.2.11 and  8.1.2.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Behavior Detection Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Behavior Detection Platform.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition product of Oracle Financial Services Applications (component: User Interface (Spring Framework)).   The supported version that is affected is 8.0.8.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Data Repository product of Oracle HealthCare Applications (component: FHIR Server (Spring Framework)).  Supported versions that are affected are 8.2.0.0-8.2.0.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Data Repository.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Data Repository.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Master Person Index product of Oracle HealthCare Applications (component: Master Index Data Manager (Spring Framework)).  Supported versions that are affected are 5.0.0.0-5.0.9.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Master Person Index.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Master Person Index.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer (Spring Framework)).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Predictive Application Server product of Oracle Retail Applications (component: RPAS Server (Spring Framework)).  Supported versions that are affected are 15.0.3.190 and  16.0.3.350. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Predictive Application Server.  Successful attacks of this vulnerability can result in takeover of Oracle Retail Predictive Application Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin (Spring Framework)).  Supported versions that are affected are 21.12.0-21.12.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway.  Successful attacks of this vulnerability can result in takeover of Primavera Gateway.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Spring Framework)).  Supported versions that are affected are 6.1.1-7.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1823V-16.0.3.350","P-1823V-15.0.3.190","P-9190V-8.1.2.12","P-9190V-8.1.2.11","P-1980V-12.2.1.4.0","P-9190V-8.0.8.1","P-5242V-12.2.1.4.0","P-14597V-6.1.1-7.0.0","P-4647V-14.1.2.0.0","P-5242V-14.1.2.0.0","P-8575V-5.0.0.0-5.0.9.7","P-10354V-24.12.0-24.12.16","P-5680V-8.1.2.5","P-5242V-15.1.1.0.0","P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-5680V-8.1.2.6","P-9161V-8.2.0.0-8.2.0.8","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5680V-8.0.7.9","P-5680V-8.0.8.7","P-13789V-8.0.8.0","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-1980V-12.2.1.4.0","P-4647V-14.1.2.0.0","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5680V-8.1.2.5","P-5680V-8.1.2.6","P-5680V-8.0.7.9","P-5680V-8.0.8.7"],"url":"https://support.oracle.com/support/?documentId=CPU421"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9190V-8.0.8.1","P-9190V-8.1.2.12","P-9190V-8.1.2.11"],"url":"https://support.oracle.com/support/?documentId=CPU389"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13789V-8.0.8.0"],"url":"https://support.oracle.com/support/?documentId=CPU390"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9161V-8.2.0.0-8.2.0.8","P-8575V-5.0.0.0-5.0.9.7"],"url":"https://support.oracle.com/support/?documentId=CPU377"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1823V-16.0.3.350","P-1823V-15.0.3.190"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41842","ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39562570"},{"system_name":"Oracle Bug ID of Oracle Healthcare Data Repository","text":"39562550"},{"system_name":"Oracle Bug ID of Primavera Gateway","text":"39562572"},{"system_name":"Oracle Bug ID of Oracle Financial Services Analytical Applications Infrastructure","text":"39562540"},{"system_name":"Oracle Bug ID of Oracle Healthcare Master Person Index","text":"39562551"},{"system_name":"Oracle Bug ID of Oracle Financial Services Behavior Detection Platform","text":"39562541"},{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39562552"},{"system_name":"Oracle Bug ID of Oracle Retail Predictive Application Server","text":"39562564"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39562499"},{"system_name":"Oracle Bug ID of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition","text":"39562546"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038132"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Thirdparty Patch (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Others (Spring Framework)).  Supported versions that are affected are 8.0.7.9, 8.0.8.7, 8.1.2.5 and  8.1.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Third Party (Spring Framework)).  Supported versions that are affected are 8.0.8.1, 8.1.2.11 and  8.1.2.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Behavior Detection Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Behavior Detection Platform.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition product of Oracle Financial Services Applications (component: User Interface (Spring Framework)).   The supported version that is affected is 8.0.8.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Data Repository product of Oracle HealthCare Applications (component: FHIR Server (Spring Framework)).  Supported versions that are affected are 8.2.0.0-8.2.0.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Data Repository.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Data Repository.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Master Person Index product of Oracle HealthCare Applications (component: Master Index Data Manager (Spring Framework)).  Supported versions that are affected are 5.0.0.0-5.0.9.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Master Person Index.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Master Person Index.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer (Spring Framework)).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Predictive Application Server product of Oracle Retail Applications (component: RPAS Server (Spring Framework)).  Supported versions that are affected are 15.0.3.190 and  16.0.3.350. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Predictive Application Server.  Successful attacks of this vulnerability can result in takeover of Oracle Retail Predictive Application Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin (Spring Framework)).  Supported versions that are affected are 21.12.0-21.12.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway.  Successful attacks of this vulnerability can result in takeover of Primavera Gateway.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Spring Framework)).  Supported versions that are affected are 6.1.1-7.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1823V-16.0.3.350","P-1823V-15.0.3.190","P-9190V-8.1.2.12","P-9190V-8.1.2.11","P-1980V-12.2.1.4.0","P-9190V-8.0.8.1","P-5242V-12.2.1.4.0","P-14597V-6.1.1-7.0.0","P-4647V-14.1.2.0.0","P-5242V-14.1.2.0.0","P-8575V-5.0.0.0-5.0.9.7","P-10354V-24.12.0-24.12.16","P-5680V-8.1.2.5","P-5242V-15.1.1.0.0","P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-5680V-8.1.2.6","P-9161V-8.2.0.0-8.2.0.8","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5680V-8.0.7.9","P-5680V-8.0.8.7","P-13789V-8.0.8.0","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-1980V-12.2.1.4.0","P-4647V-14.1.2.0.0","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5680V-8.1.2.5","P-5680V-8.1.2.6","P-5680V-8.0.7.9","P-5680V-8.0.8.7"],"url":"https://support.oracle.com/support/?documentId=CPU421"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9190V-8.0.8.1","P-9190V-8.1.2.12","P-9190V-8.1.2.11"],"url":"https://support.oracle.com/support/?documentId=CPU389"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13789V-8.0.8.0"],"url":"https://support.oracle.com/support/?documentId=CPU390"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9161V-8.2.0.0-8.2.0.8","P-8575V-5.0.0.0-5.0.9.7"],"url":"https://support.oracle.com/support/?documentId=CPU377"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1823V-16.0.3.350","P-1823V-15.0.3.190"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41843","ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39562570"},{"system_name":"Oracle Bug ID of Oracle Healthcare Data Repository","text":"39562550"},{"system_name":"Oracle Bug ID of Primavera Gateway","text":"39562572"},{"system_name":"Oracle Bug ID of Oracle Financial Services Analytical Applications Infrastructure","text":"39562540"},{"system_name":"Oracle Bug ID of Oracle Healthcare Master Person Index","text":"39562551"},{"system_name":"Oracle Bug ID of Oracle Financial Services Behavior Detection Platform","text":"39562541"},{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39562552"},{"system_name":"Oracle Bug ID of Oracle Retail Predictive Application Server","text":"39562564"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39562499"},{"system_name":"Oracle Bug ID of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition","text":"39562546"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038132"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Thirdparty Patch (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Others (Spring Framework)).  Supported versions that are affected are 8.0.7.9, 8.0.8.7, 8.1.2.5 and  8.1.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Third Party (Spring Framework)).  Supported versions that are affected are 8.0.8.1, 8.1.2.11 and  8.1.2.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Behavior Detection Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Behavior Detection Platform.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition product of Oracle Financial Services Applications (component: User Interface (Spring Framework)).   The supported version that is affected is 8.0.8.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Data Repository product of Oracle HealthCare Applications (component: FHIR Server (Spring Framework)).  Supported versions that are affected are 8.2.0.0-8.2.0.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Data Repository.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Data Repository.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Master Person Index product of Oracle HealthCare Applications (component: Master Index Data Manager (Spring Framework)).  Supported versions that are affected are 5.0.0.0-5.0.9.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Master Person Index.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Master Person Index.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer (Spring Framework)).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Predictive Application Server product of Oracle Retail Applications (component: RPAS Server (Spring Framework)).  Supported versions that are affected are 15.0.3.190 and  16.0.3.350. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Predictive Application Server.  Successful attacks of this vulnerability can result in takeover of Oracle Retail Predictive Application Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin (Spring Framework)).  Supported versions that are affected are 21.12.0-21.12.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway.  Successful attacks of this vulnerability can result in takeover of Primavera Gateway.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Spring Framework)).  Supported versions that are affected are 6.1.1-7.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1823V-16.0.3.350","P-1823V-15.0.3.190","P-9190V-8.1.2.12","P-9190V-8.1.2.11","P-1980V-12.2.1.4.0","P-9190V-8.0.8.1","P-5242V-12.2.1.4.0","P-14597V-6.1.1-7.0.0","P-4647V-14.1.2.0.0","P-5242V-14.1.2.0.0","P-8575V-5.0.0.0-5.0.9.7","P-10354V-24.12.0-24.12.16","P-5680V-8.1.2.5","P-5242V-15.1.1.0.0","P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-5680V-8.1.2.6","P-9161V-8.2.0.0-8.2.0.8","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5680V-8.0.7.9","P-5680V-8.0.8.7","P-13789V-8.0.8.0","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-1980V-12.2.1.4.0","P-4647V-14.1.2.0.0","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5680V-8.1.2.5","P-5680V-8.1.2.6","P-5680V-8.0.7.9","P-5680V-8.0.8.7"],"url":"https://support.oracle.com/support/?documentId=CPU421"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9190V-8.0.8.1","P-9190V-8.1.2.12","P-9190V-8.1.2.11"],"url":"https://support.oracle.com/support/?documentId=CPU389"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13789V-8.0.8.0"],"url":"https://support.oracle.com/support/?documentId=CPU390"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9161V-8.2.0.0-8.2.0.8","P-8575V-5.0.0.0-5.0.9.7"],"url":"https://support.oracle.com/support/?documentId=CPU377"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1823V-16.0.3.350","P-1823V-15.0.3.190"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41844","ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39562570"},{"system_name":"Oracle Bug ID of Oracle Healthcare Data Repository","text":"39562550"},{"system_name":"Oracle Bug ID of Primavera Gateway","text":"39562572"},{"system_name":"Oracle Bug ID of Oracle Financial Services Analytical Applications Infrastructure","text":"39562540"},{"system_name":"Oracle Bug ID of Oracle Healthcare Master Person Index","text":"39562551"},{"system_name":"Oracle Bug ID of Oracle Financial Services Behavior Detection Platform","text":"39562541"},{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39562552"},{"system_name":"Oracle Bug ID of Oracle Retail Predictive Application Server","text":"39562564"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39562499"},{"system_name":"Oracle Bug ID of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition","text":"39562546"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038132"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Thirdparty Patch (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Others (Spring Framework)).  Supported versions that are affected are 8.0.7.9, 8.0.8.7, 8.1.2.5 and  8.1.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Third Party (Spring Framework)).  Supported versions that are affected are 8.0.8.1, 8.1.2.11 and  8.1.2.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Behavior Detection Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Behavior Detection Platform.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition product of Oracle Financial Services Applications (component: User Interface (Spring Framework)).   The supported version that is affected is 8.0.8.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Data Repository product of Oracle HealthCare Applications (component: FHIR Server (Spring Framework)).  Supported versions that are affected are 8.2.0.0-8.2.0.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Data Repository.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Data Repository.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Master Person Index product of Oracle HealthCare Applications (component: Master Index Data Manager (Spring Framework)).  Supported versions that are affected are 5.0.0.0-5.0.9.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Master Person Index.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Master Person Index.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer (Spring Framework)).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Predictive Application Server product of Oracle Retail Applications (component: RPAS Server (Spring Framework)).  Supported versions that are affected are 15.0.3.190 and  16.0.3.350. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Predictive Application Server.  Successful attacks of this vulnerability can result in takeover of Oracle Retail Predictive Application Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin (Spring Framework)).  Supported versions that are affected are 21.12.0-21.12.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway.  Successful attacks of this vulnerability can result in takeover of Primavera Gateway.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Spring Framework)).  Supported versions that are affected are 6.1.1-7.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1823V-16.0.3.350","P-1823V-15.0.3.190","P-9190V-8.1.2.12","P-9190V-8.1.2.11","P-1980V-12.2.1.4.0","P-9190V-8.0.8.1","P-5242V-12.2.1.4.0","P-14597V-6.1.1-7.0.0","P-4647V-14.1.2.0.0","P-5242V-14.1.2.0.0","P-8575V-5.0.0.0-5.0.9.7","P-10354V-24.12.0-24.12.16","P-5680V-8.1.2.5","P-5242V-15.1.1.0.0","P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-5680V-8.1.2.6","P-9161V-8.2.0.0-8.2.0.8","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5680V-8.0.7.9","P-5680V-8.0.8.7","P-13789V-8.0.8.0","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-1980V-12.2.1.4.0","P-4647V-14.1.2.0.0","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5680V-8.1.2.5","P-5680V-8.1.2.6","P-5680V-8.0.7.9","P-5680V-8.0.8.7"],"url":"https://support.oracle.com/support/?documentId=CPU421"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9190V-8.0.8.1","P-9190V-8.1.2.12","P-9190V-8.1.2.11"],"url":"https://support.oracle.com/support/?documentId=CPU389"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13789V-8.0.8.0"],"url":"https://support.oracle.com/support/?documentId=CPU390"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9161V-8.2.0.0-8.2.0.8","P-8575V-5.0.0.0-5.0.9.7"],"url":"https://support.oracle.com/support/?documentId=CPU377"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1823V-16.0.3.350","P-1823V-15.0.3.190"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41845","ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39562570"},{"system_name":"Oracle Bug ID of Oracle Healthcare Data Repository","text":"39562550"},{"system_name":"Oracle Bug ID of Primavera Gateway","text":"39562572"},{"system_name":"Oracle Bug ID of Oracle Financial Services Analytical Applications Infrastructure","text":"39562540"},{"system_name":"Oracle Bug ID of Oracle Healthcare Master Person Index","text":"39562551"},{"system_name":"Oracle Bug ID of Oracle Financial Services Behavior Detection Platform","text":"39562541"},{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39562552"},{"system_name":"Oracle Bug ID of Oracle Retail Predictive Application Server","text":"39562564"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39562499"},{"system_name":"Oracle Bug ID of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition","text":"39562546"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038132"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Thirdparty Patch (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Others (Spring Framework)).  Supported versions that are affected are 8.0.7.9, 8.0.8.7, 8.1.2.5 and  8.1.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Third Party (Spring Framework)).  Supported versions that are affected are 8.0.8.1, 8.1.2.11 and  8.1.2.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Behavior Detection Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Behavior Detection Platform.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition product of Oracle Financial Services Applications (component: User Interface (Spring Framework)).   The supported version that is affected is 8.0.8.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Data Repository product of Oracle HealthCare Applications (component: FHIR Server (Spring Framework)).  Supported versions that are affected are 8.2.0.0-8.2.0.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Data Repository.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Data Repository.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Master Person Index product of Oracle HealthCare Applications (component: Master Index Data Manager (Spring Framework)).  Supported versions that are affected are 5.0.0.0-5.0.9.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Master Person Index.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Master Person Index.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer (Spring Framework)).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Predictive Application Server product of Oracle Retail Applications (component: RPAS Server (Spring Framework)).  Supported versions that are affected are 15.0.3.190 and  16.0.3.350. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Predictive Application Server.  Successful attacks of this vulnerability can result in takeover of Oracle Retail Predictive Application Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin (Spring Framework)).  Supported versions that are affected are 21.12.0-21.12.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway.  Successful attacks of this vulnerability can result in takeover of Primavera Gateway.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Spring Framework)).  Supported versions that are affected are 6.1.1-7.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1823V-16.0.3.350","P-1823V-15.0.3.190","P-9190V-8.1.2.12","P-9190V-8.1.2.11","P-1980V-12.2.1.4.0","P-9190V-8.0.8.1","P-5242V-12.2.1.4.0","P-14597V-6.1.1-7.0.0","P-4647V-14.1.2.0.0","P-5242V-14.1.2.0.0","P-8575V-5.0.0.0-5.0.9.7","P-10354V-24.12.0-24.12.16","P-5680V-8.1.2.5","P-5242V-15.1.1.0.0","P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-5680V-8.1.2.6","P-9161V-8.2.0.0-8.2.0.8","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5680V-8.0.7.9","P-5680V-8.0.8.7","P-13789V-8.0.8.0","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-1980V-12.2.1.4.0","P-4647V-14.1.2.0.0","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5680V-8.1.2.5","P-5680V-8.1.2.6","P-5680V-8.0.7.9","P-5680V-8.0.8.7"],"url":"https://support.oracle.com/support/?documentId=CPU421"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9190V-8.0.8.1","P-9190V-8.1.2.12","P-9190V-8.1.2.11"],"url":"https://support.oracle.com/support/?documentId=CPU389"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13789V-8.0.8.0"],"url":"https://support.oracle.com/support/?documentId=CPU390"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9161V-8.2.0.0-8.2.0.8","P-8575V-5.0.0.0-5.0.9.7"],"url":"https://support.oracle.com/support/?documentId=CPU377"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1823V-16.0.3.350","P-1823V-15.0.3.190"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41846","ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39562570"},{"system_name":"Oracle Bug ID of Oracle Healthcare Data Repository","text":"39562550"},{"system_name":"Oracle Bug ID of Primavera Gateway","text":"39562572"},{"system_name":"Oracle Bug ID of Oracle Financial Services Analytical Applications Infrastructure","text":"39562540"},{"system_name":"Oracle Bug ID of Oracle Healthcare Master Person Index","text":"39562551"},{"system_name":"Oracle Bug ID of Oracle Financial Services Behavior Detection Platform","text":"39562541"},{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39562552"},{"system_name":"Oracle Bug ID of Oracle Retail Predictive Application Server","text":"39562564"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39562499"},{"system_name":"Oracle Bug ID of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition","text":"39562546"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038132"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Thirdparty Patch (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Others (Spring Framework)).  Supported versions that are affected are 8.0.7.9, 8.0.8.7, 8.1.2.5 and  8.1.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Third Party (Spring Framework)).  Supported versions that are affected are 8.0.8.1, 8.1.2.11 and  8.1.2.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Behavior Detection Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Behavior Detection Platform.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition product of Oracle Financial Services Applications (component: User Interface (Spring Framework)).   The supported version that is affected is 8.0.8.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Data Repository product of Oracle HealthCare Applications (component: FHIR Server (Spring Framework)).  Supported versions that are affected are 8.2.0.0-8.2.0.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Data Repository.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Data Repository.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Master Person Index product of Oracle HealthCare Applications (component: Master Index Data Manager (Spring Framework)).  Supported versions that are affected are 5.0.0.0-5.0.9.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Master Person Index.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Master Person Index.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer (Spring Framework)).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Predictive Application Server product of Oracle Retail Applications (component: RPAS Server (Spring Framework)).  Supported versions that are affected are 15.0.3.190 and  16.0.3.350. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Predictive Application Server.  Successful attacks of this vulnerability can result in takeover of Oracle Retail Predictive Application Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin (Spring Framework)).  Supported versions that are affected are 21.12.0-21.12.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway.  Successful attacks of this vulnerability can result in takeover of Primavera Gateway.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Spring Framework)).  Supported versions that are affected are 6.1.1-7.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1823V-16.0.3.350","P-1823V-15.0.3.190","P-9190V-8.1.2.12","P-9190V-8.1.2.11","P-1980V-12.2.1.4.0","P-9190V-8.0.8.1","P-5242V-12.2.1.4.0","P-14597V-6.1.1-7.0.0","P-4647V-14.1.2.0.0","P-5242V-14.1.2.0.0","P-8575V-5.0.0.0-5.0.9.7","P-10354V-24.12.0-24.12.16","P-5680V-8.1.2.5","P-5242V-15.1.1.0.0","P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-5680V-8.1.2.6","P-9161V-8.2.0.0-8.2.0.8","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5680V-8.0.7.9","P-5680V-8.0.8.7","P-13789V-8.0.8.0","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-1980V-12.2.1.4.0","P-4647V-14.1.2.0.0","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5680V-8.1.2.5","P-5680V-8.1.2.6","P-5680V-8.0.7.9","P-5680V-8.0.8.7"],"url":"https://support.oracle.com/support/?documentId=CPU421"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9190V-8.0.8.1","P-9190V-8.1.2.12","P-9190V-8.1.2.11"],"url":"https://support.oracle.com/support/?documentId=CPU389"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13789V-8.0.8.0"],"url":"https://support.oracle.com/support/?documentId=CPU390"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9161V-8.2.0.0-8.2.0.8","P-8575V-5.0.0.0-5.0.9.7"],"url":"https://support.oracle.com/support/?documentId=CPU377"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1823V-16.0.3.350","P-1823V-15.0.3.190"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41847","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39562499"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Thirdparty Patch (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4647V-12.2.1.4.0","P-4647V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4647V-14.1.2.0.0","P-4647V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-41848","ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39562570"},{"system_name":"Oracle Bug ID of Oracle Healthcare Data Repository","text":"39562550"},{"system_name":"Oracle Bug ID of Primavera Gateway","text":"39562572"},{"system_name":"Oracle Bug ID of Oracle Financial Services Analytical Applications Infrastructure","text":"39562540"},{"system_name":"Oracle Bug ID of Oracle Healthcare Master Person Index","text":"39562551"},{"system_name":"Oracle Bug ID of Oracle Financial Services Behavior Detection Platform","text":"39562541"},{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39562552"},{"system_name":"Oracle Bug ID of Oracle Retail Predictive Application Server","text":"39562564"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39562499"},{"system_name":"Oracle Bug ID of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition","text":"39562546"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038132"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Thirdparty Patch (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Others (Spring Framework)).  Supported versions that are affected are 8.0.7.9, 8.0.8.7, 8.1.2.5 and  8.1.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Third Party (Spring Framework)).  Supported versions that are affected are 8.0.8.1, 8.1.2.11 and  8.1.2.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Behavior Detection Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Behavior Detection Platform.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition product of Oracle Financial Services Applications (component: User Interface (Spring Framework)).   The supported version that is affected is 8.0.8.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Data Repository product of Oracle HealthCare Applications (component: FHIR Server (Spring Framework)).  Supported versions that are affected are 8.2.0.0-8.2.0.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Data Repository.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Data Repository.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Master Person Index product of Oracle HealthCare Applications (component: Master Index Data Manager (Spring Framework)).  Supported versions that are affected are 5.0.0.0-5.0.9.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Master Person Index.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Master Person Index.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer (Spring Framework)).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Predictive Application Server product of Oracle Retail Applications (component: RPAS Server (Spring Framework)).  Supported versions that are affected are 15.0.3.190 and  16.0.3.350. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Predictive Application Server.  Successful attacks of this vulnerability can result in takeover of Oracle Retail Predictive Application Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin (Spring Framework)).  Supported versions that are affected are 21.12.0-21.12.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway.  Successful attacks of this vulnerability can result in takeover of Primavera Gateway.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Spring Framework)).  Supported versions that are affected are 6.1.1-7.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1823V-16.0.3.350","P-1823V-15.0.3.190","P-9190V-8.1.2.12","P-9190V-8.1.2.11","P-1980V-12.2.1.4.0","P-9190V-8.0.8.1","P-5242V-12.2.1.4.0","P-14597V-6.1.1-7.0.0","P-4647V-14.1.2.0.0","P-5242V-14.1.2.0.0","P-8575V-5.0.0.0-5.0.9.7","P-10354V-24.12.0-24.12.16","P-5680V-8.1.2.5","P-5242V-15.1.1.0.0","P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-5680V-8.1.2.6","P-9161V-8.2.0.0-8.2.0.8","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5680V-8.0.7.9","P-5680V-8.0.8.7","P-13789V-8.0.8.0","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-1980V-12.2.1.4.0","P-4647V-14.1.2.0.0","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5680V-8.1.2.5","P-5680V-8.1.2.6","P-5680V-8.0.7.9","P-5680V-8.0.8.7"],"url":"https://support.oracle.com/support/?documentId=CPU421"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9190V-8.0.8.1","P-9190V-8.1.2.12","P-9190V-8.1.2.11"],"url":"https://support.oracle.com/support/?documentId=CPU389"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13789V-8.0.8.0"],"url":"https://support.oracle.com/support/?documentId=CPU390"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9161V-8.2.0.0-8.2.0.8","P-8575V-5.0.0.0-5.0.9.7"],"url":"https://support.oracle.com/support/?documentId=CPU377"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1823V-16.0.3.350","P-1823V-15.0.3.190"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41849","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39562499"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Thirdparty Patch (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4647V-12.2.1.4.0","P-4647V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4647V-14.1.2.0.0","P-4647V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-41850","ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39562570"},{"system_name":"Oracle Bug ID of Oracle Healthcare Data Repository","text":"39562550"},{"system_name":"Oracle Bug ID of Primavera Gateway","text":"39562572"},{"system_name":"Oracle Bug ID of Oracle Financial Services Analytical Applications Infrastructure","text":"39562540"},{"system_name":"Oracle Bug ID of Oracle Healthcare Master Person Index","text":"39562551"},{"system_name":"Oracle Bug ID of Oracle Financial Services Behavior Detection Platform","text":"39562541"},{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39562552"},{"system_name":"Oracle Bug ID of Oracle Retail Predictive Application Server","text":"39562564"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39562499"},{"system_name":"Oracle Bug ID of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition","text":"39562546"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038132"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Thirdparty Patch (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Others (Spring Framework)).  Supported versions that are affected are 8.0.7.9, 8.0.8.7, 8.1.2.5 and  8.1.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Third Party (Spring Framework)).  Supported versions that are affected are 8.0.8.1, 8.1.2.11 and  8.1.2.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Behavior Detection Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Behavior Detection Platform.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition product of Oracle Financial Services Applications (component: User Interface (Spring Framework)).   The supported version that is affected is 8.0.8.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Data Repository product of Oracle HealthCare Applications (component: FHIR Server (Spring Framework)).  Supported versions that are affected are 8.2.0.0-8.2.0.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Data Repository.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Data Repository.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Master Person Index product of Oracle HealthCare Applications (component: Master Index Data Manager (Spring Framework)).  Supported versions that are affected are 5.0.0.0-5.0.9.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Master Person Index.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Master Person Index.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer (Spring Framework)).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Predictive Application Server product of Oracle Retail Applications (component: RPAS Server (Spring Framework)).  Supported versions that are affected are 15.0.3.190 and  16.0.3.350. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Predictive Application Server.  Successful attacks of this vulnerability can result in takeover of Oracle Retail Predictive Application Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin (Spring Framework)).  Supported versions that are affected are 21.12.0-21.12.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway.  Successful attacks of this vulnerability can result in takeover of Primavera Gateway.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Spring Framework)).  Supported versions that are affected are 6.1.1-7.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1823V-16.0.3.350","P-1823V-15.0.3.190","P-9190V-8.1.2.12","P-9190V-8.1.2.11","P-1980V-12.2.1.4.0","P-9190V-8.0.8.1","P-5242V-12.2.1.4.0","P-14597V-6.1.1-7.0.0","P-4647V-14.1.2.0.0","P-5242V-14.1.2.0.0","P-8575V-5.0.0.0-5.0.9.7","P-10354V-24.12.0-24.12.16","P-5680V-8.1.2.5","P-5242V-15.1.1.0.0","P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-5680V-8.1.2.6","P-9161V-8.2.0.0-8.2.0.8","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5680V-8.0.7.9","P-5680V-8.0.8.7","P-13789V-8.0.8.0","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-1980V-12.2.1.4.0","P-4647V-14.1.2.0.0","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5680V-8.1.2.5","P-5680V-8.1.2.6","P-5680V-8.0.7.9","P-5680V-8.0.8.7"],"url":"https://support.oracle.com/support/?documentId=CPU421"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9190V-8.0.8.1","P-9190V-8.1.2.12","P-9190V-8.1.2.11"],"url":"https://support.oracle.com/support/?documentId=CPU389"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13789V-8.0.8.0"],"url":"https://support.oracle.com/support/?documentId=CPU390"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9161V-8.2.0.0-8.2.0.8","P-8575V-5.0.0.0-5.0.9.7"],"url":"https://support.oracle.com/support/?documentId=CPU377"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1823V-16.0.3.350","P-1823V-15.0.3.190"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41851","ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39562570"},{"system_name":"Oracle Bug ID of Oracle Healthcare Data Repository","text":"39562550"},{"system_name":"Oracle Bug ID of Primavera Gateway","text":"39562572"},{"system_name":"Oracle Bug ID of Oracle Financial Services Analytical Applications Infrastructure","text":"39562540"},{"system_name":"Oracle Bug ID of Oracle Healthcare Master Person Index","text":"39562551"},{"system_name":"Oracle Bug ID of Oracle Financial Services Behavior Detection Platform","text":"39562541"},{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39562552"},{"system_name":"Oracle Bug ID of Oracle Retail Predictive Application Server","text":"39562564"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39562499"},{"system_name":"Oracle Bug ID of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition","text":"39562546"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038132"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Thirdparty Patch (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Others (Spring Framework)).  Supported versions that are affected are 8.0.7.9, 8.0.8.7, 8.1.2.5 and  8.1.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Third Party (Spring Framework)).  Supported versions that are affected are 8.0.8.1, 8.1.2.11 and  8.1.2.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Behavior Detection Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Behavior Detection Platform.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition product of Oracle Financial Services Applications (component: User Interface (Spring Framework)).   The supported version that is affected is 8.0.8.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Data Repository product of Oracle HealthCare Applications (component: FHIR Server (Spring Framework)).  Supported versions that are affected are 8.2.0.0-8.2.0.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Data Repository.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Data Repository.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Master Person Index product of Oracle HealthCare Applications (component: Master Index Data Manager (Spring Framework)).  Supported versions that are affected are 5.0.0.0-5.0.9.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Master Person Index.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Master Person Index.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer (Spring Framework)).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Predictive Application Server product of Oracle Retail Applications (component: RPAS Server (Spring Framework)).  Supported versions that are affected are 15.0.3.190 and  16.0.3.350. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Predictive Application Server.  Successful attacks of this vulnerability can result in takeover of Oracle Retail Predictive Application Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin (Spring Framework)).  Supported versions that are affected are 21.12.0-21.12.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway.  Successful attacks of this vulnerability can result in takeover of Primavera Gateway.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Spring Framework)).  Supported versions that are affected are 6.1.1-7.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1823V-16.0.3.350","P-1823V-15.0.3.190","P-9190V-8.1.2.12","P-9190V-8.1.2.11","P-1980V-12.2.1.4.0","P-9190V-8.0.8.1","P-5242V-12.2.1.4.0","P-14597V-6.1.1-7.0.0","P-4647V-14.1.2.0.0","P-5242V-14.1.2.0.0","P-8575V-5.0.0.0-5.0.9.7","P-10354V-24.12.0-24.12.16","P-5680V-8.1.2.5","P-5242V-15.1.1.0.0","P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-5680V-8.1.2.6","P-9161V-8.2.0.0-8.2.0.8","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5680V-8.0.7.9","P-5680V-8.0.8.7","P-13789V-8.0.8.0","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-1980V-12.2.1.4.0","P-4647V-14.1.2.0.0","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5680V-8.1.2.5","P-5680V-8.1.2.6","P-5680V-8.0.7.9","P-5680V-8.0.8.7"],"url":"https://support.oracle.com/support/?documentId=CPU421"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9190V-8.0.8.1","P-9190V-8.1.2.12","P-9190V-8.1.2.11"],"url":"https://support.oracle.com/support/?documentId=CPU389"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13789V-8.0.8.0"],"url":"https://support.oracle.com/support/?documentId=CPU390"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9161V-8.2.0.0-8.2.0.8","P-8575V-5.0.0.0-5.0.9.7"],"url":"https://support.oracle.com/support/?documentId=CPU377"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1823V-16.0.3.350","P-1823V-15.0.3.190"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41852","ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39562570"},{"system_name":"Oracle Bug ID of Oracle Healthcare Data Repository","text":"39562550"},{"system_name":"Oracle Bug ID of Primavera Gateway","text":"39562572"},{"system_name":"Oracle Bug ID of Oracle Financial Services Analytical Applications Infrastructure","text":"39562540"},{"system_name":"Oracle Bug ID of Oracle Healthcare Master Person Index","text":"39562551"},{"system_name":"Oracle Bug ID of Oracle Financial Services Behavior Detection Platform","text":"39562541"},{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39562552"},{"system_name":"Oracle Bug ID of Oracle Retail Predictive Application Server","text":"39562564"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39562499"},{"system_name":"Oracle Bug ID of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition","text":"39562546"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038132"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Thirdparty Patch (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Others (Spring Framework)).  Supported versions that are affected are 8.0.7.9, 8.0.8.7, 8.1.2.5 and  8.1.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Third Party (Spring Framework)).  Supported versions that are affected are 8.0.8.1, 8.1.2.11 and  8.1.2.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Behavior Detection Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Behavior Detection Platform.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition product of Oracle Financial Services Applications (component: User Interface (Spring Framework)).   The supported version that is affected is 8.0.8.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Data Repository product of Oracle HealthCare Applications (component: FHIR Server (Spring Framework)).  Supported versions that are affected are 8.2.0.0-8.2.0.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Data Repository.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Data Repository.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Master Person Index product of Oracle HealthCare Applications (component: Master Index Data Manager (Spring Framework)).  Supported versions that are affected are 5.0.0.0-5.0.9.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Master Person Index.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Master Person Index.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer (Spring Framework)).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Predictive Application Server product of Oracle Retail Applications (component: RPAS Server (Spring Framework)).  Supported versions that are affected are 15.0.3.190 and  16.0.3.350. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Predictive Application Server.  Successful attacks of this vulnerability can result in takeover of Oracle Retail Predictive Application Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin (Spring Framework)).  Supported versions that are affected are 21.12.0-21.12.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway.  Successful attacks of this vulnerability can result in takeover of Primavera Gateway.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Spring Framework)).  Supported versions that are affected are 6.1.1-7.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1823V-16.0.3.350","P-1823V-15.0.3.190","P-9190V-8.1.2.12","P-9190V-8.1.2.11","P-1980V-12.2.1.4.0","P-9190V-8.0.8.1","P-5242V-12.2.1.4.0","P-14597V-6.1.1-7.0.0","P-4647V-14.1.2.0.0","P-5242V-14.1.2.0.0","P-8575V-5.0.0.0-5.0.9.7","P-10354V-24.12.0-24.12.16","P-5680V-8.1.2.5","P-5242V-15.1.1.0.0","P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-5680V-8.1.2.6","P-9161V-8.2.0.0-8.2.0.8","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5680V-8.0.7.9","P-5680V-8.0.8.7","P-13789V-8.0.8.0","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-1980V-12.2.1.4.0","P-4647V-14.1.2.0.0","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5680V-8.1.2.5","P-5680V-8.1.2.6","P-5680V-8.0.7.9","P-5680V-8.0.8.7"],"url":"https://support.oracle.com/support/?documentId=CPU421"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9190V-8.0.8.1","P-9190V-8.1.2.12","P-9190V-8.1.2.11"],"url":"https://support.oracle.com/support/?documentId=CPU389"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13789V-8.0.8.0"],"url":"https://support.oracle.com/support/?documentId=CPU390"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9161V-8.2.0.0-8.2.0.8","P-8575V-5.0.0.0-5.0.9.7"],"url":"https://support.oracle.com/support/?documentId=CPU377"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1823V-16.0.3.350","P-1823V-15.0.3.190"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41853","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"component_not_present","product_ids":["P-9348V-11.4.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39562570"},{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39711683"},{"system_name":"Oracle Bug ID of Oracle Healthcare Data Repository","text":"39562550"},{"system_name":"Oracle Bug ID of Primavera Gateway","text":"39562572"},{"system_name":"Oracle Bug ID of Oracle Financial Services Analytical Applications Infrastructure","text":"39562540"},{"system_name":"Oracle Bug ID of Oracle Healthcare Master Person Index","text":"39562551"},{"system_name":"Oracle Bug ID of Oracle Financial Services Behavior Detection Platform","text":"39562541"},{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39562552"},{"system_name":"Oracle Bug ID of Oracle Retail Predictive Application Server","text":"39562564"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39562499"},{"system_name":"Oracle Bug ID of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition","text":"39562546"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038132"},{"system_name":"Oracle Bug ID of Siebel CRM Development","text":"39682313"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Thirdparty Patch (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Others (Spring Framework)).  Supported versions that are affected are 8.0.7.9, 8.0.8.7, 8.1.2.5 and  8.1.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Third Party (Spring Framework)).  Supported versions that are affected are 8.0.8.1, 8.1.2.11 and  8.1.2.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Behavior Detection Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Behavior Detection Platform.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition product of Oracle Financial Services Applications (component: User Interface (Spring Framework)).   The supported version that is affected is 8.0.8.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Data Repository product of Oracle HealthCare Applications (component: FHIR Server (Spring Framework)).  Supported versions that are affected are 8.2.0.0-8.2.0.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Data Repository.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Data Repository.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Master Person Index product of Oracle HealthCare Applications (component: Master Index Data Manager (Spring Framework)).  Supported versions that are affected are 5.0.0.0-5.0.9.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Master Person Index.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Master Person Index.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer (Spring Framework)).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Predictive Application Server product of Oracle Retail Applications (component: RPAS Server (Spring Framework)).  Supported versions that are affected are 15.0.3.190 and  16.0.3.350. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Predictive Application Server.  Successful attacks of this vulnerability can result in takeover of Oracle Retail Predictive Application Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin (Spring Framework)).  Supported versions that are affected are 21.12.0-21.12.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway.  Successful attacks of this vulnerability can result in takeover of Primavera Gateway.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval Manager (Spring Framework)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM Development accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (Spring Framework)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Spring Framework)).  Supported versions that are affected are 6.1.1-7.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9001V-17.0-26.9","P-1823V-16.0.3.350","P-1823V-15.0.3.190","P-9190V-8.1.2.12","P-9190V-8.1.2.11","P-1980V-12.2.1.4.0","P-9190V-8.0.8.1","P-5242V-12.2.1.4.0","P-14597V-6.1.1-7.0.0","P-4647V-14.1.2.0.0","P-5242V-14.1.2.0.0","P-8575V-5.0.0.0-5.0.9.7","P-10354V-24.12.0-24.12.16","P-5680V-8.1.2.5","P-5242V-15.1.1.0.0","P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-5680V-8.1.2.6","P-9161V-8.2.0.0-8.2.0.8","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5680V-8.0.7.9","P-5680V-8.0.8.7","P-13789V-8.0.8.0","P-10354V-25.12.0-25.12.9"],"known_not_affected":["P-9348V-11.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-1980V-12.2.1.4.0","P-4647V-14.1.2.0.0","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5680V-8.1.2.5","P-5680V-8.1.2.6","P-5680V-8.0.7.9","P-5680V-8.0.8.7"],"url":"https://support.oracle.com/support/?documentId=CPU421"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9190V-8.0.8.1","P-9190V-8.1.2.12","P-9190V-8.1.2.11"],"url":"https://support.oracle.com/support/?documentId=CPU389"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13789V-8.0.8.0"],"url":"https://support.oracle.com/support/?documentId=CPU390"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9161V-8.2.0.0-8.2.0.8","P-8575V-5.0.0.0-5.0.9.7"],"url":"https://support.oracle.com/support/?documentId=CPU377"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1823V-16.0.3.350","P-1823V-15.0.3.190"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9001V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-9001V-17.0-26.9"]},{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-9348V-11.4.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The software is not affected because the vulnerable component is not in the product.","product_ids":["P-9348V-11.4.0"]}]},{"cve":"CVE-2026-41854","ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39562570"},{"system_name":"Oracle Bug ID of Oracle Healthcare Data Repository","text":"39562550"},{"system_name":"Oracle Bug ID of Primavera Gateway","text":"39562572"},{"system_name":"Oracle Bug ID of Oracle Financial Services Analytical Applications Infrastructure","text":"39562540"},{"system_name":"Oracle Bug ID of Oracle Healthcare Master Person Index","text":"39562551"},{"system_name":"Oracle Bug ID of Oracle Financial Services Behavior Detection Platform","text":"39562541"},{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39562552"},{"system_name":"Oracle Bug ID of Oracle Retail Predictive Application Server","text":"39562564"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39562499"},{"system_name":"Oracle Bug ID of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition","text":"39562546"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038132"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Thirdparty Patch (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Others (Spring Framework)).  Supported versions that are affected are 8.0.7.9, 8.0.8.7, 8.1.2.5 and  8.1.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Third Party (Spring Framework)).  Supported versions that are affected are 8.0.8.1, 8.1.2.11 and  8.1.2.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Behavior Detection Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Behavior Detection Platform.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition product of Oracle Financial Services Applications (component: User Interface (Spring Framework)).   The supported version that is affected is 8.0.8.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Data Repository product of Oracle HealthCare Applications (component: FHIR Server (Spring Framework)).  Supported versions that are affected are 8.2.0.0-8.2.0.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Data Repository.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Data Repository.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Master Person Index product of Oracle HealthCare Applications (component: Master Index Data Manager (Spring Framework)).  Supported versions that are affected are 5.0.0.0-5.0.9.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Master Person Index.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Master Person Index.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer (Spring Framework)).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Predictive Application Server product of Oracle Retail Applications (component: RPAS Server (Spring Framework)).  Supported versions that are affected are 15.0.3.190 and  16.0.3.350. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Predictive Application Server.  Successful attacks of this vulnerability can result in takeover of Oracle Retail Predictive Application Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin (Spring Framework)).  Supported versions that are affected are 21.12.0-21.12.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway.  Successful attacks of this vulnerability can result in takeover of Primavera Gateway.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Spring Framework)).  Supported versions that are affected are 6.1.1-7.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1823V-16.0.3.350","P-1823V-15.0.3.190","P-9190V-8.1.2.12","P-9190V-8.1.2.11","P-1980V-12.2.1.4.0","P-9190V-8.0.8.1","P-5242V-12.2.1.4.0","P-14597V-6.1.1-7.0.0","P-4647V-14.1.2.0.0","P-5242V-14.1.2.0.0","P-8575V-5.0.0.0-5.0.9.7","P-10354V-24.12.0-24.12.16","P-5680V-8.1.2.5","P-5242V-15.1.1.0.0","P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-5680V-8.1.2.6","P-9161V-8.2.0.0-8.2.0.8","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5680V-8.0.7.9","P-5680V-8.0.8.7","P-13789V-8.0.8.0","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-1980V-12.2.1.4.0","P-4647V-14.1.2.0.0","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5680V-8.1.2.5","P-5680V-8.1.2.6","P-5680V-8.0.7.9","P-5680V-8.0.8.7"],"url":"https://support.oracle.com/support/?documentId=CPU421"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9190V-8.0.8.1","P-9190V-8.1.2.12","P-9190V-8.1.2.11"],"url":"https://support.oracle.com/support/?documentId=CPU389"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13789V-8.0.8.0"],"url":"https://support.oracle.com/support/?documentId=CPU390"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9161V-8.2.0.0-8.2.0.8","P-8575V-5.0.0.0-5.0.9.7"],"url":"https://support.oracle.com/support/?documentId=CPU377"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1823V-16.0.3.350","P-1823V-15.0.3.190"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-41855","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"component_not_present","product_ids":["P-9348V-11.4.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39562570"},{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39711683"},{"system_name":"Oracle Bug ID of Oracle Healthcare Data Repository","text":"39562550"},{"system_name":"Oracle Bug ID of Primavera Gateway","text":"39562572"},{"system_name":"Oracle Bug ID of Oracle Financial Services Analytical Applications Infrastructure","text":"39562540"},{"system_name":"Oracle Bug ID of Oracle Healthcare Master Person Index","text":"39562551"},{"system_name":"Oracle Bug ID of Oracle Financial Services Behavior Detection Platform","text":"39562541"},{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39562552"},{"system_name":"Oracle Bug ID of Oracle Retail Predictive Application Server","text":"39562564"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39562499"},{"system_name":"Oracle Bug ID of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition","text":"39562546"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038132"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Thirdparty Patch (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Others (Spring Framework)).  Supported versions that are affected are 8.0.7.9, 8.0.8.7, 8.1.2.5 and  8.1.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Analytical Applications Infrastructure. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: Third Party (Spring Framework)).  Supported versions that are affected are 8.0.8.1, 8.1.2.11 and  8.1.2.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Behavior Detection Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Behavior Detection Platform. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition product of Oracle Financial Services Applications (component: User Interface (Spring Framework)).   The supported version that is affected is 8.0.8.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Data Repository product of Oracle HealthCare Applications (component: FHIR Server (Spring Framework)).  Supported versions that are affected are 8.2.0.0-8.2.0.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Data Repository.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Data Repository. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Master Person Index product of Oracle HealthCare Applications (component: Master Index Data Manager (Spring Framework)).  Supported versions that are affected are 5.0.0.0-5.0.9.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Master Person Index.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Master Person Index. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer (Spring Framework)).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Predictive Application Server product of Oracle Retail Applications (component: RPAS Server (Spring Framework)).  Supported versions that are affected are 15.0.3.190 and  16.0.3.350. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Predictive Application Server.  Successful attacks of this vulnerability can result in takeover of Oracle Retail Predictive Application Server. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core (Spring Framework)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: Admin (Spring Framework)).  Supported versions that are affected are 21.12.0-21.12.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Gateway.  Successful attacks of this vulnerability can result in takeover of Primavera Gateway. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier. CVSS 3.1 Base Score 4.8 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L).","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (Spring Framework)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Spring Framework)).  Supported versions that are affected are 6.1.1-7.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1823V-16.0.3.350","P-1823V-15.0.3.190","P-9190V-8.1.2.12","P-9190V-8.1.2.11","P-1980V-12.2.1.4.0","P-9190V-8.0.8.1","P-5242V-12.2.1.4.0","P-14597V-6.1.1-7.0.0","P-4647V-14.1.2.0.0","P-5242V-14.1.2.0.0","P-8575V-5.0.0.0-5.0.9.7","P-10354V-24.12.0-24.12.16","P-5680V-8.1.2.5","P-5242V-15.1.1.0.0","P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-5680V-8.1.2.6","P-9161V-8.2.0.0-8.2.0.8","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5680V-8.0.7.9","P-5680V-8.0.8.7","P-13789V-8.0.8.0","P-10354V-25.12.0-25.12.9"],"known_not_affected":["P-9348V-11.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-1980V-12.2.1.4.0","P-4647V-14.1.2.0.0","P-5242V-14.1.1.0.0","P-4647V-12.2.1.4.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5680V-8.1.2.5","P-5680V-8.1.2.6","P-5680V-8.0.7.9","P-5680V-8.0.8.7"],"url":"https://support.oracle.com/support/?documentId=CPU421"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9190V-8.0.8.1","P-9190V-8.1.2.12","P-9190V-8.1.2.11"],"url":"https://support.oracle.com/support/?documentId=CPU389"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13789V-8.0.8.0"],"url":"https://support.oracle.com/support/?documentId=CPU390"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9161V-8.2.0.0-8.2.0.8","P-8575V-5.0.0.0-5.0.9.7"],"url":"https://support.oracle.com/support/?documentId=CPU377"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1823V-16.0.3.350","P-1823V-15.0.3.190"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10605V-21.12.0-21.12.18","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1823V-16.0.3.350","P-4647V-14.1.2.0.0","P-1823V-15.0.3.190","P-5242V-14.1.2.0.0","P-8575V-5.0.0.0-5.0.9.7","P-9190V-8.1.2.12","P-9190V-8.1.2.11","P-5680V-8.1.2.5","P-5242V-15.1.1.0.0","P-10605V-21.12.0-21.12.18","P-5680V-8.1.2.6","P-9161V-8.2.0.0-8.2.0.8","P-1980V-12.2.1.4.0","P-5242V-14.1.1.0.0","P-9190V-8.0.8.1","P-4647V-12.2.1.4.0","P-5242V-12.2.1.4.0","P-5680V-8.0.7.9","P-5680V-8.0.8.7","P-14597V-6.1.1-7.0.0","P-13789V-8.0.8.0"]},{"cvss_v3":{"baseScore":4.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"products":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"]},{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-9348V-11.4.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The software is not affected because the vulnerable component is not in the product.","product_ids":["P-9348V-11.4.0"]}]},{"cve":"CVE-2026-41989","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Service Communication Proxy","text":"39399850"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"39399849"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Network Repository Function","text":"39399845"},{"system_name":"Oracle Bug ID of Oracle Communications EAGLE LNP Application Processor","text":"39399857"},{"system_name":"Oracle Bug ID of Oracle Communications LSMS","text":"39399858"},{"system_name":"Oracle Bug ID of Oracle Communications Network Analytics Data Director","text":"39399859"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Network Repository Function product of Oracle Communications (component: Install (libgcrypt)).  Supported versions that are affected are 25.2.202 and 26.1.202. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Communications Cloud Native Core Network Repository Function executes to compromise Oracle Communications Cloud Native Core Network Repository Function.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Network Repository Function accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Network Repository Function. CVSS 3.1 Base Score 6.7 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Signaling (libgcrypt)).  Supported versions that are affected are 25.2.200 and  26.1.200. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Communications Cloud Native Core Security Edge Protection Proxy executes to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Security Edge Protection Proxy accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Security Edge Protection Proxy. CVSS 3.1 Base Score 6.7 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Service Communication Proxy product of Oracle Communications (component: Install (libgcrypt)).  Supported versions that are affected are 25.2.200 and  26.1.200. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Communications Cloud Native Core Service Communication Proxy executes to compromise Oracle Communications Cloud Native Core Service Communication Proxy.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Service Communication Proxy accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Service Communication Proxy. CVSS 3.1 Base Score 6.7 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE LNP Application Processor product of Oracle Communications (component: Platform (libgcrypt)).   The supported version that is affected is 11.0. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Communications EAGLE LNP Application Processor executes to compromise Oracle Communications EAGLE LNP Application Processor.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications EAGLE LNP Application Processor accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications EAGLE LNP Application Processor. CVSS 3.1 Base Score 6.7 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications LSMS product of Oracle Communications (component: Platform (libgcrypt)).   The supported version that is affected is 14.0. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Communications LSMS executes to compromise Oracle Communications LSMS.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications LSMS accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications LSMS. CVSS 3.1 Base Score 6.7 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Network Analytics Data Director product of Oracle Communications (component: Third Party (libgcrypt)).  Supported versions that are affected are 25.1.200, 25.2.100 and  25.2.200. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Communications Network Analytics Data Director executes to compromise Oracle Communications Network Analytics Data Director.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Network Analytics Data Director accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Network Analytics Data Director. CVSS 3.1 Base Score 6.7 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14547V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14547V-25.2.100","P-14117V-25.2.200","P-14547V-25.1.200","P-11118V-11.0","P-14118(Oracle Communications Cloud Native Core Network Repository Function_Install)V-25.2.202","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200","P-11114V-14.0","P-14117V-26.1.200","P-14118(Oracle Communications Cloud Native Core Network Repository Function_Install)V-26.1.202"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14118(Oracle Communications Cloud Native Core Network Repository Function_Install)V-25.2.202","P-14118(Oracle Communications Cloud Native Core Network Repository Function_Install)V-26.1.202"],"url":"https://support.oracle.com/support/?documentId=CPU402"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14117V-25.2.200","P-14117V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU404"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11118V-11.0"],"url":"https://support.oracle.com/support/?documentId=CPU409"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11114V-14.0"],"url":"https://support.oracle.com/support/?documentId=CPU408"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14547V-25.2.200","P-14547V-25.2.100","P-14547V-25.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU410"}],"scores":[{"cvss_v3":{"baseScore":6.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"products":["P-14547V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14547V-25.2.100","P-14117V-25.2.200","P-14547V-25.1.200","P-11118V-11.0","P-14118(Oracle Communications Cloud Native Core Network Repository Function_Install)V-25.2.202","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200","P-11114V-14.0","P-14117V-26.1.200","P-14118(Oracle Communications Cloud Native Core Network Repository Function_Install)V-26.1.202"]}]},{"cve":"CVE-2026-41990","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Service Communication Proxy","text":"39399850"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"39399849"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Network Repository Function","text":"39399845"},{"system_name":"Oracle Bug ID of Oracle Communications EAGLE LNP Application Processor","text":"39399857"},{"system_name":"Oracle Bug ID of Oracle Communications LSMS","text":"39399858"},{"system_name":"Oracle Bug ID of Oracle Communications Network Analytics Data Director","text":"39399859"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Network Repository Function product of Oracle Communications (component: Install (libgcrypt)).  Supported versions that are affected are 25.2.202 and 26.1.202. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Communications Cloud Native Core Network Repository Function executes to compromise Oracle Communications Cloud Native Core Network Repository Function.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Network Repository Function accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Network Repository Function.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Signaling (libgcrypt)).  Supported versions that are affected are 25.2.200 and  26.1.200. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Communications Cloud Native Core Security Edge Protection Proxy executes to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Security Edge Protection Proxy accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Service Communication Proxy product of Oracle Communications (component: Install (libgcrypt)).  Supported versions that are affected are 25.2.200 and  26.1.200. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Communications Cloud Native Core Service Communication Proxy executes to compromise Oracle Communications Cloud Native Core Service Communication Proxy.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Service Communication Proxy accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Service Communication Proxy.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE LNP Application Processor product of Oracle Communications (component: Platform (libgcrypt)).   The supported version that is affected is 11.0. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Communications EAGLE LNP Application Processor executes to compromise Oracle Communications EAGLE LNP Application Processor.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications EAGLE LNP Application Processor accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications EAGLE LNP Application Processor.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications LSMS product of Oracle Communications (component: Platform (libgcrypt)).   The supported version that is affected is 14.0. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Communications LSMS executes to compromise Oracle Communications LSMS.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications LSMS accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications LSMS.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Network Analytics Data Director product of Oracle Communications (component: Third Party (libgcrypt)).  Supported versions that are affected are 25.1.200, 25.2.100 and  25.2.200. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Communications Network Analytics Data Director executes to compromise Oracle Communications Network Analytics Data Director.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Network Analytics Data Director accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Network Analytics Data Director.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14547V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14547V-25.2.100","P-14117V-25.2.200","P-14547V-25.1.200","P-11118V-11.0","P-14118(Oracle Communications Cloud Native Core Network Repository Function_Install)V-25.2.202","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200","P-11114V-14.0","P-14117V-26.1.200","P-14118(Oracle Communications Cloud Native Core Network Repository Function_Install)V-26.1.202"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14118(Oracle Communications Cloud Native Core Network Repository Function_Install)V-25.2.202","P-14118(Oracle Communications Cloud Native Core Network Repository Function_Install)V-26.1.202"],"url":"https://support.oracle.com/support/?documentId=CPU402"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14117V-25.2.200","P-14117V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU404"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11118V-11.0"],"url":"https://support.oracle.com/support/?documentId=CPU409"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11114V-14.0"],"url":"https://support.oracle.com/support/?documentId=CPU408"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14547V-25.2.200","P-14547V-25.2.100","P-14547V-25.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU410"}]},{"cve":"CVE-2026-42257","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-42402","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39877601"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars (Apache Neethi)).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data as well as  unauthorized read access to a subset of Oracle SOA Suite accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-42403","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39877601"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars (Apache Neethi)).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data as well as  unauthorized read access to a subset of Oracle SOA Suite accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-42404","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39877601"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars (Apache Neethi)).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data as well as  unauthorized read access to a subset of Oracle SOA Suite accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-42496","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Binding Support Function","text":"40044535"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Binding Support Function product of Oracle Communications (component: Configuration (glibc)).   The supported version that is affected is 25.2.201. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications Cloud Native Core Binding Support Function.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Binding Support Function.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14121V-25.2.201"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14121V-25.2.201"],"url":"https://support.oracle.com/support/?documentId=CPU401"}]},{"cve":"CVE-2026-42498","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068469"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (Apache Tomcat)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-42505","ids":[{"system_name":"Oracle Bug ID of Oracle TimesTen In-Memory Database","text":"39818301"}],"notes":[{"category":"description","text":"Vulnerability in Oracle TimesTen In-Memory Database (component: EM TimesTen plug-in (Golang Go)).  Supported versions that are affected are 26.1-26.1.1.3.0 and   22.1-22.1.1.41.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle TimesTen In-Memory Database executes to compromise Oracle TimesTen In-Memory Database.  Successful attacks of this vulnerability can result in takeover of Oracle TimesTen In-Memory Database.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1870V-26.1-26.1.1.3.0","P-1870V-22.1-22.1.1.41.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1870V-26.1-26.1.1.3.0","P-1870V-22.1-22.1.1.41.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-42535","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications Policy Management","text":"39692059"},{"system_name":"Oracle Bug ID of Oracle Secure Backup","text":"39692067"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"39692055"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Automated Test Suite Framework (Apache HTTP Server)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Policy Management product of Oracle Communications (component: CMP (Apache HTTP Server)).  Supported versions that are affected are 15.0.0.0.0 and  15.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Policy Management.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle Secure Backup (component: Secure Backup (Apache HTTP Server)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200","P-10900V-15.1.0.0.0","P-10900V-15.0.0.0.0"],"known_not_affected":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10900V-15.0.0.0.0","P-10900V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU403"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}]},{"cve":"CVE-2026-42536","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications Policy Management","text":"39692059"},{"system_name":"Oracle Bug ID of Oracle Secure Backup","text":"39692067"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"39692055"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Automated Test Suite Framework (Apache HTTP Server)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Policy Management product of Oracle Communications (component: CMP (Apache HTTP Server)).  Supported versions that are affected are 15.0.0.0.0 and  15.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Policy Management.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle Secure Backup (component: Secure Backup (Apache HTTP Server)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200","P-10900V-15.1.0.0.0","P-10900V-15.0.0.0.0"],"known_not_affected":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10900V-15.0.0.0.0","P-10900V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU403"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}]},{"cve":"CVE-2026-42578","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39483464"},{"system_name":"Oracle Bug ID of Oracle Utilities Network Management System","text":"39429006"},{"system_name":"Oracle Bug ID of Oracle NoSQL Database","text":"39429000"}],"notes":[{"category":"description","text":"Vulnerability in Oracle NoSQL Database (component: Administration (Netty)).  Supported versions that are affected are 23.3.41,   24.4.14 and   25.3.24. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle NoSQL Database.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle NoSQL Database.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Third Party (Netty)).  Supported versions that are affected are 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.9 and  25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle Utilities Network Management System.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Network Management System.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Netty)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-13373V-24.4.14","P-13373V-23.3.41","P-2241V-2.6.0.1.0-2.6.0.1.12","P-13373V-25.3.24","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"],"known_not_affected":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13373V-24.4.14","P-13373V-23.3.41","P-13373V-25.3.24","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-2241V-2.6.0.1.0-2.6.0.1.12","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"],"url":"https://support.oracle.com/support/?documentId=CPU370"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2026-42579","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39483464"},{"system_name":"Oracle Bug ID of Oracle Utilities Network Management System","text":"39429006"},{"system_name":"Oracle Bug ID of Oracle NoSQL Database","text":"39429000"}],"notes":[{"category":"description","text":"Vulnerability in Oracle NoSQL Database (component: Administration (Netty)).  Supported versions that are affected are 23.3.41,   24.4.14 and   25.3.24. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle NoSQL Database.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle NoSQL Database.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Third Party (Netty)).  Supported versions that are affected are 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.9 and  25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle Utilities Network Management System.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Network Management System.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Netty)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-13373V-24.4.14","P-13373V-23.3.41","P-2241V-2.6.0.1.0-2.6.0.1.12","P-13373V-25.3.24","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"],"known_not_affected":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13373V-24.4.14","P-13373V-23.3.41","P-13373V-25.3.24","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-2241V-2.6.0.1.0-2.6.0.1.12","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"],"url":"https://support.oracle.com/support/?documentId=CPU370"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2026-42580","ids":[{"system_name":"Oracle Bug ID of Oracle Utilities Network Management System","text":"39429006"},{"system_name":"Oracle Bug ID of Oracle NoSQL Database","text":"39429000"}],"notes":[{"category":"description","text":"Vulnerability in Oracle NoSQL Database (component: Administration (Netty)).  Supported versions that are affected are 23.3.41,   24.4.14 and   25.3.24. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle NoSQL Database.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle NoSQL Database.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Third Party (Netty)).  Supported versions that are affected are 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.9 and  25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle Utilities Network Management System.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Network Management System.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-13373V-24.4.14","P-13373V-23.3.41","P-2241V-2.6.0.1.0-2.6.0.1.12","P-13373V-25.3.24","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13373V-24.4.14","P-13373V-23.3.41","P-13373V-25.3.24"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-2241V-2.6.0.1.0-2.6.0.1.12","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"],"url":"https://support.oracle.com/support/?documentId=CPU370"}]},{"cve":"CVE-2026-42581","ids":[{"system_name":"Oracle Bug ID of Oracle Utilities Network Management System","text":"39429006"},{"system_name":"Oracle Bug ID of Oracle NoSQL Database","text":"39429000"}],"notes":[{"category":"description","text":"Vulnerability in Oracle NoSQL Database (component: Administration (Netty)).  Supported versions that are affected are 23.3.41,   24.4.14 and   25.3.24. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle NoSQL Database.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle NoSQL Database.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Third Party (Netty)).  Supported versions that are affected are 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.9 and  25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle Utilities Network Management System.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Network Management System.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-13373V-24.4.14","P-13373V-23.3.41","P-2241V-2.6.0.1.0-2.6.0.1.12","P-13373V-25.3.24","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13373V-24.4.14","P-13373V-23.3.41","P-13373V-25.3.24"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-2241V-2.6.0.1.0-2.6.0.1.12","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"],"url":"https://support.oracle.com/support/?documentId=CPU370"}]},{"cve":"CVE-2026-42583","ids":[{"system_name":"Oracle Bug ID of Oracle Utilities Network Management System","text":"39429006"},{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"40024514"},{"system_name":"Oracle Bug ID of Oracle NoSQL Database","text":"39429000"},{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39663646"}],"notes":[{"category":"description","text":"Vulnerability in Oracle NoSQL Database (component: Administration (Netty)).  Supported versions that are affected are 23.3.41,   24.4.14 and   25.3.24. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle NoSQL Database.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle NoSQL Database.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Third Party (Netty)).  Supported versions that are affected are 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.9 and  25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle Utilities Network Management System.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Network Management System.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure (Netty)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Netty)).  Supported versions that are affected are 19.1.0.0.0-19.1.0.0.16. Easily exploitable vulnerability allows low privileged attacker with network access via TLS to compromise Oracle GoldenGate Stream Analytics.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle GoldenGate Stream Analytics.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-13373V-24.4.14","P-14015(Oracle GoldenGate Stream Analytics_Security)V-19.1.0.0.0-19.1.0.0.16","P-13373V-23.3.41","P-2241V-2.6.0.1.0-2.6.0.1.12","P-13373V-25.3.24","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9","P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13373V-24.4.14","P-14015(Oracle GoldenGate Stream Analytics_Security)V-19.1.0.0.0-19.1.0.0.16","P-13373V-23.3.41","P-13373V-25.3.24"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-2241V-2.6.0.1.0-2.6.0.1.12","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"],"url":"https://support.oracle.com/support/?documentId=CPU370"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}]},{"cve":"CVE-2026-42584","ids":[{"system_name":"Oracle Bug ID of Oracle Utilities Network Management System","text":"39429006"},{"system_name":"Oracle Bug ID of Oracle NoSQL Database","text":"39429000"}],"notes":[{"category":"description","text":"Vulnerability in Oracle NoSQL Database (component: Administration (Netty)).  Supported versions that are affected are 23.3.41,   24.4.14 and   25.3.24. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle NoSQL Database.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle NoSQL Database.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Third Party (Netty)).  Supported versions that are affected are 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.9 and  25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle Utilities Network Management System.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Network Management System.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-13373V-24.4.14","P-13373V-23.3.41","P-2241V-2.6.0.1.0-2.6.0.1.12","P-13373V-25.3.24","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13373V-24.4.14","P-13373V-23.3.41","P-13373V-25.3.24"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-2241V-2.6.0.1.0-2.6.0.1.12","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"],"url":"https://support.oracle.com/support/?documentId=CPU370"}]},{"cve":"CVE-2026-42585","ids":[{"system_name":"Oracle Bug ID of Oracle Utilities Network Management System","text":"39429006"},{"system_name":"Oracle Bug ID of Oracle NoSQL Database","text":"39429000"}],"notes":[{"category":"description","text":"Vulnerability in Oracle NoSQL Database (component: Administration (Netty)).  Supported versions that are affected are 23.3.41,   24.4.14 and   25.3.24. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle NoSQL Database.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle NoSQL Database.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Third Party (Netty)).  Supported versions that are affected are 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.9 and  25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle Utilities Network Management System.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Network Management System.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-13373V-24.4.14","P-13373V-23.3.41","P-2241V-2.6.0.1.0-2.6.0.1.12","P-13373V-25.3.24","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13373V-24.4.14","P-13373V-23.3.41","P-13373V-25.3.24"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-2241V-2.6.0.1.0-2.6.0.1.12","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"],"url":"https://support.oracle.com/support/?documentId=CPU370"}]},{"cve":"CVE-2026-42586","ids":[{"system_name":"Oracle Bug ID of Oracle Utilities Network Management System","text":"39429006"},{"system_name":"Oracle Bug ID of Oracle NoSQL Database","text":"39429000"}],"notes":[{"category":"description","text":"Vulnerability in Oracle NoSQL Database (component: Administration (Netty)).  Supported versions that are affected are 23.3.41,   24.4.14 and   25.3.24. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle NoSQL Database.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle NoSQL Database.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Third Party (Netty)).  Supported versions that are affected are 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.9 and  25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle Utilities Network Management System.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Network Management System.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-13373V-24.4.14","P-13373V-23.3.41","P-2241V-2.6.0.1.0-2.6.0.1.12","P-13373V-25.3.24","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13373V-24.4.14","P-13373V-23.3.41","P-13373V-25.3.24"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-2241V-2.6.0.1.0-2.6.0.1.12","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"],"url":"https://support.oracle.com/support/?documentId=CPU370"}]},{"cve":"CVE-2026-42587","ids":[{"system_name":"Oracle Bug ID of Oracle Utilities Network Management System","text":"39429006"},{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"40024514"},{"system_name":"Oracle Bug ID of Oracle NoSQL Database","text":"39429000"}],"notes":[{"category":"description","text":"Vulnerability in Oracle NoSQL Database (component: Administration (Netty)).  Supported versions that are affected are 23.3.41,   24.4.14 and   25.3.24. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle NoSQL Database.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle NoSQL Database. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Third Party (Netty)).  Supported versions that are affected are 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.9 and  25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle Utilities Network Management System.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Network Management System. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Netty)).  Supported versions that are affected are 19.1.0.0.0-19.1.0.0.16. Easily exploitable vulnerability allows low privileged attacker with network access via TLS to compromise Oracle GoldenGate Stream Analytics.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle GoldenGate Stream Analytics.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-13373V-24.4.14","P-14015(Oracle GoldenGate Stream Analytics_Security)V-19.1.0.0.0-19.1.0.0.16","P-13373V-23.3.41","P-2241V-2.6.0.1.0-2.6.0.1.12","P-13373V-25.3.24","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13373V-24.4.14","P-14015(Oracle GoldenGate Stream Analytics_Security)V-19.1.0.0.0-19.1.0.0.16","P-13373V-23.3.41","P-13373V-25.3.24"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-2241V-2.6.0.1.0-2.6.0.1.12","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"],"url":"https://support.oracle.com/support/?documentId=CPU370"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-13373V-24.4.14","P-13373V-23.3.41","P-2241V-2.6.0.1.0-2.6.0.1.12","P-13373V-25.3.24","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"]}]},{"cve":"CVE-2026-42764","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39442783"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security (OpenSSL)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-42766","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"},{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39442783"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security (OpenSSL)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-5085V-8.61-8.63","P-4629V-9.7.0-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-42767","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"},{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39442783"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security (OpenSSL)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-5085V-8.61-8.63","P-4629V-9.7.0-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-42768","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39442783"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security (OpenSSL)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-42769","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39442783"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security (OpenSSL)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-42770","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"},{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39442783"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security (OpenSSL)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-5085V-8.61-8.63","P-4629V-9.7.0-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-42778","ids":[{"system_name":"Oracle Bug ID of Oracle Healthcare Master Person Index","text":"39710974"},{"system_name":"Oracle Bug ID of Oracle Health Sciences Information Manager","text":"39710973"},{"system_name":"Oracle Bug ID of Oracle Managed File Transfer","text":"39710955"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server (Apache Mina)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Managed File Transfer.  Successful attacks of this vulnerability can result in takeover of Oracle Managed File Transfer.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Health Sciences Information Manager product of Oracle HealthCare Applications (component: Record Locator (Apache Mina)).  Supported versions that are affected are 4.0.0-4.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Health Sciences Information Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Health Sciences Information Manager.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Master Person Index product of Oracle HealthCare Applications (component: Core (Apache Mina)).  Supported versions that are affected are 5.0.0.0-5.0.9.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Master Person Index.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Master Person Index.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9177V-4.0.0-4.0.3","P-8575V-5.0.0.0-5.0.9.7","P-10198V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10198V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9177V-4.0.0-4.0.3","P-8575V-5.0.0.0-5.0.9.7"],"url":"https://support.oracle.com/support/?documentId=CPU377"}]},{"cve":"CVE-2026-42779","ids":[{"system_name":"Oracle Bug ID of Oracle Healthcare Master Person Index","text":"39710974"},{"system_name":"Oracle Bug ID of Oracle Health Sciences Information Manager","text":"39710973"},{"system_name":"Oracle Bug ID of Oracle Managed File Transfer","text":"39710955"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server (Apache Mina)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Managed File Transfer.  Successful attacks of this vulnerability can result in takeover of Oracle Managed File Transfer. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Health Sciences Information Manager product of Oracle HealthCare Applications (component: Record Locator (Apache Mina)).  Supported versions that are affected are 4.0.0-4.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Health Sciences Information Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Health Sciences Information Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Healthcare Master Person Index product of Oracle HealthCare Applications (component: Core (Apache Mina)).  Supported versions that are affected are 5.0.0.0-5.0.9.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Healthcare Master Person Index.  Successful attacks of this vulnerability can result in takeover of Oracle Healthcare Master Person Index. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9177V-4.0.0-4.0.3","P-8575V-5.0.0.0-5.0.9.7","P-10198V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10198V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9177V-4.0.0-4.0.3","P-8575V-5.0.0.0-5.0.9.7"],"url":"https://support.oracle.com/support/?documentId=CPU377"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-10198V-14.1.2.0.0","P-9177V-4.0.0-4.0.3","P-8575V-5.0.0.0-5.0.9.7"]}]},{"cve":"CVE-2026-42792","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40014104"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Erlang/OTP)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-43512","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068469"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (Apache Tomcat)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-43513","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068469"},{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39760530"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface (Apache Tomcat)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (Apache Tomcat)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0","P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-43514","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068469"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (Apache Tomcat)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-43515","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068469"},{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39760530"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface (Apache Tomcat)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (Apache Tomcat)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0","P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-43658","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43660","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"]}]},{"cve":"CVE-2026-43663","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43676","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43699","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43701","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43705","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43707","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43712","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43713","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43715","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43716","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43720","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43721","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43725","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43726","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43727","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43731","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43732","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43734","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43740","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43742","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43745","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43804","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-43827","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038090"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Shiro)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-43828","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038090"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Shiro)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-43868","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-43869","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-43870","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-43871","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-43951","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications Policy Management","text":"39692059"},{"system_name":"Oracle Bug ID of Oracle Secure Backup","text":"39692067"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"39692055"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Automated Test Suite Framework (Apache HTTP Server)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Policy Management product of Oracle Communications (component: CMP (Apache HTTP Server)).  Supported versions that are affected are 15.0.0.0.0 and  15.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Policy Management.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle Secure Backup (component: Secure Backup (Apache HTTP Server)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200","P-10900V-15.1.0.0.0","P-10900V-15.0.0.0.0"],"known_not_affected":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10900V-15.0.0.0.0","P-10900V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU403"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}]},{"cve":"CVE-2026-44119","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications Policy Management","text":"39692059"},{"system_name":"Oracle Bug ID of Oracle Secure Backup","text":"39692067"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"39692055"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Automated Test Suite Framework (Apache HTTP Server)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Policy Management product of Oracle Communications (component: CMP (Apache HTTP Server)).  Supported versions that are affected are 15.0.0.0.0 and  15.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Policy Management.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle Secure Backup (component: Secure Backup (Apache HTTP Server)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200","P-10900V-15.1.0.0.0","P-10900V-15.0.0.0.0"],"known_not_affected":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10900V-15.0.0.0.0","P-10900V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU403"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}]},{"cve":"CVE-2026-44161","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39889615"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager (Fluentd)).  Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 7.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-44185","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications Policy Management","text":"39692059"},{"system_name":"Oracle Bug ID of Oracle Secure Backup","text":"39692067"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"39692055"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Automated Test Suite Framework (Apache HTTP Server)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Policy Management product of Oracle Communications (component: CMP (Apache HTTP Server)).  Supported versions that are affected are 15.0.0.0.0 and  15.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Policy Management.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle Secure Backup (component: Secure Backup (Apache HTTP Server)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200","P-10900V-15.1.0.0.0","P-10900V-15.0.0.0.0"],"known_not_affected":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10900V-15.0.0.0.0","P-10900V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU403"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}]},{"cve":"CVE-2026-44186","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications Policy Management","text":"39692059"},{"system_name":"Oracle Bug ID of Oracle Secure Backup","text":"39692067"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"39692055"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Automated Test Suite Framework (Apache HTTP Server)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Policy Management product of Oracle Communications (component: CMP (Apache HTTP Server)).  Supported versions that are affected are 15.0.0.0.0 and  15.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Policy Management.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle Secure Backup (component: Secure Backup (Apache HTTP Server)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200","P-10900V-15.1.0.0.0","P-10900V-15.0.0.0.0"],"known_not_affected":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10900V-15.0.0.0.0","P-10900V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU403"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}]},{"cve":"CVE-2026-44248","ids":[{"system_name":"Oracle Bug ID of Oracle Utilities Network Management System","text":"39429006"},{"system_name":"Oracle Bug ID of Oracle NoSQL Database","text":"39429000"}],"notes":[{"category":"description","text":"Vulnerability in Oracle NoSQL Database (component: Administration (Netty)).  Supported versions that are affected are 23.3.41,   24.4.14 and   25.3.24. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle NoSQL Database.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle NoSQL Database.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Third Party (Netty)).  Supported versions that are affected are 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.9 and  25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle Utilities Network Management System.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Network Management System.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-13373V-24.4.14","P-13373V-23.3.41","P-2241V-2.6.0.1.0-2.6.0.1.12","P-13373V-25.3.24","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13373V-24.4.14","P-13373V-23.3.41","P-13373V-25.3.24"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2241V-25.12.0.0.0-25.12.0.0.2","P-2241V-2.6.0.1.0-2.6.0.1.12","P-2241V-2.5.0.2.0-2.5.0.2.11","P-2241V-2.6.0.2.0-2.6.0.2.9"],"url":"https://support.oracle.com/support/?documentId=CPU370"}]},{"cve":"CVE-2026-44249","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39483464"},{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39663646"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Netty)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure (Netty)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"],"known_not_affected":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2026-44598","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038090"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Shiro)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-44631","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications Policy Management","text":"39692059"},{"system_name":"Oracle Bug ID of Oracle Secure Backup","text":"39692067"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"39692055"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Automated Test Suite Framework (Apache HTTP Server)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Policy Management product of Oracle Communications (component: CMP (Apache HTTP Server)).  Supported versions that are affected are 15.0.0.0.0 and  15.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Policy Management.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle Secure Backup (component: Secure Backup (Apache HTTP Server)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200","P-10900V-15.1.0.0.0","P-10900V-15.0.0.0.0"],"known_not_affected":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10900V-15.0.0.0.0","P-10900V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU403"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}]},{"cve":"CVE-2026-44891","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-44892","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39483464"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Netty)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2026-45205","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_cannot_be_controlled_by_adversary","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-19.1.0.0.0-19.1.0.0.16"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"40025060"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Apache Commons Configuration)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-19.1.0.0.0-19.1.0.0.16"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-19.1.0.0.0-19.1.0.0.16"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-19.1.0.0.0-19.1.0.0.16"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The vulnerable component is present, and the component contains the vulnerable code. However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-19.1.0.0.0-19.1.0.0.16"]}]},{"cve":"CVE-2026-45292","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Unified Data Repository","text":"39532128"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Unified Data Repository product of Oracle Communications (component: Install (OpenTelemetry-Go)).  Supported versions that are affected are 25.2.200 and 26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Unified Data Repository.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Cloud Native Core Unified Data Repository. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14119V-26.1.200","P-14119V-25.2.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14119V-26.1.200","P-14119V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU407"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-14119V-26.1.200","P-14119V-25.2.200"]}]},{"cve":"CVE-2026-45416","ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"40024514"},{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39663646"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure (Netty)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Netty)).  Supported versions that are affected are 19.1.0.0.0-19.1.0.0.16. Easily exploitable vulnerability allows low privileged attacker with network access via TLS to compromise Oracle GoldenGate Stream Analytics.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle GoldenGate Stream Analytics. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9","P-14015(Oracle GoldenGate Stream Analytics_Security)V-19.1.0.0.0-19.1.0.0.16"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-19.1.0.0.0-19.1.0.0.16"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-19.1.0.0.0-19.1.0.0.16"]}]},{"cve":"CVE-2026-45445","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"},{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39442783"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security (OpenSSL)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-5085V-8.61-8.63","P-4629V-9.7.0-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-45446","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"},{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39442783"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security (OpenSSL)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-5085V-8.61-8.63","P-4629V-9.7.0-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-45447","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"},{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39442783"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security (OpenSSL)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-5085V-8.61-8.63","P-4629V-9.7.0-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-45536","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39483464"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Netty)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2026-46469","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39416135"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (gstreamer)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle JavaFX accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-46470","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39416135"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (gstreamer)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle JavaFX accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":4.2,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L","version":"3.1"},"products":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"]}]},{"cve":"CVE-2026-47025","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39283699"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).  Supported versions that are affected are 11.3 and  11.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4","P-10006V-11.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4","P-10006V-11.3"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-10006V-11.4","P-10006V-11.3"]}]},{"cve":"CVE-2026-47065","ids":[{"system_name":"Oracle Bug ID of Oracle Managed File Transfer","text":"39877573"},{"system_name":"Oracle Bug ID of Oracle Business Process Management Suite","text":"39742173"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39730090"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Apache Mina)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in takeover of Oracle Middleware Common Libraries and Tools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human workflow 11g+ (Apache Mina)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server (Apache Mina)).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Managed File Transfer.  Successful attacks of this vulnerability can result in takeover of Oracle Managed File Transfer.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4647V-12.2.1.4.0","P-5325V-12.2.1.4.0","P-5325V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-10198V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5325V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-10198V-12.2.1.4.0","P-4647V-12.2.1.4.0","P-5325V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5325V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-4647V-12.2.1.4.0","P-5325V-12.2.1.4.0"]}]},{"cve":"CVE-2026-47078","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40014104"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Erlang/OTP)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-47244","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39483464"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Netty)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2026-47691","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39483464"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Netty)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2026-47884","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"component_not_present","product_ids":["P-9348V-11.4.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39711683"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (Spring Framework)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-9348V-11.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-9348V-11.4.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The software is not affected because the vulnerable component is not in the product.","product_ids":["P-9348V-11.4.0"]}]},{"cve":"CVE-2026-47886","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"component_not_present","product_ids":["P-9348V-11.4.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39711683"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (Spring Framework)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-9348V-11.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-9348V-11.4.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The software is not affected because the vulnerable component is not in the product.","product_ids":["P-9348V-11.4.0"]}]},{"cve":"CVE-2026-47887","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"component_not_present","product_ids":["P-9348V-11.4.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39711683"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (Spring Framework)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-9348V-11.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-9348V-11.4.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The software is not affected because the vulnerable component is not in the product.","product_ids":["P-9348V-11.4.0"]}]},{"cve":"CVE-2026-47888","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"component_not_present","product_ids":["P-9348V-11.4.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39711683"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (Spring Framework)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-9348V-11.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-9348V-11.4.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The software is not affected because the vulnerable component is not in the product.","product_ids":["P-9348V-11.4.0"]}]},{"cve":"CVE-2026-47891","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"component_not_present","product_ids":["P-9348V-11.4.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39711683"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (Spring Framework)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"known_not_affected":["P-9348V-11.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-9348V-11.4.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The software is not affected because the vulnerable component is not in the product.","product_ids":["P-9348V-11.4.0"]}]},{"cve":"CVE-2026-47892","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"component_not_present","product_ids":["P-9348V-11.4.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39711683"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (Spring Framework)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"known_not_affected":["P-9348V-11.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-9348V-11.4.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The software is not affected because the vulnerable component is not in the product.","product_ids":["P-9348V-11.4.0"]}]},{"cve":"CVE-2026-47893","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"component_not_present","product_ids":["P-9348V-11.4.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39711683"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (Spring Framework)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"known_not_affected":["P-9348V-11.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-9348V-11.4.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The software is not affected because the vulnerable component is not in the product.","product_ids":["P-9348V-11.4.0"]}]},{"cve":"CVE-2026-4800","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"39790206"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Lodash)).   The supported version that is affected is 7.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":6.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-14597V-7.0.0"]}]},{"cve":"CVE-2026-48144","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-48145","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-48586","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-48589","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038090"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Shiro)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-48615","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-48617","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-48618","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-48619","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-4873","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-48913","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications Policy Management","text":"39692059"},{"system_name":"Oracle Bug ID of Oracle Secure Backup","text":"39692067"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"39692055"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Automated Test Suite Framework (Apache HTTP Server)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Policy Management product of Oracle Communications (component: CMP (Apache HTTP Server)).  Supported versions that are affected are 15.0.0.0.0 and  15.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Policy Management.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle Secure Backup (component: Secure Backup (Apache HTTP Server)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200","P-10900V-15.1.0.0.0","P-10900V-15.0.0.0.0"],"known_not_affected":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10900V-15.0.0.0.0","P-10900V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU403"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}]},{"cve":"CVE-2026-48928","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-48930","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-48931","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-48933","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-48934","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-48935","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-48937","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-49158","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-49268","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038090"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Shiro)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-49844","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14634V-26.3-26.8"]},{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_cannot_be_controlled_by_adversary","product_ids":["P-5(RDBMS-Apache Log4j)V-19.3-19.32","P-5(RDBMS-Apache Log4j)V-23.4.0-23.26.3","P-5(RDBMS-Apache Log4j)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Autonomous Health Framework","text":"39825915"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39891999"},{"system_name":"Oracle Bug ID of Oracle Financial Services Analytical Applications Infrastructure","text":"39954883"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39729742"},{"system_name":"Oracle Bug ID of Oracle Utilities Application Framework","text":"39862577"},{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"40052182"},{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39860594"},{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39953591"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39977056"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"39899746"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform (Apache Log4j)).  Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Primavera Unifier accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle Autonomous Health Framework (component: Trace File Analyzer (Apache Log4j)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (Apache Log4j)).   The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: Security (Apache Log4j)).  Supported versions that are affected are 4.4.0.2.0, 4.4.0.3.0, 4.4.0.4.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 4.5.0.2.0, 25.4, 25.10, 26.4 and  26.10. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Application Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Utilities Application Framework accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Apache Log4j)).   The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Middleware Common Libraries and Tools accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Log4j) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform (Apache Log4j)).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform (Apache Log4j)).  Supported versions that are affected are 8.0.7.9, 8.0.8.7, 8.1.2.5 and  8.1.2.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Apache Log4j)).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Middleware Common Libraries and Tools accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars (Apache Log4j)).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2245V-4.4.0.2.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.1.0.0","P-2245V-4.4.0.3.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.2.0.0.0","P-2245V-4.4.0.4.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.0.0.0","P-2245V-25.4","P-2245V-26.4","P-5242V-12.2.1.4.0","P-2245V-26.10","P-4647(Oracle Middleware Common Libraries and Tools_Third Party)V-12.2.1.4.0","P-9348V-11.4.0","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-4.5.0.0.0","P-10354V-24.12.0-24.12.16","P-4647(Oracle Middleware Common Libraries and Tools_Third Party)V-14.1.2.0.0","P-10354V-22.12.0-22.12.15","P-5680V-8.1.2.5","P-10354V-23.12.0-23.12.16","P-5680V-8.1.2.6","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.1.0.0.0","P-10354V-21.12.0-21.12.17","P-2245V-4.5.0.1.3","P-2245V-25.10","P-5680V-8.0.7.9","P-5680V-8.0.8.7","P-10354V-25.12.0-25.12.9"],"known_not_affected":["P-5(RDBMS-Apache Log4j)V-19.3-19.32","P-5(RDBMS-Apache Log4j)V-23.4.0-23.26.3","P-14634V-26.3-26.8","P-5(RDBMS-Apache Log4j)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Log4j)V-19.3-19.32","P-5(RDBMS-Apache Log4j)V-23.4.0-23.26.3","P-14634V-26.3-26.8","P-5(RDBMS-Apache Log4j)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU370"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-12.2.1.4.0","P-4647(Oracle Middleware Common Libraries and Tools_Third Party)V-12.2.1.4.0","P-4647(Oracle Middleware Common Libraries and Tools_Third Party)V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.1.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.2.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5680V-8.1.2.5","P-5680V-8.1.2.6","P-5680V-8.0.7.9","P-5680V-8.0.8.7"],"url":"https://support.oracle.com/support/?documentId=CPU421"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-2245V-4.4.0.2.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.1.0.0","P-2245V-4.4.0.3.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.2.0.0.0","P-2245V-4.4.0.4.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.0.0.0","P-2245V-25.4","P-2245V-26.4","P-5242V-12.2.1.4.0","P-2245V-26.10","P-4647(Oracle Middleware Common Libraries and Tools_Third Party)V-12.2.1.4.0","P-9348V-11.4.0","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-4.5.0.0.0","P-10354V-24.12.0-24.12.16","P-4647(Oracle Middleware Common Libraries and Tools_Third Party)V-14.1.2.0.0","P-10354V-22.12.0-22.12.15","P-5680V-8.1.2.5","P-10354V-23.12.0-23.12.16","P-5680V-8.1.2.6","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.1.0.0.0","P-10354V-21.12.0-21.12.17","P-2245V-4.5.0.1.3","P-2245V-25.10","P-5680V-8.0.7.9","P-5680V-8.0.8.7","P-10354V-25.12.0-25.12.9"]},{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Log4j)V-19.3-19.32","P-5(RDBMS-Apache Log4j)V-23.4.0-23.26.3","P-14634V-26.3-26.8","P-5(RDBMS-Apache Log4j)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14634V-26.3-26.8"]},{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The vulnerable component is present, and the component contains the vulnerable code. However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.","product_ids":["P-5(RDBMS-Apache Log4j)V-19.3-19.32","P-5(RDBMS-Apache Log4j)V-23.4.0-23.26.3","P-5(RDBMS-Apache Log4j)V-21.3-21.23"]}]},{"cve":"CVE-2026-49975","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications Policy Management","text":"39692059"},{"system_name":"Oracle Bug ID of Oracle Secure Backup","text":"39692067"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"39692055"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Automated Test Suite Framework (Apache HTTP Server)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Policy Management product of Oracle Communications (component: CMP (Apache HTTP Server)).  Supported versions that are affected are 15.0.0.0.0 and  15.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Policy Management.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle Secure Backup (component: Secure Backup (Apache HTTP Server)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200","P-10900V-15.1.0.0.0","P-10900V-15.0.0.0.0"],"known_not_affected":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Automated Test Suite Framework)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10900V-15.0.0.0.0","P-10900V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU403"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-1522V-19.1.0.0.0","P-1522V-19.1.0.1.0"]}]},{"cve":"CVE-2026-50009","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39483464"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Netty)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2026-50010","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39663646"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure (Netty)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-50229","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14069V-26.2.2","P-14069V-25.4.3"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications EAGLE Element Management System","text":"39705161"},{"system_name":"Oracle Bug ID of Oracle Graph Server and Client","text":"39705172"},{"system_name":"Oracle Bug ID of Oracle Hospitality Cruise Shipboard Property Management (SPMS)","text":"39705173"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Policy","text":"39705160"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068469"},{"system_name":"Oracle Bug ID of Oracle Retail Xstore Point of Service","text":"39705177"},{"system_name":"Oracle Bug ID of Oracle Communications Policy Management","text":"39705163"},{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39760530"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Alarms, KPI, and Measurements (Apache Tomcat)).   The supported version that is affected is 25.2.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications Cloud Native Core Policy accessible data as well as  unauthorized read access to a subset of Oracle Communications Cloud Native Core Policy accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE Element Management System product of Oracle Communications (component: Platform (Apache Tomcat)).   The supported version that is affected is 47.0.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE Element Management System.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications EAGLE Element Management System accessible data as well as  unauthorized read access to a subset of Oracle Communications EAGLE Element Management System accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Policy Management product of Oracle Communications (component: CMP (Apache Tomcat)).  Supported versions that are affected are 15.0.0.0.0 and  15.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications Policy Management accessible data as well as  unauthorized read access to a subset of Oracle Communications Policy Management accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle Graph Server and Client (component: Packaging/install issues (Apache Tomcat)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management (SPMS) product of Oracle Hospitality Applications (component: Next-Gen SPMS (Apache Tomcat)).  Supported versions that are affected are 23.1, 23.2 and  23.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Cruise Shipboard Property Management (SPMS).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Shipboard Property Management (SPMS) accessible data as well as  unauthorized read access to a subset of Oracle Hospitality Cruise Shipboard Property Management (SPMS) accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xenvironment (Apache Tomcat)).  Supported versions that are affected are 21.0.5, 22.0.3, 23.0.3, 24.0.2, 25.0.1 and  26.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Point of Service.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Retail Xstore Point of Service accessible data as well as  unauthorized read access to a subset of Oracle Retail Xstore Point of Service accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface (Apache Tomcat)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (Apache Tomcat)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14277V-25.2.200","P-11513V-25.0.1","P-11125V-47.0.0.2.0","P-11513V-22.0.3","P-14597V-7.0.0","P-11705V-23.2","P-11705V-23.1","P-11513V-26.0.0","P-11705V-23.3","P-10900V-15.0.0.0.0","P-11513V-24.0.2","P-11513V-23.0.3","P-9019V-17.0-26.9","P-10900V-15.1.0.0.0","P-11513V-21.0.5"],"known_not_affected":["P-14069V-26.2.2","P-14069V-25.4.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14277V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU406"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11125V-47.0.0.2.0"],"url":"https://support.oracle.com/support/?documentId=CPU399"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10900V-15.0.0.0.0","P-10900V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU403"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14069V-26.2.2","P-14069V-25.4.3"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11705V-23.2","P-11705V-23.1","P-11705V-23.3"],"url":"https://support.oracle.com/support/?documentId=CPU376"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11513V-26.0.0","P-11513V-25.0.1","P-11513V-24.0.2","P-11513V-23.0.3","P-11513V-22.0.3","P-11513V-21.0.5"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14069V-26.2.2","P-14069V-25.4.3"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14069V-26.2.2","P-14069V-25.4.3"]}]},{"cve":"CVE-2026-53404","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14069V-26.2.2","P-14069V-25.4.3"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications EAGLE Element Management System","text":"39705161"},{"system_name":"Oracle Bug ID of Oracle Graph Server and Client","text":"39705172"},{"system_name":"Oracle Bug ID of Oracle Hospitality Cruise Shipboard Property Management (SPMS)","text":"39705173"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Policy","text":"39705160"},{"system_name":"Oracle Bug ID of Oracle Retail Xstore Point of Service","text":"39705177"},{"system_name":"Oracle Bug ID of Oracle Communications Policy Management","text":"39705163"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Alarms, KPI, and Measurements (Apache Tomcat)).   The supported version that is affected is 25.2.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications Cloud Native Core Policy accessible data as well as  unauthorized read access to a subset of Oracle Communications Cloud Native Core Policy accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE Element Management System product of Oracle Communications (component: Platform (Apache Tomcat)).   The supported version that is affected is 47.0.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE Element Management System.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications EAGLE Element Management System accessible data as well as  unauthorized read access to a subset of Oracle Communications EAGLE Element Management System accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Policy Management product of Oracle Communications (component: CMP (Apache Tomcat)).  Supported versions that are affected are 15.0.0.0.0 and  15.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications Policy Management accessible data as well as  unauthorized read access to a subset of Oracle Communications Policy Management accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle Graph Server and Client (component: Packaging/install issues (Apache Tomcat)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management (SPMS) product of Oracle Hospitality Applications (component: Next-Gen SPMS (Apache Tomcat)).  Supported versions that are affected are 23.1, 23.2 and  23.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Cruise Shipboard Property Management (SPMS).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Shipboard Property Management (SPMS) accessible data as well as  unauthorized read access to a subset of Oracle Hospitality Cruise Shipboard Property Management (SPMS) accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xenvironment (Apache Tomcat)).  Supported versions that are affected are 21.0.5, 22.0.3, 23.0.3, 24.0.2, 25.0.1 and  26.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Point of Service.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Retail Xstore Point of Service accessible data as well as  unauthorized read access to a subset of Oracle Retail Xstore Point of Service accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14277V-25.2.200","P-11513V-25.0.1","P-11125V-47.0.0.2.0","P-11513V-22.0.3","P-11705V-23.2","P-11705V-23.1","P-11513V-26.0.0","P-11705V-23.3","P-10900V-15.0.0.0.0","P-11513V-24.0.2","P-11513V-23.0.3","P-10900V-15.1.0.0.0","P-11513V-21.0.5"],"known_not_affected":["P-14069V-26.2.2","P-14069V-25.4.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14277V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU406"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11125V-47.0.0.2.0"],"url":"https://support.oracle.com/support/?documentId=CPU399"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10900V-15.0.0.0.0","P-10900V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU403"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14069V-26.2.2","P-14069V-25.4.3"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11705V-23.2","P-11705V-23.1","P-11705V-23.3"],"url":"https://support.oracle.com/support/?documentId=CPU376"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11513V-26.0.0","P-11513V-25.0.1","P-11513V-24.0.2","P-11513V-23.0.3","P-11513V-22.0.3","P-11513V-21.0.5"],"url":"https://support.oracle.com/support/?documentId=CPU369"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14069V-26.2.2","P-14069V-25.4.3"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14069V-26.2.2","P-14069V-25.4.3"]}]},{"cve":"CVE-2026-53434","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14069V-26.2.2","P-14069V-25.4.3"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications EAGLE Element Management System","text":"39705161"},{"system_name":"Oracle Bug ID of Oracle Graph Server and Client","text":"39705172"},{"system_name":"Oracle Bug ID of Oracle Hospitality Cruise Shipboard Property Management (SPMS)","text":"39705173"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Policy","text":"39705160"},{"system_name":"Oracle Bug ID of Oracle Retail Xstore Point of Service","text":"39705177"},{"system_name":"Oracle Bug ID of Oracle Communications Policy Management","text":"39705163"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Alarms, KPI, and Measurements (Apache Tomcat)).   The supported version that is affected is 25.2.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications Cloud Native Core Policy accessible data as well as  unauthorized read access to a subset of Oracle Communications Cloud Native Core Policy accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE Element Management System product of Oracle Communications (component: Platform (Apache Tomcat)).   The supported version that is affected is 47.0.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE Element Management System.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications EAGLE Element Management System accessible data as well as  unauthorized read access to a subset of Oracle Communications EAGLE Element Management System accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Policy Management product of Oracle Communications (component: CMP (Apache Tomcat)).  Supported versions that are affected are 15.0.0.0.0 and  15.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications Policy Management accessible data as well as  unauthorized read access to a subset of Oracle Communications Policy Management accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle Graph Server and Client (component: Packaging/install issues (Apache Tomcat)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management (SPMS) product of Oracle Hospitality Applications (component: Next-Gen SPMS (Apache Tomcat)).  Supported versions that are affected are 23.1, 23.2 and  23.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Cruise Shipboard Property Management (SPMS).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Shipboard Property Management (SPMS) accessible data as well as  unauthorized read access to a subset of Oracle Hospitality Cruise Shipboard Property Management (SPMS) accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xenvironment (Apache Tomcat)).  Supported versions that are affected are 21.0.5, 22.0.3, 23.0.3, 24.0.2, 25.0.1 and  26.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Point of Service.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Retail Xstore Point of Service accessible data as well as  unauthorized read access to a subset of Oracle Retail Xstore Point of Service accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14277V-25.2.200","P-11513V-25.0.1","P-11125V-47.0.0.2.0","P-11513V-22.0.3","P-11705V-23.2","P-11705V-23.1","P-11513V-26.0.0","P-11705V-23.3","P-10900V-15.0.0.0.0","P-11513V-24.0.2","P-11513V-23.0.3","P-10900V-15.1.0.0.0","P-11513V-21.0.5"],"known_not_affected":["P-14069V-26.2.2","P-14069V-25.4.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14277V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU406"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11125V-47.0.0.2.0"],"url":"https://support.oracle.com/support/?documentId=CPU399"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10900V-15.0.0.0.0","P-10900V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU403"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14069V-26.2.2","P-14069V-25.4.3"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11705V-23.2","P-11705V-23.1","P-11705V-23.3"],"url":"https://support.oracle.com/support/?documentId=CPU376"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11513V-26.0.0","P-11513V-25.0.1","P-11513V-24.0.2","P-11513V-23.0.3","P-11513V-22.0.3","P-11513V-21.0.5"],"url":"https://support.oracle.com/support/?documentId=CPU369"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14069V-26.2.2","P-14069V-25.4.3"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14069V-26.2.2","P-14069V-25.4.3"]}]},{"cve":"CVE-2026-54291","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Console","text":"40113654"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Console product of Oracle Communications (component: Console (PostgreSQL JDBC Driver)).  Supported versions that are affected are 25.2.202 and  26.1.200. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Cloud Native Core Console.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Console accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14250V-26.1.200","P-14250V-25.2.202"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14250V-25.2.202","P-14250V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU405"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-14250V-25.2.202","P-14250V-26.1.200"]}]},{"cve":"CVE-2026-54369","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Network Analytics Data Director","text":"39951622"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Network Analytics Data Director product of Oracle Communications (component: Third Party (libacl)).  Supported versions that are affected are 25.1.200, 25.2.100 and  25.2.200. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Network Analytics Data Director executes to compromise Oracle Communications Network Analytics Data Director.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Network Analytics Data Director accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Network Analytics Data Director accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14547V-25.2.200","P-14547V-25.2.100","P-14547V-25.1.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14547V-25.2.200","P-14547V-25.2.100","P-14547V-25.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU410"}],"scores":[{"cvss_v3":{"baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-14547V-25.2.200","P-14547V-25.2.100","P-14547V-25.1.200"]}]},{"cve":"CVE-2026-54399","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39771662"},{"system_name":"Oracle Bug ID of Oracle Access Manager","text":"39880510"},{"system_name":"Oracle Bug ID of Oracle Essbase","text":"40003201"},{"system_name":"Oracle Bug ID of Oracle SQLcl (Apache HttpComponents)","text":"39880633"},{"system_name":"Oracle Bug ID of Oracle Access Manager","text":"39992521"},{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39953718"},{"system_name":"Oracle Bug ID of Oracle Utilities Application Framework","text":"39925139"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Apache HttpComponents)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Third Party (Apache HttpComponents)).   The supported version that is affected is 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Access Manager. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle SQLcl (Apache HttpComponents) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32, 21.3-21.23 and  23.4.0-23.26.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SQLcl (Apache HttpComponents).  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle SQLcl (Apache HttpComponents). CVSS 3.1 Base Score 3.1 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: Security (Apache HttpClient)).  Supported versions that are affected are 4.4.0.2.0, 4.4.0.3.0, 4.4.0.4.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 4.5.0.2.0, 25.4, 25.10, 26.4 and  26.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Application Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Utilities Application Framework.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server (Apache HttpClient)).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine (Apache HttpComponents)).   The supported version that is affected is 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Access Manager. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in Oracle Essbase (component: Infrastructure (Apache HttpComponents)).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Essbase.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-4647V-14.1.2.0.0","P-5565(Oracle Access Manager_Authentication Engine)V-14.1.2.1.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-5565(Oracle Access Manager_Third Party)V-14.1.2.1.0","P-13824V-23.4.0-23.26.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-4.5.0.0.0","P-13824V-19.3-19.32","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0","P-2245V-4.4.0.4.0","P-13824V-21.3-21.23","P-2245V-4.5.0.1.3","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2245V-25.4","P-2245V-26.4","P-2245V-25.10","P-2245V-26.10"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4647V-14.1.2.0.0","P-5565(Oracle Access Manager_Authentication Engine)V-14.1.2.1.0","P-5565(Oracle Access Manager_Third Party)V-14.1.2.1.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13824V-21.3-21.23","P-4379V-21.8.3.0.0","P-13824V-23.4.0-23.26.3","P-13824V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU370"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-4647V-14.1.2.0.0","P-5565(Oracle Access Manager_Authentication Engine)V-14.1.2.1.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-5565(Oracle Access Manager_Third Party)V-14.1.2.1.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]},{"cvss_v3":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-13824V-21.3-21.23","P-13824V-23.4.0-23.26.3","P-13824V-19.3-19.32"]}]},{"cve":"CVE-2026-54428","ids":[{"system_name":"Oracle Bug ID of Oracle Business Process Management Suite","text":"39896317"},{"system_name":"Oracle Bug ID of Oracle Essbase","text":"40003201"},{"system_name":"Oracle Bug ID of Oracle SQLcl (Apache HttpComponents)","text":"39880633"},{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39953718"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SQLcl (Apache HttpComponents) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32, 21.3-21.23 and  23.4.0-23.26.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SQLcl (Apache HttpComponents).  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle SQLcl (Apache HttpComponents).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Composer (Apache HttpComponents)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business Process Management Suite. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server (Apache HttpClient)).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Billing and Revenue Management.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in Oracle Essbase (component: Infrastructure (Apache HttpComponents)).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13824V-21.3-21.23","P-4379V-21.8.3.0.0","P-5325V-14.1.2.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-13824V-23.4.0-23.26.3","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-5325V-12.2.1.4.0","P-13824V-19.3-19.32","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13824V-21.3-21.23","P-4379V-21.8.3.0.0","P-13824V-23.4.0-23.26.3","P-13824V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5325V-14.1.2.0.0","P-5325V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-4379V-21.8.3.0.0","P-5325V-14.1.2.0.0","P-5325V-12.2.1.4.0"]}]},{"cve":"CVE-2026-5450","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Binding Support Function","text":"40044535"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Binding Support Function product of Oracle Communications (component: Configuration (glibc)).   The supported version that is affected is 25.2.201. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications Cloud Native Core Binding Support Function.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Binding Support Function. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14121V-25.2.201"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14121V-25.2.201"],"url":"https://support.oracle.com/support/?documentId=CPU401"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-14121V-25.2.201"]}]},{"cve":"CVE-2026-54512","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Network Analytics Data Director","text":"39714901"},{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39757371"},{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39662639"},{"system_name":"Oracle Bug ID of Oracle Enterprise Manager Base Platform","text":"39676349"},{"system_name":"Oracle Bug ID of Oracle Utilities Application Framework","text":"39970746"},{"system_name":"Oracle Bug ID of Siebel CRM End User","text":"39657548"},{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39819274"},{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39663750"},{"system_name":"Oracle Bug ID of Siebel CRM Development","text":"39702879"},{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39663592"},{"system_name":"Oracle Bug ID of Oracle Web Services Manager","text":"39846264"},{"system_name":"Oracle Bug ID of Siebel CRM Administration","text":"39663735"},{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"39668524"},{"system_name":"Oracle Bug ID of Oracle Communications Service Catalog and Design","text":"39830925"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Desktop Integration Siebel Agent (Eclipse Jetty)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM End User accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: General (jackson-databind)).  Supported versions that are affected are 24.2.0-26.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure (jackson-databind)).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component: Data Archival (jackson-databind)).  Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Administration.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Administration accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface (jackson-databind)).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server (jackson-databind)).   The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Security Framework (jackson-databind)).  Supported versions that are affected are 13.5 and  24.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Siebel Approval Manager (jackson-databind)).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development.  Successful attacks of this vulnerability can result in takeover of Siebel CRM Development. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Network Analytics Data Director product of Oracle Communications (component: Third Party (jackson-databind)).  Supported versions that are affected are 25.1.200, 25.2.100 and  25.2.200. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Network Analytics Data Director.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Network Analytics Data Director. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Third Party (jackson-databind)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (jackson-databind)).   The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Commerce Platform accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Service Catalog and Design product of Oracle Communications (component: Third Party (jackson-databind)).  Supported versions that are affected are 8.0-8.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Service Catalog and Design.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Service Catalog and Design accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Third Party (jackson-databind)).   The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Services Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Web Services Manager.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: Security (jackson-databind)).  Supported versions that are affected are 4.4.0.2.0, 4.4.0.3.0, 4.4.0.4.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 4.5.0.2.0, 25.4, 25.10, 26.4 and  26.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Application Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Application Framework.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1980V-14.1.2.1.0","P-9001V-17.0-26.9","P-9011V-17.0-26.9","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0","P-14547V-25.2.200","P-14547V-25.2.100","P-1980V-12.2.1.4.0","P-2245V-25.4","P-4461V-9.3.6","P-2245V-26.4","P-9019V-17.0-26.9","P-2245V-26.10","P-1775V-14.1.2.0.0","P-1370V-13.5","P-9348V-11.4.0","P-14547V-25.1.200","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-4.5.0.0.0","P-9456V-24.2.0-26.2.1","P-1370V-24.1","P-9747V-25.12-26.9","P-2245V-4.5.0.1.3","P-2245V-25.10","P-2283V-8.0-8.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9001V-17.0-26.9","P-9747V-25.12-26.9","P-9011V-17.0-26.9","P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.2.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4461V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1370V-24.1","P-1370V-13.5"],"url":"https://support.oracle.com/support/?documentId=CPU391"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14547V-25.2.200","P-14547V-25.2.100","P-14547V-25.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU410"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1980V-14.1.2.1.0","P-1980V-12.2.1.4.0","P-1775V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2283V-8.0-8.3"],"url":"https://support.oracle.com/support/?documentId=CPU363"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU370"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1370V-24.1","P-9001V-17.0-26.9","P-4461V-9.3.6","P-1370V-13.5"]},{"cvss_v3":{"baseScore":6.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-14547V-25.2.200","P-14547V-25.2.100","P-14547V-25.1.200"]}]},{"cve":"CVE-2026-54513","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Network Analytics Data Director","text":"39714901"},{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39757371"},{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39662639"},{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39785583"},{"system_name":"Oracle Bug ID of Oracle Web Services Manager","text":"39927140"},{"system_name":"Oracle Bug ID of Oracle Enterprise Manager Base Platform","text":"39676349"},{"system_name":"Oracle Bug ID of Oracle Utilities Application Framework","text":"39970746"},{"system_name":"Oracle Bug ID of Siebel CRM End User","text":"39657548"},{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39819274"},{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39946480"},{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39663750"},{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39663592"},{"system_name":"Oracle Bug ID of Oracle Web Services Manager","text":"39846264"},{"system_name":"Oracle Bug ID of Siebel CRM Administration","text":"39663735"},{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"39668524"},{"system_name":"Oracle Bug ID of Oracle Communications Service Catalog and Design","text":"39830925"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Desktop Integration Siebel Agent (Eclipse Jetty)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM End User accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: General (jackson-databind)).  Supported versions that are affected are 24.2.0-26.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure (jackson-databind)).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component: Data Archival (jackson-databind)).  Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Administration.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Administration accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface (jackson-databind)).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server (jackson-databind)).   The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Security Framework (jackson-databind)).  Supported versions that are affected are 13.5 and  24.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Network Analytics Data Director product of Oracle Communications (component: Third Party (jackson-databind)).  Supported versions that are affected are 25.1.200, 25.2.100 and  25.2.200. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Network Analytics Data Director.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Network Analytics Data Director.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Third Party (jackson-databind)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Rest Converters (jackson-databind)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (jackson-databind)).   The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Commerce Platform accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Service Catalog and Design product of Oracle Communications (component: Third Party (jackson-databind)).  Supported versions that are affected are 8.0-8.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Service Catalog and Design.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Service Catalog and Design accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Third Party (jackson-databind)).   The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Services Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Web Services Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Third Party (jackson-databind)).   The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Services Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Web Services Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (jackson-databind)).  Supported versions that are affected are 26.1.0.0.0-26.2.0.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle GoldenGate Stream Analytics executes to compromise Oracle GoldenGate Stream Analytics.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle GoldenGate Stream Analytics accessible data. CVSS 3.1 Base Score 2.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: Security (jackson-databind)).  Supported versions that are affected are 4.4.0.2.0, 4.4.0.3.0, 4.4.0.4.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 4.5.0.2.0, 25.4, 25.10, 26.4 and  26.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Application Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Application Framework.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1980V-14.1.2.1.0","P-9011V-17.0-26.9","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-1162V-14.1.2.0.0","P-2245V-4.4.0.4.0","P-14547V-25.2.200","P-14547V-25.2.100","P-1980V-12.2.1.4.0","P-1775(Oracle Web Services Manager_Third Party)V-14.1.2.0.0","P-4461V-9.3.6","P-2245V-25.4","P-2245V-26.4","P-2245V-26.10","P-1370V-13.5","P-9348V-11.4.0","P-14547V-25.1.200","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-4.5.0.0.0","P-9456V-24.2.0-26.2.1","P-1370V-24.1","P-9747V-25.12-26.9","P-2245V-4.5.0.1.3","P-2245V-25.10","P-9019(Siebel CRM Deployment_Application Interface)V-17.0-26.9","P-2283V-8.0-8.3","P-9019(Siebel CRM Deployment_Server Infrastructure)V-17.0-26.9","P-1162V-12.2.1.4.0","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9747V-25.12-26.9","P-9011V-17.0-26.9","P-9019(Siebel CRM Deployment_Application Interface)V-17.0-26.9","P-9019(Siebel CRM Deployment_Server Infrastructure)V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.2.1","P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4461V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1370V-24.1","P-1370V-13.5"],"url":"https://support.oracle.com/support/?documentId=CPU391"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14547V-25.2.200","P-14547V-25.2.100","P-14547V-25.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU410"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1980V-14.1.2.1.0","P-1980V-12.2.1.4.0","P-1775(Oracle Web Services Manager_Third Party)V-14.1.2.0.0","P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2283V-8.0-8.3"],"url":"https://support.oracle.com/support/?documentId=CPU363"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU370"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1980V-14.1.2.1.0","P-1980V-12.2.1.4.0","P-1775(Oracle Web Services Manager_Third Party)V-14.1.2.0.0","P-9019(Siebel CRM Deployment_Application Interface)V-17.0-26.9","P-9019(Siebel CRM Deployment_Server Infrastructure)V-17.0-26.9","P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},{"cvss_v3":{"baseScore":2.9,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2026-54514","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Network Analytics Data Director","text":"39714901"},{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39662639"},{"system_name":"Oracle Bug ID of Siebel CRM Administration","text":"39663735"},{"system_name":"Oracle Bug ID of Oracle Enterprise Manager Base Platform","text":"39676349"},{"system_name":"Oracle Bug ID of Oracle Utilities Application Framework","text":"39970746"},{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39819274"},{"system_name":"Oracle Bug ID of Oracle Communications Service Catalog and Design","text":"39830925"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: General (jackson-databind)).  Supported versions that are affected are 24.2.0-26.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component: Data Archival (jackson-databind)).  Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Administration.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Administration accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Security Framework (jackson-databind)).  Supported versions that are affected are 13.5 and  24.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Network Analytics Data Director product of Oracle Communications (component: Third Party (jackson-databind)).  Supported versions that are affected are 25.1.200, 25.2.100 and  25.2.200. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Network Analytics Data Director.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Network Analytics Data Director.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (jackson-databind)).   The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Commerce Platform accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Service Catalog and Design product of Oracle Communications (component: Third Party (jackson-databind)).  Supported versions that are affected are 8.0-8.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Service Catalog and Design.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Service Catalog and Design accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: Security (jackson-databind)).  Supported versions that are affected are 4.4.0.2.0, 4.4.0.3.0, 4.4.0.4.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 4.5.0.2.0, 25.4, 25.10, 26.4 and  26.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Application Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Application Framework.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9348V-11.4.0","P-14547V-25.1.200","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-4.5.0.0.0","P-9456V-24.2.0-26.2.1","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0","P-14547V-25.2.200","P-1370V-24.1","P-14547V-25.2.100","P-9747V-25.12-26.9","P-2245V-4.5.0.1.3","P-2245V-25.4","P-2245V-26.4","P-2245V-25.10","P-2245V-26.10","P-2283V-8.0-8.3","P-1370V-13.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.2.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9747V-25.12-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1370V-24.1","P-1370V-13.5"],"url":"https://support.oracle.com/support/?documentId=CPU391"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14547V-25.2.200","P-14547V-25.2.100","P-14547V-25.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU410"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2283V-8.0-8.3"],"url":"https://support.oracle.com/support/?documentId=CPU363"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU370"}]},{"cve":"CVE-2026-54515","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Network Analytics Data Director","text":"39714901"},{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39662639"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39793020"},{"system_name":"Oracle Bug ID of Siebel CRM Administration","text":"39663735"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39790342"},{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39953581"},{"system_name":"Oracle Bug ID of Oracle Enterprise Manager Base Platform","text":"39676349"},{"system_name":"Oracle Bug ID of Oracle Utilities Application Framework","text":"39970746"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39935172"},{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39819274"},{"system_name":"Oracle Bug ID of Oracle Communications Service Catalog and Design","text":"39830925"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"39998385"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: General (jackson-databind)).  Supported versions that are affected are 24.2.0-26.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component: Data Archival (jackson-databind)).  Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Administration.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Administration accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Security Framework (jackson-databind)).  Supported versions that are affected are 13.5 and  24.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Network Analytics Data Director product of Oracle Communications (component: Third Party (jackson-databind)).  Supported versions that are affected are 25.1.200, 25.2.100 and  25.2.200. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Network Analytics Data Director.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Network Analytics Data Director.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (jackson-databind)).   The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (jackson-databind)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (jackson-databind)).   The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Commerce Platform accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Service Catalog and Design product of Oracle Communications (component: Third Party (jackson-databind)).  Supported versions that are affected are 8.0-8.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Service Catalog and Design.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Service Catalog and Design accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform (jackson-databind)).  Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server (jackson-databind)).  Supported versions that are affected are 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Billing and Revenue Management accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: Security (jackson-databind)).  Supported versions that are affected are 4.4.0.2.0, 4.4.0.3.0, 4.4.0.4.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 4.5.0.2.0, 25.4, 25.10, 26.4 and  26.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Application Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Application Framework.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the RDBMS (jackson-databind) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32, 21.3-21.23 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where RDBMS (jackson-databind) executes to compromise RDBMS (jackson-databind).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (jackson-databind) accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-12738V-12.2.1.4.0","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0","P-14547V-25.2.200","P-14547V-25.2.100","P-5(RDBMS-jackson-databind)V-23.4.0-23.26.3","P-2245V-25.4","P-2245V-26.4","P-2245V-26.10","P-1370V-13.5","P-9348V-11.4.0","P-14547V-25.1.200","P-12738V-14.1.1.0.0","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-12738V-15.1.1.0.0","P-2245V-4.5.0.0.0","P-9456V-24.2.0-26.2.1","P-10354V-24.12.0-24.12.16","P-5(RDBMS-jackson-databind)V-19.3-19.32","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0","P-12738V-14.1.2.0.0","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-1370V-24.1","P-9747V-25.12-26.9","P-10354V-21.12.0-21.12.17","P-2245V-4.5.0.1.3","P-12738V-14.1.2.1.0","P-2245V-25.10","P-2283V-8.0-8.3","P-5(RDBMS-jackson-databind)V-21.3-21.23","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-jackson-databind)V-23.4.0-23.26.3","P-5(RDBMS-jackson-databind)V-21.3-21.23","P-9456V-24.2.0-26.2.1","P-5(RDBMS-jackson-databind)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9747V-25.12-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1370V-24.1","P-1370V-13.5"],"url":"https://support.oracle.com/support/?documentId=CPU391"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14547V-25.2.200","P-14547V-25.2.100","P-14547V-25.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU410"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2283V-8.0-8.3"],"url":"https://support.oracle.com/support/?documentId=CPU363"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU370"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-9348V-11.4.0","P-9456V-24.2.0-26.2.1"]}]},{"cve":"CVE-2026-54516","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Network Analytics Data Director","text":"39714901"},{"system_name":"Oracle Bug ID of Siebel CRM Administration","text":"39663735"},{"system_name":"Oracle Bug ID of Oracle Utilities Application Framework","text":"39970746"},{"system_name":"Oracle Bug ID of Oracle Communications Service Catalog and Design","text":"39830925"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component: Data Archival (jackson-databind)).  Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Administration.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Administration accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Network Analytics Data Director product of Oracle Communications (component: Third Party (jackson-databind)).  Supported versions that are affected are 25.1.200, 25.2.100 and  25.2.200. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Network Analytics Data Director.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Network Analytics Data Director.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Service Catalog and Design product of Oracle Communications (component: Third Party (jackson-databind)).  Supported versions that are affected are 8.0-8.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Service Catalog and Design.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Service Catalog and Design accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: Security (jackson-databind)).  Supported versions that are affected are 4.4.0.2.0, 4.4.0.3.0, 4.4.0.4.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 4.5.0.2.0, 25.4, 25.10, 26.4 and  26.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Application Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Application Framework.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14547V-25.1.200","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-4.5.0.0.0","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0","P-14547V-25.2.200","P-14547V-25.2.100","P-9747V-25.12-26.9","P-2245V-4.5.0.1.3","P-2245V-25.4","P-2245V-26.4","P-2245V-25.10","P-2245V-26.10","P-2283V-8.0-8.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9747V-25.12-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14547V-25.2.200","P-14547V-25.2.100","P-14547V-25.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU410"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2283V-8.0-8.3"],"url":"https://support.oracle.com/support/?documentId=CPU363"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU370"}]},{"cve":"CVE-2026-54517","ids":[{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39793020"},{"system_name":"Oracle Bug ID of Siebel CRM Administration","text":"39663735"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39790342"},{"system_name":"Oracle Bug ID of Oracle Utilities Application Framework","text":"39970746"},{"system_name":"Oracle Bug ID of Oracle Communications Service Catalog and Design","text":"39830925"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component: Data Archival (jackson-databind)).  Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Administration.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Administration accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (jackson-databind)).   The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (jackson-databind)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Service Catalog and Design product of Oracle Communications (component: Third Party (jackson-databind)).  Supported versions that are affected are 8.0-8.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Service Catalog and Design.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Service Catalog and Design accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: Security (jackson-databind)).  Supported versions that are affected are 4.4.0.2.0, 4.4.0.3.0, 4.4.0.4.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 4.5.0.2.0, 25.4, 25.10, 26.4 and  26.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Application Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Application Framework.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-12738V-15.1.1.0.0","P-2245V-4.5.0.0.0","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0","P-12738V-14.1.2.0.0","P-9747V-25.12-26.9","P-2245V-4.5.0.1.3","P-12738V-14.1.2.1.0","P-2245V-25.4","P-2245V-26.4","P-2245V-25.10","P-2245V-26.10","P-2283V-8.0-8.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9747V-25.12-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2283V-8.0-8.3"],"url":"https://support.oracle.com/support/?documentId=CPU363"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU370"}]},{"cve":"CVE-2026-54518","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Network Analytics Data Director","text":"39714901"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39793020"},{"system_name":"Oracle Bug ID of Siebel CRM Administration","text":"39663735"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39790342"},{"system_name":"Oracle Bug ID of Oracle Utilities Application Framework","text":"39970746"},{"system_name":"Oracle Bug ID of Oracle Communications Service Catalog and Design","text":"39830925"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component: Data Archival (jackson-databind)).  Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Administration.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Administration accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Network Analytics Data Director product of Oracle Communications (component: Third Party (jackson-databind)).  Supported versions that are affected are 25.1.200, 25.2.100 and  25.2.200. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Network Analytics Data Director.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Network Analytics Data Director.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (jackson-databind)).   The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (jackson-databind)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Service Catalog and Design product of Oracle Communications (component: Third Party (jackson-databind)).  Supported versions that are affected are 8.0-8.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Service Catalog and Design.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Service Catalog and Design accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: Security (jackson-databind)).  Supported versions that are affected are 4.4.0.2.0, 4.4.0.3.0, 4.4.0.4.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 4.5.0.2.0, 25.4, 25.10, 26.4 and  26.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Application Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Application Framework.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14547V-25.1.200","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-12738V-15.1.1.0.0","P-2245V-4.5.0.0.0","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0","P-12738V-14.1.2.0.0","P-14547V-25.2.200","P-14547V-25.2.100","P-9747V-25.12-26.9","P-2245V-4.5.0.1.3","P-12738V-14.1.2.1.0","P-2245V-25.4","P-2245V-26.4","P-2245V-25.10","P-2245V-26.10","P-2283V-8.0-8.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9747V-25.12-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14547V-25.2.200","P-14547V-25.2.100","P-14547V-25.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU410"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2283V-8.0-8.3"],"url":"https://support.oracle.com/support/?documentId=CPU363"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU370"}]},{"cve":"CVE-2026-54874","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"},{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39525775"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Certificate Management","text":"40119533"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40009481"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security (OpenSSL)).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Business Intelligence Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the RDBMS (OpenSSL) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise RDBMS (OpenSSL).  Successful attacks of this vulnerability can result in takeover of RDBMS (OpenSSL).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Certificate Management product of Oracle Communications (component: Configuration (OpenSSL)).  Supported versions that are affected are 25.2.201 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications Cloud Native Core Certificate Management.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Certificate Management. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14868V-25.2.201","P-5(RDBMS-OpenSSL)V-23.4.0-23.26.3","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-14868V-26.1.200","P-2025V-8.2.0.0.0","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-2025V-26.01.0.0.0","P-4629V-9.7.0-9.7.3","P-5(RDBMS-OpenSSL)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-OpenSSL)V-23.4.0-23.26.3","P-5(RDBMS-OpenSSL)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14868V-25.2.201","P-14868V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU411"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-14868V-25.2.201","P-14868V-26.1.200"]}]},{"cve":"CVE-2026-54876","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Certificate Management","text":"40119533"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Certificate Management product of Oracle Communications (component: Configuration (OpenSSL)).  Supported versions that are affected are 25.2.201 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications Cloud Native Core Certificate Management.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Certificate Management.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14868V-26.1.200","P-14868V-25.2.201"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14868V-25.2.201","P-14868V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU411"}]},{"cve":"CVE-2026-54890","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40014104"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Erlang/OTP)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-54904","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40063671"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Ruby)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-54905","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40063671"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Ruby)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-54906","ids":[{"system_name":"Oracle Bug ID of Siebel CRM End User","text":"39657868"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40063671"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI (Ruby)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in takeover of Siebel CRM End User. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Ruby)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0","P-9011V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9011V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-9011V-17.0-26.9","P-14597V-6.1.1-7.0.0"]}]},{"cve":"CVE-2026-55199","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39744923"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: File Processing (libssh2)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-55200","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39744923"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: File Processing (libssh2)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":8.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-55276","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14069V-26.2.2","P-14069V-25.4.3"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications EAGLE Element Management System","text":"39705161"},{"system_name":"Oracle Bug ID of Oracle Graph Server and Client","text":"39705172"},{"system_name":"Oracle Bug ID of Oracle Hospitality Cruise Shipboard Property Management (SPMS)","text":"39705173"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Policy","text":"39705160"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068469"},{"system_name":"Oracle Bug ID of Oracle Retail Xstore Point of Service","text":"39705177"},{"system_name":"Oracle Bug ID of Oracle Communications Policy Management","text":"39705163"},{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39760530"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Alarms, KPI, and Measurements (Apache Tomcat)).   The supported version that is affected is 25.2.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications Cloud Native Core Policy accessible data as well as  unauthorized read access to a subset of Oracle Communications Cloud Native Core Policy accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE Element Management System product of Oracle Communications (component: Platform (Apache Tomcat)).   The supported version that is affected is 47.0.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE Element Management System.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications EAGLE Element Management System accessible data as well as  unauthorized read access to a subset of Oracle Communications EAGLE Element Management System accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Policy Management product of Oracle Communications (component: CMP (Apache Tomcat)).  Supported versions that are affected are 15.0.0.0.0 and  15.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications Policy Management accessible data as well as  unauthorized read access to a subset of Oracle Communications Policy Management accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle Graph Server and Client (component: Packaging/install issues (Apache Tomcat)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management (SPMS) product of Oracle Hospitality Applications (component: Next-Gen SPMS (Apache Tomcat)).  Supported versions that are affected are 23.1, 23.2 and  23.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Cruise Shipboard Property Management (SPMS).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Shipboard Property Management (SPMS) accessible data as well as  unauthorized read access to a subset of Oracle Hospitality Cruise Shipboard Property Management (SPMS) accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xenvironment (Apache Tomcat)).  Supported versions that are affected are 21.0.5, 22.0.3, 23.0.3, 24.0.2, 25.0.1 and  26.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Point of Service.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Retail Xstore Point of Service accessible data as well as  unauthorized read access to a subset of Oracle Retail Xstore Point of Service accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface (Apache Tomcat)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (Apache Tomcat)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14277V-25.2.200","P-11513V-25.0.1","P-11125V-47.0.0.2.0","P-11513V-22.0.3","P-14597V-7.0.0","P-11705V-23.2","P-11705V-23.1","P-11513V-26.0.0","P-11705V-23.3","P-10900V-15.0.0.0.0","P-11513V-24.0.2","P-11513V-23.0.3","P-9019V-17.0-26.9","P-10900V-15.1.0.0.0","P-11513V-21.0.5"],"known_not_affected":["P-14069V-26.2.2","P-14069V-25.4.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14277V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU406"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11125V-47.0.0.2.0"],"url":"https://support.oracle.com/support/?documentId=CPU399"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10900V-15.0.0.0.0","P-10900V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU403"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14069V-26.2.2","P-14069V-25.4.3"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11705V-23.2","P-11705V-23.1","P-11705V-23.3"],"url":"https://support.oracle.com/support/?documentId=CPU376"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11513V-26.0.0","P-11513V-25.0.1","P-11513V-24.0.2","P-11513V-23.0.3","P-11513V-22.0.3","P-11513V-21.0.5"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14069V-26.2.2","P-14069V-25.4.3"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14069V-26.2.2","P-14069V-25.4.3"]}]},{"cve":"CVE-2026-5545","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-55737","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40014104"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Erlang/OTP)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-55831","ids":[{"system_name":"Oracle Bug ID of Oracle Retail Xstore Point of Service","text":"40015840"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"40114553"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xenvironment (Netty)).  Supported versions that are affected are 22.0.3, 23.0.3 and  24.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Point of Service.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Retail Xstore Point of Service.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Signaling (Netty)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Security Edge Protection Proxy. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-11513V-23.0.3","P-11513V-22.0.3","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200","P-14597V-6.1.1-7.0.0","P-11513V-24.0.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11513V-24.0.2","P-11513V-23.0.3","P-11513V-22.0.3"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200"]}]},{"cve":"CVE-2026-55833","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"40114553"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Signaling (Netty)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200","P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"}]},{"cve":"CVE-2026-55851","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-55858","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Console","text":"40113279"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Console product of Oracle Communications (component: Configuration (JDBC)).  Supported versions that are affected are 25.2.202 and  26.1.200. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Communications Cloud Native Core Console.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Console accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14250V-26.1.200","P-14250V-25.2.202"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14250V-25.2.202","P-14250V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU405"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-14250V-25.2.202","P-14250V-26.1.200"]}]},{"cve":"CVE-2026-5588","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39894904"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Bouncy Castle Java Library)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2026-55953","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40014104"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Erlang/OTP)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-55955","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14069V-26.2.2","P-14069V-25.4.3"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications EAGLE Element Management System","text":"39705161"},{"system_name":"Oracle Bug ID of Oracle Graph Server and Client","text":"39705172"},{"system_name":"Oracle Bug ID of Oracle Hospitality Cruise Shipboard Property Management (SPMS)","text":"39705173"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Policy","text":"39705160"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068469"},{"system_name":"Oracle Bug ID of Oracle Retail Xstore Point of Service","text":"39705177"},{"system_name":"Oracle Bug ID of Oracle Communications Policy Management","text":"39705163"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Alarms, KPI, and Measurements (Apache Tomcat)).   The supported version that is affected is 25.2.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications Cloud Native Core Policy accessible data as well as  unauthorized read access to a subset of Oracle Communications Cloud Native Core Policy accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE Element Management System product of Oracle Communications (component: Platform (Apache Tomcat)).   The supported version that is affected is 47.0.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE Element Management System.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications EAGLE Element Management System accessible data as well as  unauthorized read access to a subset of Oracle Communications EAGLE Element Management System accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Policy Management product of Oracle Communications (component: CMP (Apache Tomcat)).  Supported versions that are affected are 15.0.0.0.0 and  15.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications Policy Management accessible data as well as  unauthorized read access to a subset of Oracle Communications Policy Management accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle Graph Server and Client (component: Packaging/install issues (Apache Tomcat)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management (SPMS) product of Oracle Hospitality Applications (component: Next-Gen SPMS (Apache Tomcat)).  Supported versions that are affected are 23.1, 23.2 and  23.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Cruise Shipboard Property Management (SPMS).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Shipboard Property Management (SPMS) accessible data as well as  unauthorized read access to a subset of Oracle Hospitality Cruise Shipboard Property Management (SPMS) accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xenvironment (Apache Tomcat)).  Supported versions that are affected are 21.0.5, 22.0.3, 23.0.3, 24.0.2, 25.0.1 and  26.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Point of Service.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Retail Xstore Point of Service accessible data as well as  unauthorized read access to a subset of Oracle Retail Xstore Point of Service accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (Apache Tomcat)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14277V-25.2.200","P-11513V-25.0.1","P-11125V-47.0.0.2.0","P-11513V-22.0.3","P-14597V-7.0.0","P-11705V-23.2","P-11705V-23.1","P-11513V-26.0.0","P-11705V-23.3","P-10900V-15.0.0.0.0","P-11513V-24.0.2","P-11513V-23.0.3","P-10900V-15.1.0.0.0","P-11513V-21.0.5"],"known_not_affected":["P-14069V-26.2.2","P-14069V-25.4.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14277V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU406"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11125V-47.0.0.2.0"],"url":"https://support.oracle.com/support/?documentId=CPU399"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10900V-15.0.0.0.0","P-10900V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU403"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14069V-26.2.2","P-14069V-25.4.3"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11705V-23.2","P-11705V-23.1","P-11705V-23.3"],"url":"https://support.oracle.com/support/?documentId=CPU376"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11513V-26.0.0","P-11513V-25.0.1","P-11513V-24.0.2","P-11513V-23.0.3","P-11513V-22.0.3","P-11513V-21.0.5"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14069V-26.2.2","P-14069V-25.4.3"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14069V-26.2.2","P-14069V-25.4.3"]}]},{"cve":"CVE-2026-55956","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14069V-26.2.2","P-14069V-25.4.3"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications EAGLE Element Management System","text":"39705161"},{"system_name":"Oracle Bug ID of Oracle Graph Server and Client","text":"39705172"},{"system_name":"Oracle Bug ID of Oracle Hospitality Cruise Shipboard Property Management (SPMS)","text":"39705173"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Policy","text":"39705160"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068469"},{"system_name":"Oracle Bug ID of Oracle Retail Xstore Point of Service","text":"39705177"},{"system_name":"Oracle Bug ID of Oracle Communications Policy Management","text":"39705163"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Policy product of Oracle Communications (component: Alarms, KPI, and Measurements (Apache Tomcat)).   The supported version that is affected is 25.2.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Policy.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications Cloud Native Core Policy accessible data as well as  unauthorized read access to a subset of Oracle Communications Cloud Native Core Policy accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE Element Management System product of Oracle Communications (component: Platform (Apache Tomcat)).   The supported version that is affected is 47.0.0.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE Element Management System.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications EAGLE Element Management System accessible data as well as  unauthorized read access to a subset of Oracle Communications EAGLE Element Management System accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Policy Management product of Oracle Communications (component: CMP (Apache Tomcat)).  Supported versions that are affected are 15.0.0.0.0 and  15.1.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Policy Management.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications Policy Management accessible data as well as  unauthorized read access to a subset of Oracle Communications Policy Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in Oracle Graph Server and Client (component: Packaging/install issues (Apache Tomcat)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Hospitality Cruise Shipboard Property Management (SPMS) product of Oracle Hospitality Applications (component: Next-Gen SPMS (Apache Tomcat)).  Supported versions that are affected are 23.1, 23.2 and  23.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Cruise Shipboard Property Management (SPMS).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Hospitality Cruise Shipboard Property Management (SPMS) accessible data as well as  unauthorized read access to a subset of Oracle Hospitality Cruise Shipboard Property Management (SPMS) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xenvironment (Apache Tomcat)).  Supported versions that are affected are 21.0.5, 22.0.3, 23.0.3, 24.0.2, 25.0.1 and  26.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Point of Service.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Retail Xstore Point of Service accessible data as well as  unauthorized read access to a subset of Oracle Retail Xstore Point of Service accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (Apache Tomcat)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14277V-25.2.200","P-11513V-25.0.1","P-11125V-47.0.0.2.0","P-11513V-22.0.3","P-14597V-7.0.0","P-11705V-23.2","P-11705V-23.1","P-11513V-26.0.0","P-11705V-23.3","P-10900V-15.0.0.0.0","P-11513V-24.0.2","P-11513V-23.0.3","P-10900V-15.1.0.0.0","P-11513V-21.0.5"],"known_not_affected":["P-14069V-26.2.2","P-14069V-25.4.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14277V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU406"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11125V-47.0.0.2.0"],"url":"https://support.oracle.com/support/?documentId=CPU399"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10900V-15.0.0.0.0","P-10900V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU403"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14069V-26.2.2","P-14069V-25.4.3"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11705V-23.2","P-11705V-23.1","P-11705V-23.3"],"url":"https://support.oracle.com/support/?documentId=CPU376"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11513V-26.0.0","P-11513V-25.0.1","P-11513V-24.0.2","P-11513V-23.0.3","P-11513V-22.0.3","P-11513V-21.0.5"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-14277V-25.2.200","P-11513V-25.0.1","P-11125V-47.0.0.2.0","P-11513V-22.0.3","P-11705V-23.2","P-11705V-23.1","P-11513V-26.0.0","P-11705V-23.3","P-10900V-15.0.0.0.0","P-11513V-24.0.2","P-11513V-23.0.3","P-10900V-15.1.0.0.0","P-11513V-21.0.5"]},{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14069V-26.2.2","P-14069V-25.4.3"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14069V-26.2.2","P-14069V-25.4.3"]}]},{"cve":"CVE-2026-55957","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068469"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (Apache Tomcat)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-55968","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-55969","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-55970","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-55971","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40014104"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Erlang/OTP)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0","P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0","P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-14597V-7.0.0"]}]},{"cve":"CVE-2026-5598","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39785588"},{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39436464"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Rest Converters (Bouncy Castle Java Library)).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-56091","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038090"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Shiro)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-56130","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40038090"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Shiro)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-14597V-6.1.1-7.0.0"]}]},{"cve":"CVE-2026-56452","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(Clusterware-Apache MINA SSHD)V-23.4.0-23.26.3","P-5(Clusterware-Apache MINA SSHD)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"39953375"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Clusterware (Apache MINA SSHD) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-5(Clusterware-Apache MINA SSHD)V-23.4.0-23.26.3","P-5(Clusterware-Apache MINA SSHD)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(Clusterware-Apache MINA SSHD)V-23.4.0-23.26.3","P-5(Clusterware-Apache MINA SSHD)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(Clusterware-Apache MINA SSHD)V-23.4.0-23.26.3","P-5(Clusterware-Apache MINA SSHD)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(Clusterware-Apache MINA SSHD)V-23.4.0-23.26.3","P-5(Clusterware-Apache MINA SSHD)V-21.3-21.23"]}]},{"cve":"CVE-2026-56623","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(Clusterware-Apache MINA SSHD)V-23.4.0-23.26.3","P-5(Clusterware-Apache MINA SSHD)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"39953375"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Clusterware (Apache MINA SSHD) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-5(Clusterware-Apache MINA SSHD)V-23.4.0-23.26.3","P-5(Clusterware-Apache MINA SSHD)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(Clusterware-Apache MINA SSHD)V-23.4.0-23.26.3","P-5(Clusterware-Apache MINA SSHD)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(Clusterware-Apache MINA SSHD)V-23.4.0-23.26.3","P-5(Clusterware-Apache MINA SSHD)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(Clusterware-Apache MINA SSHD)V-23.4.0-23.26.3","P-5(Clusterware-Apache MINA SSHD)V-21.3-21.23"]}]},{"cve":"CVE-2026-56624","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(Clusterware-Apache MINA SSHD)V-23.4.0-23.26.3","P-5(Clusterware-Apache MINA SSHD)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"39953375"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Clusterware (Apache MINA SSHD) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-5(Clusterware-Apache MINA SSHD)V-23.4.0-23.26.3","P-5(Clusterware-Apache MINA SSHD)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(Clusterware-Apache MINA SSHD)V-23.4.0-23.26.3","P-5(Clusterware-Apache MINA SSHD)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(Clusterware-Apache MINA SSHD)V-23.4.0-23.26.3","P-5(Clusterware-Apache MINA SSHD)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(Clusterware-Apache MINA SSHD)V-23.4.0-23.26.3","P-5(Clusterware-Apache MINA SSHD)V-21.3-21.23"]}]},{"cve":"CVE-2026-56684","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"39940096"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (valkey)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-56740","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39953600"},{"system_name":"Oracle Bug ID of Oracle Coherence","text":"39687215"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars (jline)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server (jline)).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2545V-14.1.1.0.0","P-2545V-12.2.1.4.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2545V-12.2.1.4.0","P-2545V-14.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]}]},{"cve":"CVE-2026-56741","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-jline)V-21.3-21.23","P-5(RDBMS-jline)V-23.4.0-23.26.3","P-5(RDBMS-jline)V-19.3-19.32"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39953600"},{"system_name":"Oracle Bug ID of Oracle Coherence","text":"39687215"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"39777790"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars (jline)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the RDBMS (jline) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server (jline)).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Billing and Revenue Management.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2545V-14.1.1.0.0","P-2545V-12.2.1.4.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"],"known_not_affected":["P-5(RDBMS-jline)V-21.3-21.23","P-5(RDBMS-jline)V-23.4.0-23.26.3","P-5(RDBMS-jline)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2545V-12.2.1.4.0","P-2545V-14.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-jline)V-21.3-21.23","P-5(RDBMS-jline)V-23.4.0-23.26.3","P-5(RDBMS-jline)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-2545V-12.2.1.4.0","P-2545V-14.1.1.0.0"]},{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-jline)V-21.3-21.23","P-5(RDBMS-jline)V-23.4.0-23.26.3","P-5(RDBMS-jline)V-19.3-19.32"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-jline)V-21.3-21.23","P-5(RDBMS-jline)V-23.4.0-23.26.3","P-5(RDBMS-jline)V-19.3-19.32"]}]},{"cve":"CVE-2026-56745","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"40114553"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Signaling (Netty)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200","P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"}]},{"cve":"CVE-2026-56746","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"40114553"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Signaling (Netty)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200","P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"}]},{"cve":"CVE-2026-56816","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-56817","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-56819","ids":[{"system_name":"Oracle Bug ID of Oracle Retail Xstore Point of Service","text":"40015840"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"40114553"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xenvironment (Netty)).  Supported versions that are affected are 22.0.3, 23.0.3 and  24.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Point of Service.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Retail Xstore Point of Service.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Signaling (Netty)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-11513V-24.0.2","P-11513V-23.0.3","P-11513V-22.0.3","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200","P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11513V-24.0.2","P-11513V-23.0.3","P-11513V-22.0.3"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"}]},{"cve":"CVE-2026-56820","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-56821","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-56822","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-56846","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-56847","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-56848","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-56850","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-5704","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Console","text":"40113889"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Console product of Oracle Communications (component: Configuration (node-tar)).  Supported versions that are affected are 25.2.202 and  26.1.200. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Cloud Native Core Console executes to compromise Oracle Communications Cloud Native Core Console.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Console accessible data. CVSS 3.1 Base Score 5.0 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14250V-26.1.200","P-14250V-25.2.202"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14250V-25.2.202","P-14250V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU405"}],"scores":[{"cvss_v3":{"baseScore":5.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-14250V-25.2.202","P-14250V-26.1.200"]}]},{"cve":"CVE-2026-57234","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-57235","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-57236","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-57432","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"39861227"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Perl)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-57435","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-57436","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-57437","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-57438","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-5773","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-5795","ids":[{"system_name":"Oracle Bug ID of Oracle Communications EAGLE Element Management System","text":"39311780"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications EAGLE Element Management System product of Oracle Communications (component: Security (Eclipse Jetty)).   The supported version that is affected is 47.0.0.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications EAGLE Element Management System.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications EAGLE Element Management System accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications EAGLE Element Management System accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-11125V-47.0.0.2.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11125V-47.0.0.2.0"],"url":"https://support.oracle.com/support/?documentId=CPU399"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-11125V-47.0.0.2.0"]}]},{"cve":"CVE-2026-58014","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Network Analytics Data Director","text":"39951201"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Network Analytics Data Director product of Oracle Communications (component: Third Party (glib)).  Supported versions that are affected are 25.1.200, 25.2.100 and  25.2.200. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Network Analytics Data Director.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Communications Network Analytics Data Director accessible data as well as  unauthorized read access to a subset of Oracle Communications Network Analytics Data Director accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Communications Network Analytics Data Director. CVSS 3.1 Base Score 5.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14547V-25.2.200","P-14547V-25.2.100","P-14547V-25.1.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14547V-25.2.200","P-14547V-25.2.100","P-14547V-25.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU410"}],"scores":[{"cvss_v3":{"baseScore":5.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-14547V-25.2.200","P-14547V-25.2.100","P-14547V-25.1.200"]}]},{"cve":"CVE-2026-58016","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Console","text":"40119220"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Binding Support Function","text":"40044535"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Certificate Management","text":"40119182"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Binding Support Function product of Oracle Communications (component: Configuration (glibc)).   The supported version that is affected is 25.2.201. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications Cloud Native Core Binding Support Function.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Binding Support Function.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Certificate Management product of Oracle Communications (component: Configuration (glib)).   The supported version that is affected is 26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Certificate Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Certificate Management accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Certificate Management. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Console product of Oracle Communications (component: Console (glib)).  Supported versions that are affected are 25.2.202 and 26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Console.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Console accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Console. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14868V-26.1.200","P-14250V-25.2.202","P-14121V-25.2.201","P-14250V-26.1.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14121V-25.2.201"],"url":"https://support.oracle.com/support/?documentId=CPU401"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14868V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU411"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14250V-25.2.202","P-14250V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU405"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"products":["P-14250V-25.2.202","P-14250V-26.1.200","P-14868V-26.1.200"]}]},{"cve":"CVE-2026-58023","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-58039","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-58041","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-58042","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-58043","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-58044","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-58045","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40027712"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Node.js)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Assurance executes to compromise Oracle Communications Unified Assurance.  While the vulnerability is in Oracle Communications Unified Assurance, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-58050","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39744923"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: File Processing (libssh2)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-58051","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39744923"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: File Processing (libssh2)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-58059","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39989976"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (Bouncy Castle Java Library)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-58060","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39989976"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (Bouncy Castle Java Library)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-58061","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39989976"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (Bouncy Castle Java Library)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-58062","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39989976"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (Bouncy Castle Java Library)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-58063","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39989976"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (Bouncy Castle Java Library)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-58227","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40014104"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Erlang/OTP)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-58389","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40006598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache Thrift)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance. CVSS 3.1 Base Score 9.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"products":["P-14597V-6.1.1-7.0.0"]}]},{"cve":"CVE-2026-58624","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(Clusterware-Apache MINA SSHD)V-23.4.0-23.26.3","P-5(Clusterware-Apache MINA SSHD)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"39953375"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Clusterware (Apache MINA SSHD) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-5(Clusterware-Apache MINA SSHD)V-23.4.0-23.26.3","P-5(Clusterware-Apache MINA SSHD)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(Clusterware-Apache MINA SSHD)V-23.4.0-23.26.3","P-5(Clusterware-Apache MINA SSHD)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(Clusterware-Apache MINA SSHD)V-23.4.0-23.26.3","P-5(Clusterware-Apache MINA SSHD)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(Clusterware-Apache MINA SSHD)V-23.4.0-23.26.3","P-5(Clusterware-Apache MINA SSHD)V-21.3-21.23"]}]},{"cve":"CVE-2026-59083","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068469"},{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39760530"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface (Apache Tomcat)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (Apache Tomcat)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0","P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-59250","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40014104"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Erlang/OTP)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-59251","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40014104"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Erlang/OTP)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-5928","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"40119916"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Install (glibc)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Security Edge Protection Proxy. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-26.1.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-25.2.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-26.1.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-26.1.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-25.2.200"]}]},{"cve":"CVE-2026-59280","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"component_not_present","product_ids":["P-9348V-11.4.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39711683"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (Spring Framework)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"known_not_affected":["P-9348V-11.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-9348V-11.4.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The software is not affected because the vulnerable component is not in the product.","product_ids":["P-9348V-11.4.0"]}]},{"cve":"CVE-2026-59281","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"component_not_present","product_ids":["P-9348V-11.4.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39711683"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (Spring Framework)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"known_not_affected":["P-9348V-11.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-9348V-11.4.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The software is not affected because the vulnerable component is not in the product.","product_ids":["P-9348V-11.4.0"]}]},{"cve":"CVE-2026-59282","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"component_not_present","product_ids":["P-9348V-11.4.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39711683"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (Spring Framework)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"known_not_affected":["P-9348V-11.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-9348V-11.4.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The software is not affected because the vulnerable component is not in the product.","product_ids":["P-9348V-11.4.0"]}]},{"cve":"CVE-2026-59283","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"component_not_present","product_ids":["P-9348V-11.4.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39711683"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (Spring Framework)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"known_not_affected":["P-9348V-11.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-9348V-11.4.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The software is not affected because the vulnerable component is not in the product.","product_ids":["P-9348V-11.4.0"]}]},{"cve":"CVE-2026-59313","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"component_not_present","product_ids":["P-9348V-11.4.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39711683"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (Spring Framework)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"known_not_affected":["P-9348V-11.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-9348V-11.4.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The software is not affected because the vulnerable component is not in the product.","product_ids":["P-9348V-11.4.0"]}]},{"cve":"CVE-2026-59314","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"component_not_present","product_ids":["P-9348V-11.4.0"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Commerce Platform","text":"39711683"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39562575"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document Management (Spring Framework)).  Supported versions that are affected are 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework (Spring Framework)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"known_not_affected":["P-9348V-11.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9348V-11.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU416"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-9348V-11.4.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The software is not affected because the vulnerable component is not in the product.","product_ids":["P-9348V-11.4.0"]}]},{"cve":"CVE-2026-59639","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4647V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4647V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-59642","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4647V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4647V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-59645","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"},{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"40052139"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars (Bouncy Castle Java Library)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server as well as  unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data and  unauthorized read access to a subset of Oracle WebLogic Server accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5242V-12.2.1.4.0","P-4647V-14.1.2.0.0","P-5242V-14.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4647V-14.1.2.0.0","P-5242V-14.1.1.0.0","P-5242V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-59647","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4647V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4647V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-59649","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4647V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4647V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-4647V-14.1.2.0.0"]}]},{"cve":"CVE-2026-59650","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39989976"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (Bouncy Castle Java Library)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-59651","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39989976"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (Bouncy Castle Java Library)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-59652","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39989976"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (Bouncy Castle Java Library)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Global Lifecycle Management NextGen OUI Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-59696","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40014104"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Erlang/OTP)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-59739","ids":[{"system_name":"Oracle Bug ID of Primavera Unifier","text":"40063078"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform (Apache ZooKeeper)).  Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"}]},{"cve":"CVE-2026-59888","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Administration","text":"39663735"},{"system_name":"Oracle Bug ID of Oracle Utilities Application Framework","text":"39970746"},{"system_name":"Oracle Bug ID of Oracle Communications Service Catalog and Design","text":"39830925"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component: Data Archival (jackson-databind)).  Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Administration.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Administration accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Service Catalog and Design product of Oracle Communications (component: Third Party (jackson-databind)).  Supported versions that are affected are 8.0-8.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Service Catalog and Design.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Service Catalog and Design accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: Security (jackson-databind)).  Supported versions that are affected are 4.4.0.2.0, 4.4.0.3.0, 4.4.0.4.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 4.5.0.2.0, 25.4, 25.10, 26.4 and  26.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Application Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Application Framework.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-4.5.0.0.0","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0","P-9747V-25.12-26.9","P-2245V-4.5.0.1.3","P-2245V-25.4","P-2245V-26.4","P-2245V-25.10","P-2245V-26.10","P-2283V-8.0-8.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9747V-25.12-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2283V-8.0-8.3"],"url":"https://support.oracle.com/support/?documentId=CPU363"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU370"}]},{"cve":"CVE-2026-59889","ids":[{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39793020"},{"system_name":"Oracle Bug ID of Siebel CRM Administration","text":"39663735"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39790342"},{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39953581"},{"system_name":"Oracle Bug ID of Oracle Enterprise Manager Base Platform","text":"39676349"},{"system_name":"Oracle Bug ID of Oracle Utilities Application Framework","text":"39970746"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39935172"},{"system_name":"Oracle Bug ID of Oracle Communications Service Catalog and Design","text":"39830925"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"39998385"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component: Data Archival (jackson-databind)).  Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Administration.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Administration accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Security Framework (jackson-databind)).  Supported versions that are affected are 13.5 and  24.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Manager Base Platform.  Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (jackson-databind)).   The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (jackson-databind)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Service Catalog and Design product of Oracle Communications (component: Third Party (jackson-databind)).  Supported versions that are affected are 8.0-8.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Service Catalog and Design.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Service Catalog and Design accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform (jackson-databind)).  Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server (jackson-databind)).  Supported versions that are affected are 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: Security (jackson-databind)).  Supported versions that are affected are 4.4.0.2.0, 4.4.0.3.0, 4.4.0.4.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 4.5.0.2.0, 25.4, 25.10, 26.4 and  26.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Application Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Application Framework.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the RDBMS (jackson-databind) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32, 21.3-21.23 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where RDBMS (jackson-databind) executes to compromise RDBMS (jackson-databind).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (jackson-databind) accessible data. CVSS 3.1 Base Score 6.2 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer)V-12.2.1.4.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0","P-5(RDBMS-jackson-databind)V-23.4.0-23.26.3","P-2245V-25.4","P-2245V-26.4","P-2245V-26.10","P-1370V-13.5","P-12738(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer)V-14.1.1.0.0","P-12738(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer)V-15.1.1.0.0","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-4.5.0.0.0","P-10354V-24.12.0-24.12.16","P-5(RDBMS-jackson-databind)V-19.3-19.32","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-1370V-24.1","P-12738(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer)V-14.1.2.1.0","P-12738(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer)V-14.1.2.0.0","P-9747V-25.12-26.9","P-10354V-21.12.0-21.12.17","P-2245V-4.5.0.1.3","P-2245V-25.10","P-2283V-8.0-8.3","P-5(RDBMS-jackson-databind)V-21.3-21.23","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9747V-25.12-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1370V-24.1","P-1370V-13.5"],"url":"https://support.oracle.com/support/?documentId=CPU391"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer)V-14.1.1.0.0","P-12738(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer)V-15.1.1.0.0","P-12738(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer)V-14.1.2.1.0","P-12738(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer)V-14.1.2.0.0","P-12738(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer)V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2283V-8.0-8.3"],"url":"https://support.oracle.com/support/?documentId=CPU363"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU370"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-jackson-databind)V-23.4.0-23.26.3","P-5(RDBMS-jackson-databind)V-21.3-21.23","P-5(RDBMS-jackson-databind)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-12738(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer)V-14.1.1.0.0","P-12738(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer)V-15.1.1.0.0","P-12738(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer)V-14.1.2.1.0","P-12738(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer)V-14.1.2.0.0","P-9747V-25.12-26.9","P-12738(Oracle Global Lifecycle Management NextGen OUI Framework_NextGen Installer)V-12.2.1.4.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2283V-8.0-8.3","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]},{"cvss_v3":{"baseScore":6.2,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-5(RDBMS-jackson-databind)V-23.4.0-23.26.3","P-5(RDBMS-jackson-databind)V-21.3-21.23","P-5(RDBMS-jackson-databind)V-19.3-19.32"]}]},{"cve":"CVE-2026-59898","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"40114553"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Signaling (Netty)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200","P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"}]},{"cve":"CVE-2026-59899","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"40114553"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Signaling (Netty)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200","P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"}]},{"cve":"CVE-2026-59900","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"40114553"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Signaling (Netty)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200","P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"}]},{"cve":"CVE-2026-59901","ids":[{"system_name":"Oracle Bug ID of Oracle Retail Xstore Point of Service","text":"40015840"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"40114553"},{"system_name":"Oracle Bug ID of Oracle Communications Network Analytics Data Director","text":"39951117"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Network Analytics Data Director product of Oracle Communications (component: Third Party (Netty)).  Supported versions that are affected are 25.1.200, 25.2.100 and  25.2.200. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Network Analytics Data Director.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Network Analytics Data Director. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xenvironment (Netty)).  Supported versions that are affected are 22.0.3, 23.0.3 and  24.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Point of Service.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Retail Xstore Point of Service. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Signaling (Netty)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14547V-25.2.200","P-14547V-25.2.100","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14547V-25.1.200","P-11513V-24.0.2","P-11513V-23.0.3","P-11513V-22.0.3","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200","P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14547V-25.2.200","P-14547V-25.2.100","P-14547V-25.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU410"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11513V-24.0.2","P-11513V-23.0.3","P-11513V-22.0.3"],"url":"https://support.oracle.com/support/?documentId=CPU369"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-14547V-25.2.200","P-14547V-25.2.100","P-14547V-25.1.200"]},{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-11513V-24.0.2","P-11513V-23.0.3","P-11513V-22.0.3"]}]},{"cve":"CVE-2026-59902","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-59903","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-59919","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-59920","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-59921","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"40114553"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Signaling (Netty)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200","P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"}]},{"cve":"CVE-2026-59949","ids":[{"system_name":"Oracle Bug ID of Oracle Communications BRM - Elastic Charging Engine","text":"39861814"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications (component: Third Party (lz4-java)).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications BRM - Elastic Charging Engine.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications BRM - Elastic Charging Engine and  unauthorized read access to a subset of Oracle Communications BRM - Elastic Charging Engine accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9742V-15.2.0.0.0","P-9742V-15.0.1.0.0","P-9742V-15.0.0.0.0","P-9742V-15.1.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9742V-15.0.0.0.0","P-9742V-15.2.0.0.0","P-9742V-15.0.1.0.0","P-9742V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU413"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","version":"3.1"},"products":["P-9742V-15.0.0.0.0","P-9742V-15.2.0.0.0","P-9742V-15.0.1.0.0","P-9742V-15.1.0.0.0"]}]},{"cve":"CVE-2026-59969","ids":[{"system_name":"Oracle Bug ID of Primavera Unifier","text":"40063078"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform (Apache ZooKeeper)).  Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"}]},{"cve":"CVE-2026-60074","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"39933090"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Date::Manip)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-60075","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"39933090"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Date::Manip)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-14597V-6.1.1-7.0.0"]}]},{"cve":"CVE-2026-60432","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39291655"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).  Supported versions that are affected are 11.3 and  11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4","P-10006V-11.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4","P-10006V-11.3"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-10006V-11.4","P-10006V-11.3"]}]},{"cve":"CVE-2026-60453","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39293710"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: X Window System).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Solaris accessible data as well as  unauthorized read access to a subset of Oracle Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Solaris. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-60500","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39216582"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Web Server).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":5.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-60589","ids":[{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management OPatch","text":"39993878"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle Global Lifecycle Management OPatch product of Oracle Global Lifecycle Management (component: Patch Installer). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-12753V-12.2.0.1.16-12.2.0.1.52"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12753V-12.2.0.1.16-12.2.0.1.52"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N","version":"3.1"},"products":["P-12753V-12.2.0.1.16-12.2.0.1.52"]}]},{"cve":"CVE-2026-60662","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39340674"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-60743","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39286742"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Weblogic).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-60745","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39286782"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Application Server - JRE).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":4.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-60746","ids":[{"system_name":"Oracle Bug ID of Oracle Order Management","text":"39494086"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Order Management accessible data as well as  unauthorized update, insert or delete access to some of Oracle Order Management accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-497V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-497V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-497V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-60809","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39288575"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Weblogic).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":4.2,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-60814","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39288613"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 3.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":3.9,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-60819","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39288619"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Application Server - JRE).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SSH to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-60839","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39288888"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query).  Supported versions that are affected are 8.61 and  8.62. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools as well as  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data and  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61","P-5085V-8.62"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61","P-5085V-8.62"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"products":["P-5085V-8.61","P-5085V-8.62"]}]},{"cve":"CVE-2026-60869","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39289671"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Application Data Sets).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 6.8 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-60874","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39289724"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).  Supported versions that are affected are 8.61 and  8.62. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 4.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61","P-5085V-8.62"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61","P-5085V-8.62"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":4.2,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"products":["P-5085V-8.61","P-5085V-8.62"]}]},{"cve":"CVE-2026-60876","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39290124"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Search Framework).   The supported version that is affected is 8.62. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.62"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.62"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":4.2,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-5085V-8.62"]}]},{"cve":"CVE-2026-60878","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39290130"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Process Scheduler).  Supported versions that are affected are 8.61 and  8.62. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61","P-5085V-8.62"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61","P-5085V-8.62"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":4.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61","P-5085V-8.62"]}]},{"cve":"CVE-2026-60881","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39290275"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Meta Data).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-60882","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39290292"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Search Framework).  Supported versions that are affected are 8.61 and  8.62. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61","P-5085V-8.62"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61","P-5085V-8.62"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61","P-5085V-8.62"]}]},{"cve":"CVE-2026-60885","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39291093"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Push Notifications).  Supported versions that are affected are 8.61 and  8.62. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 6.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61","P-5085V-8.62"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61","P-5085V-8.62"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5085V-8.61","P-5085V-8.62"]}]},{"cve":"CVE-2026-60887","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39291203"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Data Mover).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 3.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":3.8,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-60964","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296241"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Open Query).  Supported versions that are affected are 8.61 and  8.62. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 1.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61","P-5085V-8.62"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61","P-5085V-8.62"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":1.9,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61","P-5085V-8.62"]}]},{"cve":"CVE-2026-60968","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296849"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 6.0 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-61308","ids":[{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management OPatch","text":"39993878"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle Global Lifecycle Management OPatch product of Oracle Global Lifecycle Management (component: Patch Installer). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-12753V-12.2.0.1.16-12.2.0.1.52"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12753V-12.2.0.1.16-12.2.0.1.52"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N","version":"3.1"},"products":["P-12753V-12.2.0.1.16-12.2.0.1.52"]}]},{"cve":"CVE-2026-61674","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40057323"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (fluentbit)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-14597V-6.1.1-7.0.0"]}]},{"cve":"CVE-2026-62380","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-6253","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-62574","ids":[{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management OPatch","text":"39993878"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle Global Lifecycle Management OPatch product of Oracle Global Lifecycle Management (component: Patch Installer). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-12753V-12.2.0.1.16-12.2.0.1.52"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12753V-12.2.0.1.16-12.2.0.1.52"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N","version":"3.1"},"products":["P-12753V-12.2.0.1.16-12.2.0.1.52"]}]},{"cve":"CVE-2026-6276","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-63072","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"},{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39525775"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Certificate Management","text":"40119533"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40009481"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security (OpenSSL)).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Business Intelligence Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the RDBMS (OpenSSL) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise RDBMS (OpenSSL).  Successful attacks of this vulnerability can result in takeover of RDBMS (OpenSSL).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Certificate Management product of Oracle Communications (component: Configuration (OpenSSL)).  Supported versions that are affected are 25.2.201 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications Cloud Native Core Certificate Management.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Certificate Management.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14868V-25.2.201","P-5(RDBMS-OpenSSL)V-23.4.0-23.26.3","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-14868V-26.1.200","P-2025V-8.2.0.0.0","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-2025V-26.01.0.0.0","P-4629V-9.7.0-9.7.3","P-5(RDBMS-OpenSSL)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-OpenSSL)V-23.4.0-23.26.3","P-5(RDBMS-OpenSSL)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14868V-25.2.201","P-14868V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU411"}]},{"cve":"CVE-2026-63073","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Certificate Management","text":"40119533"},{"system_name":"Oracle Bug ID of Oracle Autonomous Health Framework","text":"40013468"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Autonomous Health Framework (component: AHFCOMMON (OpenSSL)).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Autonomous Health Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Autonomous Health Framework accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Certificate Management product of Oracle Communications (component: Configuration (OpenSSL)).  Supported versions that are affected are 25.2.201 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications Cloud Native Core Certificate Management.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Certificate Management.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14868V-26.1.200","P-14868V-25.2.201","P-14634V-26.3-26.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14634V-26.3-26.8"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14868V-25.2.201","P-14868V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU411"}]},{"cve":"CVE-2026-63074","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"},{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39525775"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Certificate Management","text":"40119533"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40009481"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security (OpenSSL)).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Business Intelligence Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the RDBMS (OpenSSL) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise RDBMS (OpenSSL).  Successful attacks of this vulnerability can result in takeover of RDBMS (OpenSSL).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Certificate Management product of Oracle Communications (component: Configuration (OpenSSL)).  Supported versions that are affected are 25.2.201 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications Cloud Native Core Certificate Management.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Certificate Management.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14868V-25.2.201","P-5(RDBMS-OpenSSL)V-23.4.0-23.26.3","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-14868V-26.1.200","P-2025V-8.2.0.0.0","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-2025V-26.01.0.0.0","P-4629V-9.7.0-9.7.3","P-5(RDBMS-OpenSSL)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-OpenSSL)V-23.4.0-23.26.3","P-5(RDBMS-OpenSSL)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14868V-25.2.201","P-14868V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU411"}]},{"cve":"CVE-2026-63075","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Certificate Management","text":"40119533"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40009481"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (OpenSSL) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise RDBMS (OpenSSL).  Successful attacks of this vulnerability can result in takeover of RDBMS (OpenSSL).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Certificate Management product of Oracle Communications (component: Configuration (OpenSSL)).  Supported versions that are affected are 25.2.201 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications Cloud Native Core Certificate Management.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Certificate Management.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14868V-26.1.200","P-14868V-25.2.201","P-5(RDBMS-OpenSSL)V-23.4.0-23.26.3","P-5(RDBMS-OpenSSL)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-OpenSSL)V-23.4.0-23.26.3","P-5(RDBMS-OpenSSL)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14868V-25.2.201","P-14868V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU411"}]},{"cve":"CVE-2026-63076","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"},{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39525775"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Certificate Management","text":"40119533"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40009481"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security (OpenSSL)).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Business Intelligence Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the RDBMS (OpenSSL) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise RDBMS (OpenSSL).  Successful attacks of this vulnerability can result in takeover of RDBMS (OpenSSL).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Certificate Management product of Oracle Communications (component: Configuration (OpenSSL)).  Supported versions that are affected are 25.2.201 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications Cloud Native Core Certificate Management.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Certificate Management.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14868V-25.2.201","P-5(RDBMS-OpenSSL)V-23.4.0-23.26.3","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-14868V-26.1.200","P-2025V-8.2.0.0.0","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-2025V-26.01.0.0.0","P-4629V-9.7.0-9.7.3","P-5(RDBMS-OpenSSL)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-OpenSSL)V-23.4.0-23.26.3","P-5(RDBMS-OpenSSL)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14868V-25.2.201","P-14868V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU411"}]},{"cve":"CVE-2026-63382","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"40119734"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Install (libevent)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Communications Cloud Native Core Security Edge Protection Proxy executes to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-26.1.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-25.2.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-26.1.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"}]},{"cve":"CVE-2026-63385","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"40119734"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Install (libevent)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Communications Cloud Native Core Security Edge Protection Proxy executes to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-26.1.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-25.2.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-26.1.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"}]},{"cve":"CVE-2026-63387","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"40119734"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Install (libevent)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Communications Cloud Native Core Security Edge Protection Proxy executes to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Security Edge Protection Proxy.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-26.1.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-25.2.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-26.1.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"}]},{"cve":"CVE-2026-63388","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"40119734"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Install (libevent)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Communications Cloud Native Core Security Edge Protection Proxy executes to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Security Edge Protection Proxy. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-26.1.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-25.2.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-26.1.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"}],"scores":[{"cvss_v3":{"baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-26.1.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Install)V-25.2.200"]}]},{"cve":"CVE-2026-6357","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39953623"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server (pip)).  Supported versions that are affected are 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Billing and Revenue Management accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"}]},{"cve":"CVE-2026-63639","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"39940096"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (valkey)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-14597V-7.0.0"]}]},{"cve":"CVE-2026-64193","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"39932959"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Net::DNS)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-14597V-6.1.1-7.0.0"]}]},{"cve":"CVE-2026-64194","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"39932959"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Net::DNS)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via DNS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-6429","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-64607","ids":[{"system_name":"Oracle Bug ID of Oracle Access Manager","text":"39992405"},{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39877900"},{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39953718"},{"system_name":"Oracle Bug ID of Oracle Utilities Application Framework","text":"39925139"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Apache HttpClient)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Middleware Common Libraries and Tools. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: Security (Apache HttpClient)).  Supported versions that are affected are 4.4.0.2.0, 4.4.0.3.0, 4.4.0.4.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 4.5.0.2.0, 25.4, 25.10, 26.4 and  26.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Application Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Utilities Application Framework. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server (Apache HttpClient)).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Billing and Revenue Management.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine (Apache HttpClient)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Access Manager. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-4647V-14.1.2.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-4.5.0.0.0","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0","P-5565V-14.1.2.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0","P-2245V-4.5.0.1.3","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2245V-25.4","P-2245V-26.4","P-2245V-25.10","P-2245V-26.10"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4647V-14.1.2.0.0","P-5565V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU370"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-4647V-14.1.2.0.0","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-4.5.0.0.0","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0","P-5565V-14.1.2.0.0","P-2245V-4.5.0.1.3","P-2245V-25.4","P-2245V-26.4","P-2245V-25.10","P-2245V-26.10"]}]},{"cve":"CVE-2026-64713","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-64719","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-64728","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-64730","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-64757","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-64783","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-64787","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39636856"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Java SE, Oracle JavaFX.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}]},{"cve":"CVE-2026-65182","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068469"},{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"40008114"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders & Files Attachment (Apache Tomcat)).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile PLM accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (Apache Tomcat)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4429V-9.3.6","P-14597V-7.0.0"],"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4429V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-65183","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"40008114"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders & Files Attachment (Apache Tomcat)).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile PLM accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4429V-9.3.6"],"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4429V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-65637","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"40008114"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders & Files Attachment (Apache Tomcat)).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile PLM accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4429V-9.3.6"],"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4429V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-65905","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068469"},{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"40008114"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders & Files Attachment (Apache Tomcat)).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile PLM accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (Apache Tomcat)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4429V-9.3.6","P-14597V-7.0.0"],"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4429V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-65927","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"40008114"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders & Files Attachment (Apache Tomcat)).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile PLM accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4429V-9.3.6"],"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4429V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-66010","ids":[{"system_name":"Oracle Bug ID of Oracle APEX","text":"39790911"}],"notes":[{"category":"description","text":"Vulnerability in Oracle APEX (component: General (DOMPurify)).  Supported versions that are affected are 24.1.0-24.1.19,   24.2.0-24.2.18 and   26.1.0-26.1.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle APEX.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle APEX, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle APEX accessible data as well as  unauthorized read access to a subset of Oracle APEX accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1348V-24.1.0-24.1.19","P-1348V-26.1.0-26.1.2","P-1348V-24.2.0-24.2.18"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1348V-24.1.0-24.1.19","P-1348V-26.1.0-26.1.2","P-1348V-24.2.0-24.2.18"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-1348V-24.1.0-24.1.19","P-1348V-26.1.0-26.1.2","P-1348V-24.2.0-24.2.18"]}]},{"cve":"CVE-2026-66142","ids":[{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39834530"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform (Apache Neethi)).  Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"}]},{"cve":"CVE-2026-66143","ids":[{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39834530"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform (Apache Neethi)).  Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"}]},{"cve":"CVE-2026-66144","ids":[{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39834530"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform (Apache Neethi)).  Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"]}]},{"cve":"CVE-2026-66299","ids":[{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"40008114"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders & Files Attachment (Apache Tomcat)).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile PLM accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4429V-9.3.6"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4429V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"}]},{"cve":"CVE-2026-66357","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40014104"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Erlang/OTP)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-66422","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"40008114"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders & Files Attachment (Apache Tomcat)).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile PLM accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4429V-9.3.6"],"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4429V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-6653","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Certificate Management","text":"40119487"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Console","text":"40119070"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Console product of Oracle Communications (component: Console (libxml2)).  Supported versions that are affected are 25.2.202 and 26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Console.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Console. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Certificate Management product of Oracle Communications (component: Configuration (libxml2)).   The supported version that is affected is 26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Certificate Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Certificate Management. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14868V-26.1.200","P-14250V-25.2.202","P-14250V-26.1.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14250V-25.2.202","P-14250V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU405"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14868V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU411"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-14250V-25.2.202","P-14250V-26.1.200","P-14868V-26.1.200"]}]},{"cve":"CVE-2026-6732","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39368322"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX (WebKitGTK)).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27;Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-13497V-21.3.19.1.1","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-13497V-21.3.19.1.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-13497V-21.3.19.1.1"]}]},{"cve":"CVE-2026-6790","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40063481"},{"system_name":"Oracle Bug ID of Siebel CRM End User","text":"39657548"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Desktop Integration Siebel Agent (Eclipse Jetty)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM End User accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Eclipse Jetty)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0","P-9011V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9011V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-68494","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Unified Data Repository","text":"40120734"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Unified Data Repository product of Oracle Communications (component: Configuration (jackson-core)).  Supported versions that are affected are 25.2.200 and 26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Unified Data Repository.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Unified Data Repository. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14119V-26.1.200","P-14119V-25.2.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14119V-26.1.200","P-14119V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU407"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-14119V-26.1.200","P-14119V-25.2.200"]}]},{"cve":"CVE-2026-68497","ids":[{"system_name":"Oracle Bug ID of Oracle Financial Services Analytical Applications Infrastructure","text":"39869987"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Unified Data Repository","text":"40121152"},{"system_name":"Oracle Bug ID of Oracle Utilities Application Framework","text":"39970746"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39935172"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Infrastructure).  Supported versions that are affected are 8.0.7.9, 8.0.8.7, 8.1.2.5 and  8.1.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Financial Services Analytical Applications Infrastructure. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform (jackson-databind)).  Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: Security (jackson-databind)).  Supported versions that are affected are 4.4.0.2.0, 4.4.0.3.0, 4.4.0.4.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 4.5.0.2.0, 25.4, 25.10, 26.4 and  26.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Application Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Application Framework. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Unified Data Repository product of Oracle Communications (component: Configuration (jackson-databind)).  Supported versions that are affected are 25.2.200 and 26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Unified Data Repository.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Unified Data Repository. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-4.5.0.0.0","P-2245V-4.4.0.2.0","P-10354V-24.12.0-24.12.16","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0","P-14119V-25.2.200","P-5680V-8.1.2.5","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-5680V-8.1.2.6","P-10354V-21.12.0-21.12.17","P-2245V-4.5.0.1.3","P-14119V-26.1.200","P-2245V-25.4","P-2245V-26.4","P-5680V-8.0.7.9","P-2245V-25.10","P-5680V-8.0.8.7","P-2245V-26.10","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5680V-8.1.2.5","P-5680V-8.1.2.6","P-5680V-8.0.7.9","P-5680V-8.0.8.7"],"url":"https://support.oracle.com/support/?documentId=CPU421"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU370"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14119V-26.1.200","P-14119V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU407"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-4.5.0.0.0","P-2245V-4.4.0.2.0","P-10354V-24.12.0-24.12.16","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0","P-14119V-25.2.200","P-5680V-8.1.2.5","P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-5680V-8.1.2.6","P-10354V-21.12.0-21.12.17","P-2245V-4.5.0.1.3","P-14119V-26.1.200","P-2245V-25.4","P-2245V-26.4","P-5680V-8.0.7.9","P-2245V-25.10","P-5680V-8.0.8.7","P-2245V-26.10","P-10354V-25.12.0-25.12.9"]}]},{"cve":"CVE-2026-68525","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068469"},{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"40008114"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders & Files Attachment (Apache Tomcat)).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile PLM accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (Apache Tomcat)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4429V-9.3.6","P-14597V-7.0.0"],"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4429V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-14597V-7.0.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-68569","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068469"},{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"40008114"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders & Files Attachment (Apache Tomcat)).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile PLM accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (Apache Tomcat)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4429V-9.3.6","P-14597V-7.0.0"],"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4429V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-4429V-9.3.6"]},{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-6860","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate Stream Analytics","text":"39950628"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle GoldenGate Stream Analytics product of Oracle GoldenGate (component: Security (Vert.x-Web)). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-14015(Oracle GoldenGate Stream Analytics_Security)V-26.1.0.0.0-26.2.0.0.1"]}]},{"cve":"CVE-2026-68763","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"40008114"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders & Files Attachment (Apache Tomcat)).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile PLM accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4429V-9.3.6"],"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4429V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-69247","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"39945617"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068780"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Cryptography)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (pyca-cryptography)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-14597V-6.1.1-7.0.0"]}]},{"cve":"CVE-2026-69248","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"39945617"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068780"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Cryptography)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (pyca-cryptography)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-69249","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"39945617"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40068780"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Cryptography)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Microservices (pyca-cryptography)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-70860","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise FIN Common Objects Argentina","text":"39435794"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: eProcurement).   The supported version that is affected is 9.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Argentina.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Common Objects Argentina accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise FIN Common Objects Argentina accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8930V-9.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8930V-9.1"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"products":["P-8930V-9.1"]}]},{"cve":"CVE-2026-70869","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39448737"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":4.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-70907","ids":[{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management OPatch","text":"39993878"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle Global Lifecycle Management OPatch product of Oracle Global Lifecycle Management (component: Patch Installer). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-12753V-12.2.0.1.16-12.2.0.1.52"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12753V-12.2.0.1.16-12.2.0.1.52"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N","version":"3.1"},"products":["P-12753V-12.2.0.1.16-12.2.0.1.52"]}]},{"cve":"CVE-2026-71497","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-jsoup)V-19.3-19.32","P-5(RDBMS-jsoup)V-21.3-21.23","P-5(RDBMS-jsoup)V-23.4.0-23.26.3"]}],"ids":[{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39879804"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"39849673"},{"system_name":"Oracle Bug ID of Siebel CRM Integration","text":"39861607"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the RDBMS (jsoup) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Integration.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform (jsoup)).  Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-9008V-17.0-26.9","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"known_not_affected":["P-5(RDBMS-jsoup)V-19.3-19.32","P-5(RDBMS-jsoup)V-21.3-21.23","P-5(RDBMS-jsoup)V-23.4.0-23.26.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-jsoup)V-19.3-19.32","P-5(RDBMS-jsoup)V-21.3-21.23","P-5(RDBMS-jsoup)V-23.4.0-23.26.3"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9008V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-jsoup)V-19.3-19.32","P-5(RDBMS-jsoup)V-21.3-21.23","P-5(RDBMS-jsoup)V-23.4.0-23.26.3"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-jsoup)V-19.3-19.32","P-5(RDBMS-jsoup)V-21.3-21.23","P-5(RDBMS-jsoup)V-23.4.0-23.26.3"]}]},{"cve":"CVE-2026-7168","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40059631"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (libcurl)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Communications Unified Assurance accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-14597V-6.1.1-7.0.0","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-14597V-6.1.1-7.0.0"]}]},{"cve":"CVE-2026-73180","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"40008114"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders & Files Attachment (Apache Tomcat)).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile PLM accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4429V-9.3.6"],"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4429V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-73507","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-73508","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-73581","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-73812","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40014104"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Erlang/OTP)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-7383","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"},{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39442783"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security (OpenSSL)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-5085V-8.61-8.63","P-4629V-9.7.0-9.7.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-73964","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"34610477"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  21.3-21.23. Easily exploitable vulnerability allows high privileged attacker having Query Optimizer privilege with network access via Oracle Net to compromise RDBMS.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of RDBMS accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS)V-21.3-21.23","P-5(RDBMS)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS)V-19.3-19.32","P-5(RDBMS)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":2.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS)V-19.3-19.32","P-5(RDBMS)V-21.3-21.23"]}]},{"cve":"CVE-2026-74835","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40014104"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Erlang/OTP)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-74860","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Certificate Management","text":"40119487"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Certificate Management product of Oracle Communications (component: Configuration (libxml2)).   The supported version that is affected is 26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Certificate Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Certificate Management.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14868V-26.1.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14868V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU411"}]},{"cve":"CVE-2026-74994","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40014104"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Erlang/OTP)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-75140","ids":[{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39879804"},{"system_name":"Oracle Bug ID of Siebel CRM Integration","text":"39861607"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Integration.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform (jsoup)).  Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9","P-9008V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9008V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"]}]},{"cve":"CVE-2026-75595","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Service Catalog and Design","text":"40060196"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Unified Data Repository","text":"40120275"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Service Catalog and Design product of Oracle Communications (component: Third Party (Netty)).  Supported versions that are affected are 8.0-8.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Service Catalog and Design.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Service Catalog and Design accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Service Catalog and Design accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Unified Data Repository product of Oracle Communications (component: Configuration (Netty)).  Supported versions that are affected are 25.2.200 and 26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Cloud Native Core Unified Data Repository.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Unified Data Repository accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Unified Data Repository accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0","P-2283V-8.0-8.1","P-14119V-26.1.200","P-14119V-25.2.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2283V-8.0-8.1"],"url":"https://support.oracle.com/support/?documentId=CPU363"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14119V-26.1.200","P-14119V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU407"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-14119V-26.1.200","P-2283V-8.0-8.1","P-14119V-25.2.200"]}]},{"cve":"CVE-2026-75596","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40025956"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Netty)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-14597V-6.1.1-7.0.0"]}]},{"cve":"CVE-2026-75803","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"},{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39525775"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"39969157"},{"system_name":"Oracle Bug ID of Oracle Autonomous Health Framework","text":"40013468"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40009481"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security (OpenSSL)).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Business Intelligence Enterprise Edition accessible data as well as  unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the RDBMS (Python) component of Oracle Database Server.  Supported versions that are affected are 21.3-21.23 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where RDBMS (Python) executes to compromise RDBMS (Python).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (Python) accessible data. CVSS 3.1 Base Score 6.2 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the RDBMS (OpenSSL) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise RDBMS (OpenSSL).  Successful attacks of this vulnerability can result in takeover of RDBMS (OpenSSL). CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in Oracle Autonomous Health Framework (component: AHFCOMMON (OpenSSL)).  Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Autonomous Health Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Autonomous Health Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Autonomous Health Framework accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS-OpenSSL)V-23.4.0-23.26.3","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-5(RDBMS-Python)V-21.3-21.23","P-2025V-8.2.0.0.0","P-5(RDBMS-Python)V-23.4.0-23.26.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-2025V-26.01.0.0.0","P-4629V-9.7.0-9.7.3","P-14634V-26.3-26.8","P-5(RDBMS-OpenSSL)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-OpenSSL)V-23.4.0-23.26.3","P-5(RDBMS-Python)V-21.3-21.23","P-5(RDBMS-Python)V-23.4.0-23.26.3","P-14634V-26.3-26.8","P-5(RDBMS-OpenSSL)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0","P-14634V-26.3-26.8"]},{"cvss_v3":{"baseScore":6.2,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-5(RDBMS-Python)V-21.3-21.23","P-5(RDBMS-Python)V-23.4.0-23.26.3"]},{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5(RDBMS-OpenSSL)V-23.4.0-23.26.3","P-5(RDBMS-OpenSSL)V-19.3-19.32"]}]},{"cve":"CVE-2026-75973","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-7598","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39744923"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: File Processing (libssh2)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-76183","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-77310","ids":[{"system_name":"Oracle Bug ID of Oracle Utilities Application Framework","text":"39970746"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: Security (jackson-databind)).  Supported versions that are affected are 4.4.0.2.0, 4.4.0.3.0, 4.4.0.4.0, 4.5.0.0.0, 4.5.0.1.1, 4.5.0.1.3, 4.5.0.2.0, 25.4, 25.10, 26.4 and  26.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Application Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Utilities Application Framework.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU370"}]},{"cve":"CVE-2026-77420","ids":[{"system_name":"Oracle Bug ID of Oracle Coherence","text":"39687215"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars (jline)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2545V-12.2.1.4.0","P-2545V-14.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2545V-12.2.1.4.0","P-2545V-14.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-77421","ids":[{"system_name":"Oracle Bug ID of Oracle Coherence","text":"39687215"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars (jline)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2545V-12.2.1.4.0","P-2545V-14.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2545V-12.2.1.4.0","P-2545V-14.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-77422","ids":[{"system_name":"Oracle Bug ID of Oracle Coherence","text":"39687215"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars (jline)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Coherence.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2545V-12.2.1.4.0","P-2545V-14.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2545V-12.2.1.4.0","P-2545V-14.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}]},{"cve":"CVE-2026-77756","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-77762","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-77791","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-78030","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_cannot_be_controlled_by_adversary","product_ids":["P-5(RDBMS-DBI)V-19.3-19.32","P-5(RDBMS-DBI)V-21.3-21.23","P-5(RDBMS-DBI)V-23.4.0-23.26.3"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40051206"},{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40048265"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the RDBMS (DBI) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (DBI)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"],"known_not_affected":["P-5(RDBMS-DBI)V-23.4.0-23.26.3","P-5(RDBMS-DBI)V-19.3-19.32","P-5(RDBMS-DBI)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-DBI)V-19.3-19.32","P-5(RDBMS-DBI)V-21.3-21.23","P-5(RDBMS-DBI)V-23.4.0-23.26.3"],"url":"https://support.oracle.com/support/?documentId=CPU359"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-DBI)V-19.3-19.32","P-5(RDBMS-DBI)V-21.3-21.23","P-5(RDBMS-DBI)V-23.4.0-23.26.3"]},{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-14597V-6.1.1-7.0.0"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The vulnerable component is present, and the component contains the vulnerable code. However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.","product_ids":["P-5(RDBMS-DBI)V-19.3-19.32","P-5(RDBMS-DBI)V-21.3-21.23","P-5(RDBMS-DBI)V-23.4.0-23.26.3"]}]},{"cve":"CVE-2026-78254","ids":[{"system_name":"Oracle Bug ID of Primavera Unifier","text":"40025648"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform (Apache Ant)).  Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data as well as  unauthorized read access to a subset of Primavera Unifier accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"}],"scores":[{"cvss_v3":{"baseScore":4.2,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"]}]},{"cve":"CVE-2026-78383","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-78437","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-79677","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-79769","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-79770","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-79771","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-79772","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39739253"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Logstash (Logstash)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}]},{"cve":"CVE-2026-79993","ids":[{"system_name":"Oracle Bug ID of Primavera Unifier","text":"40063078"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform (Apache ZooKeeper)).  Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"}]},{"cve":"CVE-2026-8286","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40059631"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (libcurl)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Communications Unified Assurance accessible data.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12","P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-4629V-9.7.0-9.7.3","P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-83139","ids":[{"system_name":"Oracle Bug ID of Oracle Order Management","text":"39494543"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Order Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-497V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-497V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-497V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-83358","ids":[{"system_name":"Oracle Bug ID of Oracle HRMS (Norway)","text":"39495402"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (Norway).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle HRMS (Norway) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1645V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1645V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-1645V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-83359","ids":[{"system_name":"Oracle Bug ID of Oracle HRMS (India)","text":"39496069"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Indian Payroll).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (India).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle HRMS (India) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1557V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1557V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-1557V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-83360","ids":[{"system_name":"Oracle Bug ID of Oracle HRMS (Republic of Korea)","text":"39496079"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle HRMS (Republic of Korea) product of Oracle E-Business Suite (component: Korean Payroll).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (Republic of Korea).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle HRMS (Republic of Korea) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1565V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1565V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-1565V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-83361","ids":[{"system_name":"Oracle Bug ID of Oracle Contract Lifecycle Management for Public Sector","text":"39496427"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Contract Lifecycle Management for Public Sector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Contract Lifecycle Management for Public Sector accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8759V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8759V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-8759V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-83363","ids":[{"system_name":"Oracle Bug ID of Oracle Contract Lifecycle Management for Public Sector","text":"39496527"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contract Lifecycle Management for Public Sector.  Successful attacks of this vulnerability can result in takeover of Oracle Contract Lifecycle Management for Public Sector. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8759V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8759V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-8759V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-83366","ids":[{"system_name":"Oracle Bug ID of Oracle Shipping Execution","text":"39507911"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Shipping Execution accessible data as well as  unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-996V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-996V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-996V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-83367","ids":[{"system_name":"Oracle Bug ID of Oracle Shipping Execution","text":"39508133"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Shipping Execution.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Shipping Execution accessible data as well as  unauthorized access to critical data or complete access to all Oracle Shipping Execution accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-996V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-996V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-996V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-83370","ids":[{"system_name":"Oracle Bug ID of Sourcing","text":"39588181"}],"notes":[{"category":"description","text":"Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Sourcing.  Successful attacks of this vulnerability can result in takeover of Sourcing. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1273V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1273V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1273V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-83371","ids":[{"system_name":"Oracle Bug ID of Oracle HRMS (UK)","text":"39600340"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK).  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle HRMS (UK), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle HRMS (UK) accessible data as well as  unauthorized read access to a subset of Oracle HRMS (UK) accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1001V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1001V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-1001V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-83372","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"38742304"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-83373","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"38951763"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 3.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":3.0,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"acknowledgments":[{"names":["Doria Tang"]}],"cve":"CVE-2026-83374","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39071238"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-83375","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise HCM Human Resources","text":"39130268"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Administer Workforce).   The supported version that is affected is 9.2. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HCM Human Resources.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise HCM Human Resources accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise HCM Human Resources accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise HCM Human Resources. CVSS 3.1 Base Score 6.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5071V-9.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5071V-9.2"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H","version":"3.1"},"products":["P-5071V-9.2"]}]},{"acknowledgments":[{"names":["Greencrow1234"]}],"cve":"CVE-2026-83376","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39192378"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-83377","ids":[{"system_name":"Oracle Bug ID of Oracle HRMS (US)","text":"39600418"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Mobile Applications).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US).  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle HRMS (US), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle HRMS (US) accessible data as well as  unauthorized read access to a subset of Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1000V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1000V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-1000V-12.2.3-12.2.15"]}]},{"acknowledgments":[{"names":["Bruce Dang"],"organization":"Calif.io"}],"cve":"CVE-2026-83378","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39203411"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Java SE (component: Compiler).  Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as  unauthorized read access to a subset of Oracle Java SE accessible data.  Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-25.0.4.1","P-856(Java SE)V-21.0.12.1","P-856(Java SE)V-27"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":4.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1"]}]},{"cve":"CVE-2026-83379","ids":[{"system_name":"Oracle Bug ID of Oracle Weblogic Server Proxy Plug-in","text":"39730245"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in.  While the vulnerability is in Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data as well as  unauthorized access to critical data or complete access to all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1042(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers)V-14.1.2.0.0","P-1042(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers)V-12.2.1.4.0","P-1042(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers)V-14.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1042(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers)V-14.1.2.0.0","P-1042(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers)V-12.2.1.4.0","P-1042(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers)V-14.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-1042(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers)V-14.1.2.0.0","P-1042(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers)V-12.2.1.4.0","P-1042(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers)V-14.1.1.0.0"]}]},{"cve":"CVE-2026-83380","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39235123"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAAS).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-83381","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39235151"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as  unauthorized read access to a subset of Oracle Java SE accessible data.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":4.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-83382","ids":[{"system_name":"Oracle Bug ID of Oracle Report Manager","text":"39604110"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Report Manager accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-777V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-777V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-777V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-83383","ids":[{"system_name":"Oracle Bug ID of Oracle HRMS (US)","text":"39633651"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1000V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1000V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-1000V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-83384","ids":[{"system_name":"Oracle Bug ID of Oracle HRMS (US)","text":"39633826"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1000V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1000V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-1000V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-83385","ids":[{"system_name":"Oracle Bug ID of Oracle HRMS (US)","text":"39633997"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1000V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1000V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-1000V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-83386","ids":[{"system_name":"Oracle Bug ID of Oracle HRMS (US)","text":"39634084"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1000V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1000V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-1000V-12.2.3-12.2.15"]}]},{"acknowledgments":[{"names":["Alexander Dezhinov, Stanislav Dukhin, Nikita Kozlov"]}],"cve":"CVE-2026-83387","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39240913"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JDBC).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-83388","ids":[{"system_name":"Oracle Bug ID of Oracle Applications Manager","text":"39662027"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Applications Manager accessible data. CVSS 3.1 Base Score 2.2 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-99V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-99V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":2.2,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-99V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-83389","ids":[{"system_name":"Oracle Bug ID of Oracle HRMS (UK)","text":"39694185"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (UK).  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle HRMS (UK), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle HRMS (UK) accessible data as well as  unauthorized read access to a subset of Oracle HRMS (UK) accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1001V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1001V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-1001V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-83390","ids":[{"system_name":"Oracle Bug ID of Oracle Applications Manager","text":"39733315"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Applications Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Applications Manager. CVSS 3.1 Base Score 4.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-99V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-99V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":4.2,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"products":["P-99V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-83391","ids":[{"system_name":"Oracle Bug ID of Oracle HRMS (US)","text":"39736643"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll Year End).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS (US).  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle HRMS (US), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle HRMS (US) accessible data as well as  unauthorized read access to a subset of Oracle HRMS (US) accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1000V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1000V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-1000V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-83392","ids":[{"system_name":"Oracle Bug ID of Oracle Applications Manager","text":"39299589"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Diagnostics).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Applications Manager accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-99V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-99V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-99V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-83393","ids":[{"system_name":"Oracle Bug ID of Oracle Product Hub","text":"39382672"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  While the vulnerability is in Oracle Product Hub, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1313V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1313V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-1313V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-83394","ids":[{"system_name":"Oracle Bug ID of Oracle Demand Planning","text":"39398771"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations).  Supported versions that are affected are 12.1 and  12.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand Planning.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Demand Planning, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Demand Planning accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-723V-12.2","P-723V-12.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-723V-12.2","P-723V-12.1"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-723V-12.2","P-723V-12.1"]}]},{"acknowledgments":[{"names":["4ra1n, pyn3rd and unam4"]},{"names":["Acol7542"]},{"names":["Binbin Xu"],"organization":"Tencent YUNDING LAB CodeBuddy Security"}],"cve":"CVE-2026-83395","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39247389"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-83396","ids":[{"system_name":"Oracle Bug ID of Oracle Data Integrator","text":"39109284"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2196V-14.1.2.0.0","P-2196V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2196V-12.2.1.4.0","P-2196V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2196V-12.2.1.4.0","P-2196V-14.1.2.0.0"]}]},{"cve":"CVE-2026-83397","ids":[{"system_name":"Oracle Bug ID of Oracle Data Integrator","text":"39114933"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2196V-14.1.2.0.0","P-2196V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2196V-12.2.1.4.0","P-2196V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2196V-12.2.1.4.0","P-2196V-14.1.2.0.0"]}]},{"cve":"CVE-2026-83398","ids":[{"system_name":"Oracle Bug ID of Oracle Data Integrator","text":"39303799"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Data Transforms).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Data Integrator accessible data as well as  unauthorized update, insert or delete access to some of Oracle Data Integrator accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2196V-14.1.2.0.0","P-2196V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2196V-12.2.1.4.0","P-2196V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-2196V-12.2.1.4.0","P-2196V-14.1.2.0.0"]}]},{"cve":"CVE-2026-83399","ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39263794"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5242V-15.1.1.0.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0","P-5242V-14.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-5242V-14.1.1.0.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5242V-15.1.1.0.0","P-5242V-14.1.1.0.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"]}]},{"acknowledgments":[{"names":["Jens Frieß"],"organization":"Goethe University Frankfurt"}],"cve":"CVE-2026-83400","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39269980"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-83401","ids":[{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39271538"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Identity Manager accessible data as well as  unauthorized read access to a subset of Oracle Identity Manager accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1980V-12.2.1.4.0","P-1980V-14.1.2.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1980V-14.1.2.1.0","P-1980V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-1980V-14.1.2.1.0","P-1980V-12.2.1.4.0"]}]},{"cve":"CVE-2026-83402","ids":[{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39271552"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1980V-12.2.1.4.0","P-1980V-14.1.2.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1980V-14.1.2.1.0","P-1980V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1980V-14.1.2.1.0","P-1980V-12.2.1.4.0"]}]},{"cve":"CVE-2026-83403","ids":[{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39271554"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1980V-12.2.1.4.0","P-1980V-14.1.2.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1980V-14.1.2.1.0","P-1980V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1980V-14.1.2.1.0","P-1980V-12.2.1.4.0"]}]},{"acknowledgments":[{"names":["Yoggydev"]}],"cve":"CVE-2026-83404","ids":[{"system_name":"Oracle Bug ID of MySQL Connectors","text":"40010859"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8576(MySQL Connectors_Connector/Python)V-26.7.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8576(MySQL Connectors_Connector/Python)V-26.7.0"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-8576(MySQL Connectors_Connector/Python)V-26.7.0"]}]},{"cve":"CVE-2026-83405","ids":[{"system_name":"Oracle Bug ID of Oracle Utilities Application Framework","text":"39735194"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: Security). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU370"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-2245V-4.5.0.1.3","P-2245V-4.5.0.1.1","P-2245V-4.5.0.2.0","P-2245V-25.4","P-2245V-26.4","P-2245V-4.5.0.0.0","P-2245V-25.10","P-2245V-26.10","P-2245V-4.4.0.2.0","P-2245V-4.4.0.3.0","P-2245V-4.4.0.4.0"]}]},{"cve":"CVE-2026-83406","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39511542"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.1.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.2.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.1.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.2.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"}],"scores":[{"cvss_v3":{"baseScore":6.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.1.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.2.0.0.0"]}]},{"cve":"CVE-2026-83407","ids":[{"system_name":"Oracle Bug ID of Oracle Access Manager","text":"39274559"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data as well as  unauthorized update, insert or delete access to some of Oracle Access Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Access Manager. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5565V-12.2.1.4.0","P-5565V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5565V-12.2.1.4.0","P-5565V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","version":"3.1"},"products":["P-5565V-12.2.1.4.0","P-5565V-14.1.2.0.0"]}]},{"cve":"CVE-2026-83409","ids":[{"system_name":"Oracle Bug ID of Oracle Access Manager","text":"39274574"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5565V-12.2.1.4.0","P-5565V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5565V-12.2.1.4.0","P-5565V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5565V-12.2.1.4.0","P-5565V-14.1.2.0.0"]}]},{"cve":"CVE-2026-83426","ids":[{"system_name":"Oracle Bug ID of Oracle Access Manager","text":"39275745"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5565V-14.1.2.1.0","P-5565V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5565V-14.1.2.1.0","P-5565V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-5565V-14.1.2.1.0","P-5565V-12.2.1.4.0"]}]},{"cve":"CVE-2026-83427","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39288883"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Multichannel Framework).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-8376","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"39861227"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Perl)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}]},{"cve":"CVE-2026-8384","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40063481"},{"system_name":"Oracle Bug ID of Siebel CRM End User","text":"39657548"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Desktop Integration Siebel Agent (Eclipse Jetty)).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Eclipse Jetty)).   The supported version that is affected is 7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Unified Assurance.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-7.0.0","P-9011V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9011V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-9011V-17.0-26.9"]}]},{"cve":"CVE-2026-84439","ids":[{"system_name":"Oracle Bug ID of Primavera Unifier","text":"40063078"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform (Apache ZooKeeper)).  Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"}]},{"cve":"CVE-2026-84501","ids":[{"system_name":"Oracle Bug ID of Primavera Unifier","text":"40063078"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform (Apache ZooKeeper)).  Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera Unifier accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"]}]},{"cve":"CVE-2026-8458","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-84939","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Console","text":"40113701"},{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"40070599"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Apache FreeMarker)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Unified Assurance accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Unified Assurance accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Console product of Oracle Communications (component: CNC Console (class)).  Supported versions that are affected are 25.2.202 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Console.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Console accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Console accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14250V-25.2.202","P-14250V-26.1.200","P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14250V-25.2.202","P-14250V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU405"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-14250V-25.2.202","P-14250V-26.1.200","P-14597V-6.1.1-7.0.0"]}]},{"cve":"CVE-2026-86138","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Certificate Management","text":"40119487"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Certificate Management product of Oracle Communications (component: Configuration (libxml2)).   The supported version that is affected is 26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Certificate Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Certificate Management.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14868V-26.1.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14868V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU411"}]},{"cve":"CVE-2026-86140","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Certificate Management","text":"40119487"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Certificate Management product of Oracle Communications (component: Configuration (libxml2)).   The supported version that is affected is 26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Certificate Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Certificate Management.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14868V-26.1.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14868V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU411"}]},{"cve":"CVE-2026-86142","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Certificate Management","text":"40119487"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Certificate Management product of Oracle Communications (component: Configuration (libxml2)).   The supported version that is affected is 26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Certificate Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Certificate Management.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14868V-26.1.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14868V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU411"}]},{"cve":"CVE-2026-86143","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Certificate Management","text":"40119487"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Certificate Management product of Oracle Communications (component: Configuration (libxml2)).   The supported version that is affected is 26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Certificate Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Certificate Management.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14868V-26.1.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14868V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU411"}]},{"cve":"CVE-2026-86144","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Certificate Management","text":"40119487"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Certificate Management product of Oracle Communications (component: Configuration (libxml2)).   The supported version that is affected is 26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Certificate Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Cloud Native Core Certificate Management.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14868V-26.1.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14868V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU411"}]},{"cve":"CVE-2026-86219","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Assurance","text":"39992619"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Assurance product of Oracle Communications (component: Core (Authen::SASL)).  Supported versions that are affected are 6.1.1-7.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Assurance.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Unified Assurance. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14597V-6.1.1-7.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14597V-6.1.1-7.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU362"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-14597V-6.1.1-7.0.0"]}]},{"cve":"CVE-2026-86248","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-86350","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-8643","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39953623"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server (pip)).  Supported versions that are affected are 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 5.0 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"}],"scores":[{"cvss_v3":{"baseScore":5.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]}]},{"cve":"CVE-2026-87022","flags":[{"date":"2026-10-20T13:00:00-07:00","label":"vulnerable_code_not_in_execute_path","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40065649"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the RDBMS (Apache Tomcat) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}],"threats":[{"category":"impact","date":"2026-10-20T13:00:00-07:00","details":"The affected code is not reachable through the execution of the code, including non-anticipated states of the product. Components that are neither used nor executed by the product.","product_ids":["P-5(RDBMS-Apache Tomcat)V-21.3-21.23"]}]},{"cve":"CVE-2026-87251","ids":[{"system_name":"Oracle Bug ID of Oracle Access Manager","text":"39275752"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5565V-14.1.2.1.0","P-5565V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5565V-14.1.2.1.0","P-5565V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5565V-14.1.2.1.0","P-5565V-12.2.1.4.0"]}]},{"cve":"CVE-2026-87255","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39276889"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Java SE (component: Compiler).  Supported versions that are affected are Oracle Java SE: 25.0.4.1 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE accessible data.  Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-25.0.4.1","P-856(Java SE)V-27"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1"]}]},{"cve":"CVE-2026-87263","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39351412"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"]}]},{"cve":"CVE-2026-87290","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39277217"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-87291","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39277338"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and  27. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE accessible data.  Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-25.0.4.1","P-856(Java SE)V-21.0.12.1","P-856(Java SE)V-27"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1"]}]},{"cve":"CVE-2026-87292","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39277364"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-87293","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39279248"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Java SE (component: RMI).  Supported versions that are affected are Oracle Java SE: 8u503 and  8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  While the vulnerability is in Oracle Java SE, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as  unauthorized read access to a subset of Oracle Java SE accessible data.  Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-8u503-perf","P-13497V-21.3.19.1.1","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(Java SE)V-8u503-perf","P-13497V-21.3.19.1.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-856(Java SE)V-8u503","P-856(Java SE)V-8u503-perf","P-13497V-21.3.19.1.1"]}]},{"acknowledgments":[{"names":["Arthur Chan"],"organization":"ADAlogics"}],"cve":"CVE-2026-87294","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39283554"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-87295","ids":[{"system_name":"Oracle Bug ID of Oracle HRMS (India)","text":"39558758"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Indian Payroll).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HRMS (India) executes to compromise Oracle HRMS (India).  While the vulnerability is in Oracle HRMS (India), attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle HRMS (India) accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1557V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1557V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-1557V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-87296","ids":[{"system_name":"Oracle Bug ID of Oracle Access Manager","text":"39284191"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5565V-14.1.2.1.0","P-5565V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5565V-14.1.2.1.0","P-5565V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-5565V-14.1.2.1.0","P-5565V-12.2.1.4.0"]}]},{"cve":"CVE-2026-87297","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39511596"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.1.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.2.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.1.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.2.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"}],"scores":[{"cvss_v3":{"baseScore":6.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.1.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.2.0.0.0"]}]},{"cve":"CVE-2026-87298","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Content","text":"39284243"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]}]},{"cve":"CVE-2026-87299","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Content","text":"39284244"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data as well as  unauthorized read access to a subset of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]}]},{"cve":"CVE-2026-87300","ids":[{"system_name":"Oracle Bug ID of Oracle Weblogic Server Proxy Plug-in","text":"39790509"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in.  While the vulnerability is in Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data as well as  unauthorized access to critical data or complete access to all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1042(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers)V-14.1.2.0.0","P-1042(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers)V-12.2.1.4.0","P-1042(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers)V-14.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1042(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers)V-14.1.2.0.0","P-1042(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers)V-12.2.1.4.0","P-1042(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers)V-14.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-1042(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers)V-14.1.2.0.0","P-1042(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers)V-12.2.1.4.0","P-1042(Oracle Weblogic Server Proxy Plug-in_WebLogic Server Proxy Plug-In for Third-Party Web Servers)V-14.1.1.0.0"]}]},{"acknowledgments":[{"names":["Tristan Madani"],"organization":"Talence Security"}],"cve":"CVE-2026-87301","ids":[{"system_name":"Oracle Bug ID of Oracle VM VirtualBox","text":"40176458"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.4 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8370V-7.2.16"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8370V-7.2.16"],"url":"https://support.oracle.com/support/?documentId=CPU414"}],"scores":[{"cvss_v3":{"baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H","version":"3.1"},"products":["P-8370V-7.2.16"]}]},{"cve":"CVE-2026-87302","ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39284299"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as  unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5242V-15.1.1.0.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0","P-5242V-14.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-5242V-14.1.1.0.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-5242V-15.1.1.0.0","P-5242V-14.1.1.0.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"]}]},{"acknowledgments":[{"names":["Tristan Madani"],"organization":"Talence Security"}],"cve":"CVE-2026-87303","ids":[{"system_name":"Oracle Bug ID of Oracle VM VirtualBox","text":"40176665"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8370V-7.2.16"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8370V-7.2.16"],"url":"https://support.oracle.com/support/?documentId=CPU414"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H","version":"3.1"},"products":["P-8370V-7.2.16"]}]},{"cve":"CVE-2026-87304","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39293919"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-87305","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286440"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87306","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286451"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87307","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286454"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87308","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286457"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87309","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286465"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87310","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286468"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Database and Comm SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"acknowledgments":[{"names":["Tristan Madani"],"organization":"Talence Security"}],"cve":"CVE-2026-87311","ids":[{"system_name":"Oracle Bug ID of Oracle VM VirtualBox","text":"40176673"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.16. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 5.6 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8370V-7.2.16"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8370V-7.2.16"],"url":"https://support.oracle.com/support/?documentId=CPU414"}],"scores":[{"cvss_v3":{"baseScore":5.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H","version":"3.1"},"products":["P-8370V-7.2.16"]}]},{"cve":"CVE-2026-87312","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286473"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87313","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286479"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87314","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286485"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87315","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286493"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87316","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286497"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87317","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286499"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 4.8 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":4.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87318","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286505"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87319","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286508"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87320","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286512"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87321","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286515"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"acknowledgments":[{"names":["Dhanush Arvind"]}],"cve":"CVE-2026-87322","ids":[{"system_name":"Oracle Bug ID of Oracle VM VirtualBox","text":"40094804"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).   The supported version that is affected is 7.2.20. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox.  While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8370V-7.2.20"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8370V-7.2.20"],"url":"https://support.oracle.com/support/?documentId=CPU414"}],"scores":[{"cvss_v3":{"baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-8370V-7.2.20"]}]},{"cve":"CVE-2026-87323","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286519"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87324","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286529"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools as well as  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data and  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87325","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286531"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools as well as  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data and  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87326","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286535"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87327","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286540"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87328","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286554"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87329","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286563"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87330","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286566"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 4.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":4.2,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87331","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286570"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 3.4 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":3.4,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87332","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286576"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - Cloud).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 3.0 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":3.0,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87333","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39286585"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 3.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":3.6,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87334","ids":[{"system_name":"Oracle Bug ID of Oracle JDeveloper","text":"39286594"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle JDeveloper executes to compromise Oracle JDeveloper.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-807V-14.1.2.0.0","P-807V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-807V-14.1.2.0.0","P-807V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-807V-14.1.2.0.0","P-807V-12.2.1.4.0"]}]},{"cve":"CVE-2026-87335","ids":[{"system_name":"Oracle Bug ID of Applications DBA","text":"39383365"}],"notes":[{"category":"description","text":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Applications DBA.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Applications DBA accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-166V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-166V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-166V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-87336","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39286748"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-87337","ids":[{"system_name":"Oracle Bug ID of Oracle Access Manager","text":"39286800"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5565V-14.1.2.1.0","P-5565V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5565V-14.1.2.1.0","P-5565V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":10.0,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-5565V-14.1.2.1.0","P-5565V-12.2.1.4.0"]}]},{"cve":"CVE-2026-87338","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Integration","text":"39288505"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM Integration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Integration accessible data as well as  unauthorized update, insert or delete access to some of Siebel CRM Integration accessible data. CVSS 3.1 Base Score 6.9 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9008V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9008V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N","version":"3.1"},"products":["P-9008V-17.0-26.9"]}]},{"cve":"CVE-2026-87339","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Integration","text":"39288519"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Siebel CRM Integration accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9008V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9008V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-9008V-17.0-26.9"]}]},{"cve":"CVE-2026-87340","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39288587"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-87341","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39288601"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PUM Automated Updates). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-87342","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39288602"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-87343","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39288604"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":4.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-87344","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39288841"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: LDAP).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-87345","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39288863"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-87346","ids":[{"system_name":"Oracle Bug ID of Oracle HTTP Server","text":"39288994"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server.  While the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server accessible data as well as  unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1042(Oracle HTTP Server_Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server)V-12.2.1.4.0","P-1042(Oracle HTTP Server_Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server)V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1042(Oracle HTTP Server_Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server)V-14.1.2.0.0","P-1042(Oracle HTTP Server_Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server)V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-1042(Oracle HTTP Server_Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server)V-14.1.2.0.0","P-1042(Oracle HTTP Server_Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server)V-12.2.1.4.0"]}]},{"cve":"CVE-2026-87347","ids":[{"system_name":"Oracle Bug ID of Oracle HTTP Server","text":"39289003"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HTTP Server.  While the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server accessible data as well as  unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1042(Oracle HTTP Server_OSSL Module)V-12.2.1.4.0","P-1042(Oracle HTTP Server_OSSL Module)V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1042(Oracle HTTP Server_OSSL Module)V-14.1.2.0.0","P-1042(Oracle HTTP Server_OSSL Module)V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.6,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-1042(Oracle HTTP Server_OSSL Module)V-14.1.2.0.0","P-1042(Oracle HTTP Server_OSSL Module)V-12.2.1.4.0"]}]},{"cve":"CVE-2026-87348","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39289110"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 4.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":4.2,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-87349","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39289675"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-87350","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39289712"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 4.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":4.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-87351","ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate","text":"39290098"}],"notes":[{"category":"description","text":"Vulnerability in Oracle GoldenGate (component: Admin Server Executable).  Supported versions that are affected are 19.1.0.0.0-19.32.0.0,   21.3-21.23 and   23.4-23.26.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle GoldenGate.  Successful attacks of this vulnerability can result in takeover of Oracle GoldenGate. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5757V-23.4-23.26.3.0.0","P-5757V-21.3-21.23","P-5757V-19.1.0.0.0-19.32.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5757V-19.1.0.0.0-19.32.0.0","P-5757V-23.4-23.26.3.0.0","P-5757V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5757V-19.1.0.0.0-19.32.0.0","P-5757V-23.4-23.26.3.0.0","P-5757V-21.3-21.23"]}]},{"cve":"CVE-2026-87352","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39290303"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: LDAP).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":4.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-87353","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39290312"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Porting).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 4.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":4.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-87354","ids":[{"system_name":"Oracle Bug ID of Oracle TimesTen In-Memory Database","text":"39290657"}],"notes":[{"category":"description","text":"Vulnerability in Oracle TimesTen In-Memory Database (component: Kubernetes Operator).  Supported versions that are affected are 22.1-22.1.40.0 and  26.1-26.1.1.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle TimesTen In-Memory Database.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle TimesTen In-Memory Database accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1870V-26.1-26.1.1.2.0","P-1870V-22.1-22.1.40.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1870V-26.1-26.1.1.2.0","P-1870V-22.1-22.1.40.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-1870V-26.1-26.1.1.2.0","P-1870V-22.1-22.1.40.0"]}]},{"cve":"CVE-2026-87355","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39290871"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":4.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-87356","ids":[{"system_name":"Oracle Bug ID of Applications Platform Engineering","text":"39383759"}],"notes":[{"category":"description","text":"Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications Platform Engineering executes to compromise Applications Platform Engineering.  Successful attacks of this vulnerability can result in takeover of Applications Platform Engineering. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4488V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4488V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4488V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-87357","ids":[{"system_name":"Oracle Bug ID of Order Capture","text":"39384320"}],"notes":[{"category":"description","text":"Vulnerability in the Order Capture product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Order Capture.  Successful attacks of this vulnerability can result in takeover of Order Capture. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-769V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-769V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-769V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-87358","ids":[{"system_name":"Oracle Bug ID of Oracle General Ledger","text":"39391406"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle General Ledger accessible data as well as  unauthorized read access to a subset of Oracle General Ledger accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle General Ledger. CVSS 3.1 Base Score 7.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-500V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-500V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"products":["P-500V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-87359","ids":[{"system_name":"Oracle Bug ID of Oracle Service Bus","text":"39292537"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5308V-14.1.2.0.0","P-5308V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5308V-14.1.2.0.0","P-5308V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5308V-14.1.2.0.0","P-5308V-12.2.1.4.0"]}]},{"cve":"CVE-2026-87360","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Content","text":"39292588"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]}]},{"cve":"CVE-2026-87361","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Content","text":"39292593"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2271V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2271V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-2271V-12.2.1.4.0"]}]},{"cve":"CVE-2026-87362","ids":[{"system_name":"Oracle Bug ID of Oracle Agile PLM","text":"39529649"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments).   The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4461V-9.3.6"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4461V-9.3.6"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4461V-9.3.6"]}]},{"cve":"CVE-2026-87363","ids":[{"system_name":"Oracle Bug ID of Oracle Payroll","text":"39495249"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll.  Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-506V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-506V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-506V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-87364","ids":[{"system_name":"Oracle Bug ID of Oracle Service Bus","text":"39293360"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5308V-14.1.2.0.0","P-5308V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5308V-14.1.2.0.0","P-5308V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5308V-14.1.2.0.0","P-5308V-12.2.1.4.0"]}]},{"cve":"CVE-2026-87365","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Content","text":"39293373"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebCenter Content. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]}]},{"cve":"CVE-2026-87366","ids":[{"system_name":"Oracle Bug ID of Oracle Applications Framework","text":"39610123"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Web Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications Framework.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1472V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1472V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-1472V-12.2.3-12.2.15"]}]},{"acknowledgments":[{"names":["4ra1n, pyn3rd and unam4"]},{"names":["Alexander Dezhinov, Stanislav Dukhin, Nikita Kozlov"]}],"cve":"CVE-2026-87367","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39293468"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-87369","ids":[{"system_name":"Oracle Bug ID of Oracle Service Bus","text":"39293845"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Service Bus. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5308V-14.1.2.0.0","P-5308V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5308V-14.1.2.0.0","P-5308V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-5308V-14.1.2.0.0","P-5308V-12.2.1.4.0"]}]},{"cve":"CVE-2026-87370","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Content","text":"39293853"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data as well as  unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N","version":"3.1"},"products":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]}]},{"cve":"CVE-2026-87371","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Content","text":"39293872"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle WebCenter Content executes to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as  unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]}]},{"cve":"CVE-2026-87372","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Content","text":"39293876"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle WebCenter Content executes to compromise Oracle WebCenter Content.  While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]}]},{"cve":"CVE-2026-87373","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Content","text":"39293878"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data as well as  unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]}]},{"cve":"CVE-2026-87374","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Content","text":"39293879"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as  unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]}]},{"cve":"CVE-2026-87375","ids":[{"system_name":"Oracle Bug ID of WebCenter Content: Imaging","text":"39293888"}],"notes":[{"category":"description","text":"Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebCenter Content: Imaging.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all WebCenter Content: Imaging accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4576V-12.2.1.4.0","P-4576V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4576V-12.2.1.4.0","P-4576V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4576V-12.2.1.4.0","P-4576V-14.1.2.0.0"]}]},{"cve":"CVE-2026-87376","ids":[{"system_name":"Oracle Bug ID of WebCenter Content: Imaging","text":"39293902"}],"notes":[{"category":"description","text":"Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core).   The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise WebCenter Content: Imaging.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all WebCenter Content: Imaging accessible data as well as  unauthorized access to critical data or complete access to all WebCenter Content: Imaging accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4576V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4576V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-4576V-14.1.2.0.0"]}]},{"cve":"CVE-2026-87377","ids":[{"system_name":"Oracle Bug ID of WebCenter Content: Imaging","text":"39293903"}],"notes":[{"category":"description","text":"Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core).   The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via SOAP to compromise WebCenter Content: Imaging.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all WebCenter Content: Imaging accessible data as well as  unauthorized access to critical data or complete access to all WebCenter Content: Imaging accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4576V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4576V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-4576V-14.1.2.0.0"]}]},{"cve":"CVE-2026-87378","ids":[{"system_name":"Oracle Bug ID of WebCenter Content: Imaging","text":"39293904"}],"notes":[{"category":"description","text":"Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebCenter Content: Imaging.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all WebCenter Content: Imaging accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4576V-12.2.1.4.0","P-4576V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4576V-12.2.1.4.0","P-4576V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4576V-12.2.1.4.0","P-4576V-14.1.2.0.0"]}]},{"cve":"CVE-2026-87379","ids":[{"system_name":"Oracle Bug ID of WebCenter Content: Imaging","text":"39293905"}],"notes":[{"category":"description","text":"Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise WebCenter Content: Imaging.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of WebCenter Content: Imaging accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4576V-12.2.1.4.0","P-4576V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4576V-12.2.1.4.0","P-4576V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-4576V-12.2.1.4.0","P-4576V-14.1.2.0.0"]}]},{"cve":"CVE-2026-87380","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Sales Order Entry","text":"39294675"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Sales Order Entry product of Oracle JD Edwards (component: Sales Order Entry).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Sales Order Entry.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Sales Order Entry accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4769V-9.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4769V-9.2"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4769V-9.2"]}]},{"cve":"CVE-2026-87381","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39294784"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87382","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Operational Sourcing","text":"39294786"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Operational Sourcing product of Oracle JD Edwards (component: Operational Sourcing).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via SMTP to compromise JD Edwards EnterpriseOne Operational Sourcing.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Operational Sourcing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5533V-9.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5533V-9.2"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-5533V-9.2"]}]},{"cve":"CVE-2026-87383","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39294788"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-87384","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Human Resources Management","text":"39294790"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Human Resources Management.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Human Resources Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Human Resources Management. CVSS 3.1 Base Score 5.4 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4742V-9.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4742V-9.2"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"products":["P-4742V-9.2"]}]},{"cve":"CVE-2026-87385","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Human Resources Management","text":"39294793"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources).   The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Human Resources Management.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Human Resources Management accessible data as well as  unauthorized read access to a subset of JD Edwards EnterpriseOne Human Resources Management accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4742V-9.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4742V-9.2"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":4.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-4742V-9.2"]}]},{"cve":"CVE-2026-87386","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne General Ledger","text":"39294794"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle JD Edwards (component: E1 Foundation).   The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne General Ledger.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne General Ledger. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4737V-9.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4737V-9.2"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-4737V-9.2"]}]},{"cve":"CVE-2026-87387","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Homebuilder","text":"39294795"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Homebuilder product of Oracle JD Edwards (component: Homebuilder Management).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Homebuilder.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Homebuilder accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4741V-9.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4741V-9.2"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-4741V-9.2"]}]},{"cve":"CVE-2026-87388","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Configurator","text":"39294799"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Configurator product of Oracle JD Edwards (component: Configuration Management).   The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Configurator.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Configurator accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4710V-9.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4710V-9.2"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-4710V-9.2"]}]},{"cve":"CVE-2026-87389","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Human Resources Management","text":"39294804"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources).   The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Human Resources Management.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Human Resources Management accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4742V-9.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4742V-9.2"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-4742V-9.2"]}]},{"cve":"CVE-2026-87390","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Content","text":"39295138"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Content. CVSS 3.1 Base Score 5.4 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","version":"3.1"},"products":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]}]},{"cve":"CVE-2026-87391","ids":[{"system_name":"Oracle Bug ID of WebCenter Content: Imaging","text":"39295171"}],"notes":[{"category":"description","text":"Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where WebCenter Content: Imaging executes to compromise WebCenter Content: Imaging.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in WebCenter Content: Imaging, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all WebCenter Content: Imaging accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4576V-12.2.1.4.0","P-4576V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4576V-12.2.1.4.0","P-4576V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-4576V-12.2.1.4.0","P-4576V-14.1.2.0.0"]}]},{"cve":"CVE-2026-87392","ids":[{"system_name":"Oracle Bug ID of WebCenter Content: Imaging","text":"39295172"}],"notes":[{"category":"description","text":"Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise WebCenter Content: Imaging.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all WebCenter Content: Imaging accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4576V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4576V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-4576V-14.1.2.0.0"]}]},{"cve":"CVE-2026-87393","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39295178"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-87394","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39295190"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-87395","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39295194"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-87396","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39295195"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-87397","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39295206"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-87398","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39295218"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-87399","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Content","text":"39295221"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as  unauthorized read access to a subset of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 6.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2271V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2271V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N","version":"3.1"},"products":["P-2271V-14.1.2.0.0"]}]},{"cve":"CVE-2026-87400","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Content","text":"39295224"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).   The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data as well as  unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 6.9 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2271V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2271V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N","version":"3.1"},"products":["P-2271V-14.1.2.0.0"]}]},{"cve":"CVE-2026-87401","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39295989"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: XML Publisher).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":3.3,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-87402","ids":[{"system_name":"Oracle Bug ID of Applications DBA","text":"39704207"}],"notes":[{"category":"description","text":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-166V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-166V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-166V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-87403","ids":[{"system_name":"Oracle Bug ID of Applications DBA","text":"39705375"}],"notes":[{"category":"description","text":"Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Applications DBA accessible data as well as  unauthorized access to critical data or complete access to all Applications DBA accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-166V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-166V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-166V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-87404","ids":[{"system_name":"Oracle Bug ID of Pasta","text":"39717311"}],"notes":[{"category":"description","text":"Vulnerability in the Pasta product of Oracle E-Business Suite (component: Printing Engine).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Pasta.  Successful attacks of this vulnerability can result in takeover of Pasta. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1195V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1195V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1195V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-87405","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296139"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-87407","ids":[{"system_name":"Oracle Bug ID of Oracle Applications Framework","text":"39869460"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Security).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1472V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1472V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-1472V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-87408","ids":[{"system_name":"Oracle Bug ID of Oracle Applications Framework","text":"39913277"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Applications Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1472V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1472V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-1472V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-87409","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296168"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: nVision).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-87410","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296197"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-87411","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"31429348"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 5.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-87412","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296225"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":2.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"acknowledgments":[{"names":["Safa S. Karakuş"],"organization":"Secunnix Siber Teknoloji Hizmetleri Ltd. Sti."}],"cve":"CVE-2026-87413","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39191029"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 5.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-87414","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39287816"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).   The supported version that is affected is 11.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Solaris.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Solaris accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-87415","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296293"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-87416","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296296"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-87417","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39291673"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Solaris accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-87418","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39296835"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 2.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":2.5,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-87419","ids":[{"system_name":"Oracle Bug ID of Oracle Service Bus","text":"39297000"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5308V-14.1.2.0.0","P-5308V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5308V-14.1.2.0.0","P-5308V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5308V-14.1.2.0.0","P-5308V-12.2.1.4.0"]}]},{"cve":"CVE-2026-87420","ids":[{"system_name":"Oracle Bug ID of Oracle Service Bus","text":"39297004"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5308V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5308V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5308V-14.1.2.0.0"]}]},{"cve":"CVE-2026-87421","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39291678"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Solaris accessible data as well as  unauthorized update, insert or delete access to some of Oracle Solaris accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-87422","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39293697"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Solaris accessible data. CVSS 3.1 Base Score 2.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":2.5,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-87423","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39293707"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: X Window System).   The supported version that is affected is 11.4. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Solaris accessible data as well as  unauthorized read access to a subset of Oracle Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Solaris. CVSS 3.1 Base Score 4.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":4.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-8763","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39993826"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Security Edge Protection Proxy","text":"40115141"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"39989976"},{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Unified Data Repository","text":"40120457"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (Bouncy Castle Java Library)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Global Lifecycle Management NextGen OUI Framework accessible data as well as  unauthorized access to critical data or complete access to all Oracle Global Lifecycle Management NextGen OUI Framework accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Third Party (Bouncy Castle Java Library)).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Middleware Common Libraries and Tools.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: Signaling (Bouncy Castle Java Library)).  Supported versions that are affected are 25.2.200 and  26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Security Edge Protection Proxy accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Security Edge Protection Proxy accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Unified Data Repository product of Oracle Communications (component: Configuration (Bouncy Castle Java Library)).  Supported versions that are affected are 25.2.200 and 26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Communications Cloud Native Core Unified Data Repository.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Unified Data Repository accessible data as well as  unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Unified Data Repository accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-14.1.2.0.0","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-14119V-26.1.200","P-12738V-15.1.1.0.0","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200","P-14119V-25.2.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-4647V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200"],"url":"https://support.oracle.com/support/?documentId=CPU400"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14119V-26.1.200","P-14119V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU407"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-12738V-14.1.2.0.0","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-25.2.200","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-14119V-26.1.200","P-12738V-15.1.1.0.0","P-14123(Oracle Communications Cloud Native Core Security Edge Protection Proxy_Signaling)V-26.1.200","P-14119V-25.2.200"]}]},{"cve":"CVE-2026-89044","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40022653"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise RDBMS (Micronaut).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (Micronaut) accessible data as well as  unauthorized read access to a subset of RDBMS (Micronaut) accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-8924","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-8926","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-8927","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-8932","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-89407","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Unified Data Repository","text":"40120734"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"40112934"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (jackson-databind)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Global Lifecycle Management NextGen OUI Framework.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Unified Data Repository product of Oracle Communications (component: Configuration (jackson-core)).  Supported versions that are affected are 25.2.200 and 26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Unified Data Repository.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Unified Data Repository.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-14119V-26.1.200","P-12738V-15.1.1.0.0","P-14119V-25.2.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14119V-26.1.200","P-14119V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU407"}]},{"cve":"CVE-2026-89425","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Unified Data Repository","text":"40120734"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"40112934"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (jackson-databind)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Global Lifecycle Management NextGen OUI Framework.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Unified Data Repository product of Oracle Communications (component: Configuration (jackson-core)).  Supported versions that are affected are 25.2.200 and 26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Unified Data Repository.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Unified Data Repository.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-14119V-26.1.200","P-12738V-15.1.1.0.0","P-14119V-25.2.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14119V-26.1.200","P-14119V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU407"}]},{"cve":"CVE-2026-9076","ids":[{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114042"},{"system_name":"Oracle Bug ID of MySQL Server","text":"40082971"},{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39442783"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security (OpenSSL)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (OpenSSL)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (OpenSSL)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-5085V-8.61-8.63","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-9079","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-9080","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-91208","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39293708"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 5.1 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":5.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-91209","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39293709"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: X Window System).   The supported version that is affected is 11.4. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Solaris accessible data as well as  unauthorized read access to a subset of Oracle Solaris accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Solaris. CVSS 3.1 Base Score 4.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":4.2,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-91210","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Content","text":"39299131"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).   The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data as well as  unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2271V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2271V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N","version":"3.1"},"products":["P-2271V-14.1.2.0.0"]}]},{"cve":"CVE-2026-91211","ids":[{"system_name":"Oracle Bug ID of Oracle Identity Manager Connector","text":"39299897"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via SOAP to compromise Oracle Identity Manager Connector.  While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1999V-12.2.1.4.0","P-1999V-14.1.2.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1999V-14.1.2.1.0","P-1999V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-1999V-14.1.2.1.0","P-1999V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91212","ids":[{"system_name":"Oracle Bug ID of Oracle Identity Manager Connector","text":"39299927"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector.  While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1999V-12.2.1.4.0","P-1999V-14.1.2.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1999V-14.1.2.1.0","P-1999V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-1999V-14.1.2.1.0","P-1999V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91213","ids":[{"system_name":"Oracle Bug ID of Oracle Business Process Management Suite","text":"39299999"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: BPM Composer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5325V-12.2.1.4.0","P-5325V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5325V-14.1.2.0.0","P-5325V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5325V-14.1.2.0.0","P-5325V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91214","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300008"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"acknowledgments":[{"names":["Co-tang X"]}],"cve":"CVE-2026-91215","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300011"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91216","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300013"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":10.0,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91217","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300017"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91218","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300018"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data as well as  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.6,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91219","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300019"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91220","ids":[{"system_name":"Oracle Bug ID of Oracle Business Process Management Suite","text":"39300020"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5325V-12.2.1.4.0","P-5325V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5325V-14.1.2.0.0","P-5325V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5325V-14.1.2.0.0","P-5325V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91221","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300021"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":10.0,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91222","ids":[{"system_name":"Oracle Bug ID of Oracle Business Process Management Suite","text":"39300023"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human Workflow (11g+)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle Business Process Management Suite.  While the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Business Process Management Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5325V-12.2.1.4.0","P-5325V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5325V-14.1.2.0.0","P-5325V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-5325V-14.1.2.0.0","P-5325V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91223","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300028"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91224","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300030"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91225","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300032"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91226","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300035"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91227","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300036"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91228","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300039"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data as well as  unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91229","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300042"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91230","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300043"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data as well as  unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"acknowledgments":[{"names":["Co-tang X"]}],"cve":"CVE-2026-91231","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300045"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":10.0,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91232","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300047"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91233","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300057"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Enterprise Scheduling System).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91234","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300060"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91235","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300061"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91236","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300062"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91237","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300063"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91238","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300069"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91239","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300072"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91240","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Sites","text":"39300106"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9617V-12.2.1.4.0","P-9617V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9617V-12.2.1.4.0","P-9617V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-9617V-12.2.1.4.0","P-9617V-14.1.2.0.0"]}]},{"cve":"CVE-2026-91241","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39532661"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Administration).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0","P-2025V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-12.2.1.4.0","P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-2025V-12.2.1.4.0","P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"]}]},{"cve":"CVE-2026-91242","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39293714"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Plugins).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Solaris accessible data as well as  unauthorized access to critical data or complete access to all Oracle Solaris accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-91243","ids":[{"system_name":"Oracle Bug ID of Oracle Business Process Management Suite","text":"39301052"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  While the vulnerability is in Oracle Business Process Management Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Business Process Management Suite accessible data as well as  unauthorized access to critical data or complete access to all Oracle Business Process Management Suite accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5325V-12.2.1.4.0","P-5325V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5325V-14.1.2.0.0","P-5325V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.6,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-5325V-14.1.2.0.0","P-5325V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91244","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39293716"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 4.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":4.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-91245","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Portal","text":"39301077"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebCenter Portal accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1696V-14.1.2.0.0","P-1696V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1696V-14.1.2.0.0","P-1696V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-1696V-14.1.2.0.0","P-1696V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91246","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Portal","text":"39301108"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle WebCenter Portal accessible data as well as  unauthorized read access to a subset of Oracle WebCenter Portal accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1696V-14.1.2.0.0","P-1696V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1696V-14.1.2.0.0","P-1696V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-1696V-14.1.2.0.0","P-1696V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91247","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Portal","text":"39301116"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Portal accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Portal. CVSS 3.1 Base Score 5.9 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1696V-14.1.2.0.0","P-1696V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1696V-14.1.2.0.0","P-1696V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L","version":"3.1"},"products":["P-1696V-14.1.2.0.0","P-1696V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91248","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Portal","text":"39301120"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle WebCenter Portal accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1696V-14.1.2.0.0","P-1696V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1696V-14.1.2.0.0","P-1696V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-1696V-14.1.2.0.0","P-1696V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91249","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39293722"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Libraries).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":3.3,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-91250","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300034"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91251","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39300055"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite.  While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle SOA Suite. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91252","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39340658"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris and  unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-91253","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39340659"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-91254","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39340660"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-91255","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39340662"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-91256","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39340669"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris and  unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-91257","ids":[{"system_name":"Oracle Bug ID of iSupport","text":"39354558"}],"notes":[{"category":"description","text":"Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all iSupport accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-381V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-381V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-381V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-91259","ids":[{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39301366"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1980V-12.2.1.4.0","P-1980V-14.1.2.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1980V-14.1.2.1.0","P-1980V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1980V-14.1.2.1.0","P-1980V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91260","ids":[{"system_name":"Oracle Bug ID of iProcurement","text":"39384058"}],"notes":[{"category":"description","text":"Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise iProcurement.  Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-398V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-398V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-398V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-91261","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Content","text":"39301638"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).   The supported version that is affected is 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2271V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2271V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-2271V-14.1.2.0.0"]}]},{"cve":"CVE-2026-91262","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Content","text":"39301640"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data as well as  unauthorized read access to a subset of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2271V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2271V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-2271V-14.1.2.0.0"]}]},{"cve":"CVE-2026-91263","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39315723"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Notification Configuration).  Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  While the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.9 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":4.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-91264","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise SCM Manufacturing","text":"39324799"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise SCM Manufacturing product of Oracle PeopleSoft (component: Security).   The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Manufacturing.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM Manufacturing accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5126V-9.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5126V-9.2"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-5126V-9.2"]}]},{"cve":"CVE-2026-91265","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325562"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91266","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325605"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91267","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325618"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":8.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91268","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325624"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91269","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325627"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91270","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325630"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91271","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325639"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91272","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325644"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91273","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325656"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Object and Env Tech SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":8.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91274","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325657"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91275","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325662"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows high privileged attacker with network access via SQL to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91276","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Orchestrator","text":"39325677"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Orchestrator accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-11681V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11681V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-11681V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91277","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Orchestrator","text":"39325686"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of JD Edwards EnterpriseOne Orchestrator accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-11681V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11681V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-11681V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91278","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325691"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91279","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325696"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91280","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325699"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91281","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325702"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91282","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325718"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Portal SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91283","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325726"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91284","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325742"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91285","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Orchestrator","text":"39325765"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Orchestrator accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-11681V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11681V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-11681V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91286","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325831"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91287","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325840"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91288","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325845"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91289","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325849"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91290","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325851"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91291","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325854"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 3.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":3.6,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91292","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Localizations","text":"39325881"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Localizations product of Oracle JD Edwards (component: LATAM).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Localizations.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of JD Edwards EnterpriseOne Localizations accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Localizations. CVSS 3.1 Base Score 5.4 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9032V-9.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9032V-9.2"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"products":["P-9032V-9.2"]}]},{"cve":"CVE-2026-91293","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325885"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 5.4 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91294","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325888"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 4.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91295","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325901"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91296","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325903"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91297","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325909"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91298","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325914"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91299","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Orchestrator","text":"39325918"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator.  While the vulnerability is in JD Edwards EnterpriseOne Orchestrator, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Orchestrator. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-11681V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11681V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":10.0,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-11681V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91300","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325940"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91301","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325944"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 3.6 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":3.6,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91302","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325950"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 3.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":3.3,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91303","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325961"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91304","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325973"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91305","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39325999"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91306","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39326002"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91307","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39326004"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91308","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39326006"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91309","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39326013"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91310","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39326015"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91311","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39326024"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91312","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39326029"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91313","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39326044"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.4"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.4"]}]},{"cve":"CVE-2026-91314","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39326102"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91315","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39326103"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91316","ids":[{"system_name":"Oracle Bug ID of iProcurement","text":"39384083"}],"notes":[{"category":"description","text":"Vulnerability in the iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise iProcurement.  Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-398V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-398V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-398V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-91317","ids":[{"system_name":"Oracle Bug ID of Oracle JDeveloper","text":"39326420"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Databinding).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle JDeveloper.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle JDeveloper. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-807V-14.1.2.0.0","P-807V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-807V-14.1.2.0.0","P-807V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"products":["P-807V-14.1.2.0.0","P-807V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91318","ids":[{"system_name":"Oracle Bug ID of Oracle JDeveloper","text":"39326425"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security Framework).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle JDeveloper accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-807V-14.1.2.0.0","P-807V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-807V-14.1.2.0.0","P-807V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-807V-14.1.2.0.0","P-807V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91319","ids":[{"system_name":"Oracle Bug ID of Oracle JDeveloper","text":"39326436"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Java Business Objects).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle JDeveloper accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-807V-14.1.2.0.0","P-807V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-807V-14.1.2.0.0","P-807V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-807V-14.1.2.0.0","P-807V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91320","ids":[{"system_name":"Oracle Bug ID of Oracle JDeveloper","text":"39326443"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle JDeveloper executes to compromise Oracle JDeveloper.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle JDeveloper accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle JDeveloper. CVSS 3.1 Base Score 5.7 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-807V-14.1.2.0.0","P-807V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-807V-14.1.2.0.0","P-807V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":5.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"products":["P-807V-14.1.2.0.0","P-807V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91321","ids":[{"system_name":"Oracle Bug ID of iProcurement","text":"39384088"}],"notes":[{"category":"description","text":"Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Requisition Management).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise iProcurement.  Successful attacks of this vulnerability can result in takeover of iProcurement. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-398V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-398V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-398V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-91322","ids":[{"system_name":"Oracle Bug ID of Oracle JDeveloper","text":"39326457"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle JDeveloper executes to compromise Oracle JDeveloper.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle JDeveloper accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-807V-14.1.2.0.0","P-807V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-807V-14.1.2.0.0","P-807V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":3.3,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-807V-14.1.2.0.0","P-807V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91323","ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39327259"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5242V-15.1.1.0.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0","P-5242V-14.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-5242V-14.1.1.0.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5242V-15.1.1.0.0","P-5242V-14.1.1.0.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"]}]},{"cve":"CVE-2026-91324","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39427871"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Libraries).   The supported version that is affected is 11.4. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 4.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":4.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-91325","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39328739"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91326","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39328757"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.4"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.4"]}]},{"cve":"CVE-2026-91327","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39328764"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91328","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39328775"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91329","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39328781"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91330","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39328783"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 3.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":3.3,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91331","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise CC Common Application Objects","text":"39332818"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Common Application Objects).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise CC Common Application Objects accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 3.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8911V-9.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8911V-9.2"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":3.8,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-8911V-9.2"]}]},{"cve":"CVE-2026-91332","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39333541"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91333","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39333559"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Java SE (component: Security).  Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-25.0.4.1","P-856(Java SE)V-21.0.12.1","P-856(Java SE)V-27"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1"]}]},{"cve":"CVE-2026-91334","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39333587"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91335","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39333662"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 2.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":2.6,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91336","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39486671"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Solaris accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-91337","ids":[{"system_name":"Oracle Bug ID of iProcurement","text":"39384091"}],"notes":[{"category":"description","text":"Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Internal operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise iProcurement.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all iProcurement accessible data as well as  unauthorized access to critical data or complete access to all iProcurement accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-398V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-398V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-398V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-91338","ids":[{"system_name":"Oracle Bug ID of iSupport","text":"39385403"}],"notes":[{"category":"description","text":"Vulnerability in the iSupport product of Oracle E-Business Suite (component: Internal operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all iSupport accessible data as well as  unauthorized read access to a subset of iSupport accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-381V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-381V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"products":["P-381V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-91339","ids":[{"system_name":"Oracle Bug ID of iSupport","text":"39385407"}],"notes":[{"category":"description","text":"Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all iSupport accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-381V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-381V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-381V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-91340","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39337871"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-91341","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39337875"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 9.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-91342","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39337878"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data as well as  unauthorized read access to a subset of Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-91343","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39337880"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.6 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-91344","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39337883"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-91345","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39337887"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-91346","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39337890"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data as well as  unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-91347","ids":[{"system_name":"Oracle Bug ID of iSupport","text":"39385417"}],"notes":[{"category":"description","text":"Vulnerability in the iSupport product of Oracle E-Business Suite (component: Service Requests).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport.  While the vulnerability is in iSupport, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all iSupport accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of iSupport. CVSS 3.1 Base Score 8.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-381V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-381V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L","version":"3.1"},"products":["P-381V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-91348","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39387101"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).  Supported versions that are affected are 11.3 and  11.4. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4","P-10006V-11.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4","P-10006V-11.3"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-10006V-11.4","P-10006V-11.3"]}]},{"cve":"CVE-2026-91349","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39340128"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-91350","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39340381"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-91351","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39341197"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 6.1 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-91352","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39341239"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-91353","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39341241"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-91354","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39341243"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Outside In Technology.  While the vulnerability is in Oracle Outside In Technology, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-91355","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39344129"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-91356","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise HCM Global Payroll Switzerland","text":"39349032"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Switzerland product of Oracle PeopleSoft (component: Global Payroll for Switzerland).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise HCM Global Payroll Switzerland executes to compromise PeopleSoft Enterprise HCM Global Payroll Switzerland.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise HCM Global Payroll Switzerland accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise HCM Global Payroll Switzerland accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise HCM Global Payroll Switzerland. CVSS 3.1 Base Score 4.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5068V-9.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5068V-9.2"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":4.2,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-5068V-9.2"]}]},{"cve":"CVE-2026-91357","ids":[{"system_name":"Oracle Bug ID of Oracle Order Management","text":"39391350"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Transaction Entry).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Order Management accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-497V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-497V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-497V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-91358","ids":[{"system_name":"Oracle Bug ID of Oracle Business Process Management Suite","text":"39351448"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Case management  Service (11g+)).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Process Management Suite.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Business Process Management Suite accessible data as well as  unauthorized update, insert or delete access to some of Oracle Business Process Management Suite accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5325V-12.2.1.4.0","P-5325V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5325V-14.1.2.0.0","P-5325V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-5325V-14.1.2.0.0","P-5325V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91359","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39355236"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-91360","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39355294"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-91361","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39355337"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-91362","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39355376"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-91363","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39355435"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-91364","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39355461"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Cloud Applications accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-91365","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39355657"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data as well as  unauthorized update, insert or delete access to some of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-91366","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39355680"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications.  While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM Cloud Applications accessible data as well as  unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 4.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":4.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-91367","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39356126"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications.  While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-91368","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39356325"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 4.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":4.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-91369","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39356401"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-91370","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39356932"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-91371","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39356966"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications.  While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 5.8 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-91372","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Cloud Applications","text":"39357029"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).  Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14107V-22.3-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14107V-22.3-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":3.3,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-14107V-22.3-26.9"]}]},{"cve":"CVE-2026-91373","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39359542"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91374","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39360539"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serviceability).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":4.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91375","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39360579"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":4.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91376","ids":[{"system_name":"Oracle Bug ID of Primavera P6 Enterprise Project Portfolio Management","text":"39683534"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access).  Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Primavera P6 Enterprise Project Portfolio Management accessible data as well as  unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5579V-25.12.0-25.12.8","P-5579V-21.12.0.0-21.12.21.9","P-5579V-24.12.0-24.12.16","P-5579V-23.12.0-23.12.20","P-5579V-22.12.0.0-22.12.21.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5579V-24.12.0-24.12.16","P-5579V-25.12.0-25.12.8","P-5579V-21.12.0.0-21.12.21.9","P-5579V-23.12.0-23.12.20","P-5579V-22.12.0.0-22.12.21.4"],"url":"https://support.oracle.com/support/?documentId=CPU415"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N","version":"3.1"},"products":["P-5579V-24.12.0-24.12.16","P-5579V-25.12.0-25.12.8","P-5579V-21.12.0.0-21.12.21.9","P-5579V-23.12.0-23.12.20","P-5579V-22.12.0.0-22.12.21.4"]}]},{"cve":"CVE-2026-91377","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Integration","text":"39362533"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).  Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Integration accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9008V-25.12-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9008V-25.12-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-9008V-25.12-26.9"]}]},{"cve":"CVE-2026-91378","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Integration","text":"39362550"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).  Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM Integration, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM Integration accessible data as well as  unauthorized read access to a subset of Siebel CRM Integration accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9008V-25.12-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9008V-25.12-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-9008V-25.12-26.9"]}]},{"acknowledgments":[{"names":["Alexander Dezhinov, Stanislav Dukhin, Nikita Kozlov"]}],"cve":"CVE-2026-91379","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39368341"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JDK tools).  Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 4.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":4.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91380","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39368364"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.0 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":4.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91381","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39368565"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u503 and  8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-8u503-perf","P-13497V-21.3.19.1.1","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(Java SE)V-8u503-perf","P-13497V-21.3.19.1.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-856(Java SE)V-8u503","P-856(Java SE)V-8u503-perf","P-13497V-21.3.19.1.1"]}]},{"cve":"CVE-2026-91382","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39368796"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"products":["P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91383","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39375339"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.6 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91384","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39381614"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91385","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39385973"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27;  Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-13497V-21.3.19.1.1","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-13497V-21.3.19.1.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-13497V-21.3.19.1.1"]}]},{"cve":"CVE-2026-91386","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Orchestrator","text":"39404902"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Orchestrator executes to compromise JD Edwards EnterpriseOne Orchestrator.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Orchestrator accessible data as well as  unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Orchestrator accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-11681V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-11681V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-11681V-9.2.0.0-9.2.26.5"]}]},{"cve":"CVE-2026-91387","ids":[{"system_name":"Oracle Bug ID of Siebel CRM End User","text":"39413441"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM End User accessible data as well as  unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9011V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9011V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-9011V-17.0-26.9"]}]},{"cve":"CVE-2026-91388","ids":[{"system_name":"Oracle Bug ID of Siebel CRM End User","text":"39413454"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM End User, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM End User accessible data as well as  unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 4.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9011V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9011V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":4.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-9011V-17.0-26.9"]}]},{"cve":"CVE-2026-91389","ids":[{"system_name":"Oracle Bug ID of Siebel CRM End User","text":"39413463"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM End User, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM End User accessible data as well as  unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9011V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9011V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-9011V-17.0-26.9"]}]},{"cve":"CVE-2026-91390","ids":[{"system_name":"Oracle Bug ID of Siebel CRM End User","text":"39413476"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel CRM End User, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM End User accessible data as well as  unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9011V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9011V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-9011V-17.0-26.9"]}]},{"cve":"CVE-2026-91391","ids":[{"system_name":"Oracle Bug ID of Siebel CRM End User","text":"39413480"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9011V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9011V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-9011V-17.0-26.9"]}]},{"cve":"CVE-2026-91392","ids":[{"system_name":"Oracle Bug ID of Siebel CRM End User","text":"39413496"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9011V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9011V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-9011V-17.0-26.9"]}]},{"cve":"CVE-2026-91393","ids":[{"system_name":"Oracle Bug ID of Siebel CRM End User","text":"39413498"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 3.1 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9011V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9011V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-9011V-17.0-26.9"]}]},{"acknowledgments":[{"names":["4ra1n, pyn3rd and unam4"]}],"cve":"CVE-2026-91394","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39413577"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK accessible data.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-11.0.32.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-11.0.32.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-11.0.32.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91395","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39413590"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"products":["P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1"]}]},{"cve":"CVE-2026-91396","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39413598"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Utility).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"products":["P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1"]}]},{"cve":"CVE-2026-91397","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39413739"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serviceability).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.6 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":3.6,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91398","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39413787"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SOCKS5 to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  While the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.8 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91399","ids":[{"system_name":"Oracle Bug ID of Primavera P6 Enterprise Project Portfolio Management","text":"39751148"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering (component: Web Access).  Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5579V-25.12.0-25.12.8","P-5579V-21.12.0.0-21.12.21.9","P-5579V-24.12.0-24.12.16","P-5579V-23.12.0-23.12.20","P-5579V-22.12.0.0-22.12.21.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5579V-24.12.0-24.12.16","P-5579V-25.12.0-25.12.8","P-5579V-21.12.0.0-21.12.21.9","P-5579V-23.12.0-23.12.20","P-5579V-22.12.0.0-22.12.21.4"],"url":"https://support.oracle.com/support/?documentId=CPU415"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-5579V-24.12.0-24.12.16","P-5579V-25.12.0-25.12.8","P-5579V-21.12.0.0-21.12.21.9","P-5579V-23.12.0-23.12.20","P-5579V-22.12.0.0-22.12.21.4"]}]},{"acknowledgments":[{"names":["Acol7542"]}],"cve":"CVE-2026-91400","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39421148"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91402","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39437361"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX).  Supported versions that are affected are Oracle Java SE: 8u503; Oracle JavaFX: 21.0.12, 25.0.4 and  27; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Java SE, Oracle JavaFX, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-13497V-21.3.19.1.1","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-13497V-21.3.19.1.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-856(Java SE)V-8u503","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(JavaFX)V-21.0.12","P-13497V-21.3.19.1.1"]}]},{"cve":"CVE-2026-91404","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39448262"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Outside In Technology accessible data. CVSS 3.1 Base Score 4.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":4.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-91405","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39448343"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK).   The supported version that is affected is 8.5.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-91406","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39448348"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK).   The supported version that is affected is 8.5.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-91407","ids":[{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39448442"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1980V-12.2.1.4.0","P-1980V-14.1.2.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1980V-14.1.2.1.0","P-1980V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1980V-14.1.2.1.0","P-1980V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91408","ids":[{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39448619"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1980V-12.2.1.4.0","P-1980V-14.1.2.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1980V-14.1.2.1.0","P-1980V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1980V-14.1.2.1.0","P-1980V-12.2.1.4.0"]}]},{"acknowledgments":[{"names":["Thien Ta Duc"]}],"cve":"CVE-2026-91409","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39449781"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Java SE (component: Networking).   The supported version that is affected is Oracle Java SE: 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-27"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-27"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-856(Java SE)V-27"]}]},{"cve":"CVE-2026-91410","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39454717"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Java SE (component: Libraries).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91411","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39454738"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition as well as  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"products":["P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1"]}]},{"cve":"CVE-2026-91412","ids":[{"system_name":"Oracle Bug ID of Siebel CRM End User","text":"39471012"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9011V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9011V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-9011V-17.0-26.9"]}]},{"cve":"CVE-2026-91413","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Development","text":"39471047"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Integration - Scripting).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network access via CORBA to compromise Siebel CRM Development.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Development as well as  unauthorized update, insert or delete access to some of Siebel CRM Development accessible data and  unauthorized read access to a subset of Siebel CRM Development accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9001V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9001V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"products":["P-9001V-17.0-26.9"]}]},{"cve":"CVE-2026-91414","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39471060"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"acknowledgments":[{"names":["Avicii"]},{"names":["Sergey Bylokhov"],"organization":"AWS Security"},{"names":["Weber Leon"]}],"cve":"CVE-2026-91415","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39473129"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition as well as  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data and  unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":7.0,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91417","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39474724"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA).  Supported versions that are affected are Oracle Java SE: 8u503 and  8u503-perf; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle GraalVM Enterprise Edition.  Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-8u503-perf","P-13497V-21.3.19.1.1","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(Java SE)V-8u503-perf","P-13497V-21.3.19.1.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-856(Java SE)V-8u503","P-856(Java SE)V-8u503-perf","P-13497V-21.3.19.1.1"]}]},{"acknowledgments":[{"names":["Alexey Bakhtin"]}],"cve":"CVE-2026-91418","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39478497"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle JavaFX: 21.0.12, 25.0.4, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Java SE, Oracle JavaFX, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-13497V-17.0.20.1","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1","P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-25.0.4.1","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(Java SE)V-8u503-perf","P-856(JavaFX)V-21.0.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-13497V-17.0.20.1","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1","P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-25.0.4.1","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(Java SE)V-8u503-perf","P-856(JavaFX)V-21.0.12"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-13497V-17.0.20.1","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1","P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-25.0.4.1","P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4","P-856(Java SE)V-8u503-perf","P-856(JavaFX)V-21.0.12"]}]},{"cve":"CVE-2026-91419","ids":[{"system_name":"Oracle Bug ID of Oracle HTTP Server","text":"39479539"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1042(Oracle HTTP Server_OSSL Module)V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1042(Oracle HTTP Server_OSSL Module)V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1042(Oracle HTTP Server_OSSL Module)V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91420","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39494422"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91421","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39494432"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 5.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91422","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39494443"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91423","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39494498"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91424","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39494517"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Deployment as well as  unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data and  unauthorized read access to a subset of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91426","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39494807"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91427","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39494832"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 2.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":2.3,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91428","ids":[{"system_name":"Oracle Bug ID of Siebel CRM End User","text":"39494905"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9011V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9011V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-9011V-17.0-26.9"]}]},{"cve":"CVE-2026-91429","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39494913"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data as well as  unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91430","ids":[{"system_name":"Oracle Bug ID of Siebel Apps - Financial Services","text":"39494961"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Apps - Financial Services product of Oracle Siebel CRM (component: Financial Accounts).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Financial Services.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel Apps - Financial Services accessible data as well as  unauthorized update, insert or delete access to some of Siebel Apps - Financial Services accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9170V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9170V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-9170V-17.0-26.9"]}]},{"cve":"CVE-2026-91431","ids":[{"system_name":"Oracle Bug ID of Siebel CRM End User","text":"39494969"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM End User executes to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9011V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9011V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-9011V-17.0-26.9"]}]},{"cve":"CVE-2026-91432","ids":[{"system_name":"Oracle Bug ID of Siebel CRM End User","text":"39494975"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM End User accessible data as well as  unauthorized read access to a subset of Siebel CRM End User accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9011V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9011V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-9011V-17.0-26.9"]}]},{"cve":"CVE-2026-91433","ids":[{"system_name":"Oracle Bug ID of Siebel Apps - Field Service","text":"39495034"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Apps - Field Service product of Oracle Siebel CRM (component: Smart Answer).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel Apps - Field Service.  Successful attacks of this vulnerability can result in takeover of Siebel Apps - Field Service. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8971V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8971V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-8971V-17.0-26.9"]}]},{"cve":"CVE-2026-91434","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39495064"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91435","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39495072"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91436","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39495118"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data as well as  unauthorized read access to a subset of Siebel CRM Deployment accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Siebel CRM Deployment. CVSS 3.1 Base Score 3.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":3.9,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91437","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39496702"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  While the vulnerability is in Siebel CRM Deployment, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91438","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39496739"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data as well as  unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91439","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39496758"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91440","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39496760"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel CRM Deployment accessible data as well as  unauthorized read access to a subset of Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91441","ids":[{"system_name":"Oracle Bug ID of Siebel Apps - Customer Order Management","text":"39496780"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel Apps - Customer Order Management product of Oracle Siebel CRM (component: Order Management).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps - Customer Order Management.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Apps - Customer Order Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Siebel Apps - Customer Order Management accessible data as well as  unauthorized read access to a subset of Siebel Apps - Customer Order Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Siebel Apps - Customer Order Management. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8967V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8967V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},"products":["P-8967V-17.0-26.9"]}]},{"cve":"CVE-2026-91442","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39496810"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91443","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39496821"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91444","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39496843"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91445","ids":[{"system_name":"Oracle Bug ID of Siebel CRM End User","text":"39496849"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Communications Panel/Dashboard).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM End User accessible data as well as  unauthorized update, insert or delete access to some of Siebel CRM End User accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9011V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9011V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-9011V-17.0-26.9"]}]},{"cve":"CVE-2026-91446","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39496866"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in takeover of Siebel CRM Deployment. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":6.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91447","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39496873"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91448","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39496940"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91449","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39496947"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91450","ids":[{"system_name":"Oracle Bug ID of Siebel CRM Deployment","text":"39496954"}],"notes":[{"category":"description","text":"Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).  Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as  unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9019V-17.0-26.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9019V-17.0-26.9"],"url":"https://support.oracle.com/support/?documentId=CPU419"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-9019V-17.0-26.9"]}]},{"cve":"CVE-2026-91451","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39508041"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data.  Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91452","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39508437"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91453","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39508610"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweight HTTP Server).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91455","ids":[{"system_name":"Oracle Bug ID of JD Edwards EnterpriseOne Tools","text":"39523451"}],"notes":[{"category":"description","text":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX).  Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as  unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4781V-9.2.0.0-9.2.26.5"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4781V-9.2.0.0-9.2.26.5"],"url":"https://support.oracle.com/support/?documentId=CPU417"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-4781V-9.2.0.0-9.2.26.5"]}]},{"acknowledgments":[{"names":["Mat Powell"],"organization":"TrendAI Zero Day Initiative"}],"cve":"CVE-2026-91457","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39549417"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"acknowledgments":[{"names":["Mat Powell"],"organization":"TrendAI Zero Day Initiative"}],"cve":"CVE-2026-91458","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39549423"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"acknowledgments":[{"names":["Mat Powell"],"organization":"TrendAI Zero Day Initiative"}],"cve":"CVE-2026-91459","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39549425"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"acknowledgments":[{"names":["Mat Powell"],"organization":"TrendAI Zero Day Initiative"}],"cve":"CVE-2026-91460","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39549427"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Image Export SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-91461","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39561459"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91462","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39568105"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27;    Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1;   Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 5.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91463","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39569037"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91464","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39574353"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS).  Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-8u503","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91465","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise FIN Common Objects Argentina","text":"39435681"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Integration).   The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise PeopleSoft Enterprise FIN Common Objects Argentina.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Argentina accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8930V-9.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8930V-9.1"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-8930V-9.1"]}]},{"cve":"CVE-2026-91466","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise FIN Common Objects Argentina","text":"39435742"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: Asset Management).   The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Argentina.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Common Objects Argentina accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Argentina accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Common Objects Argentina. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8930V-9.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8930V-9.1"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L","version":"3.1"},"products":["P-8930V-9.1"]}]},{"cve":"CVE-2026-91467","ids":[{"system_name":"Oracle Bug ID of Oracle Fusion Middleware Control","text":"39638518"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion Middleware (component: Framework).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows physical access to compromise Oracle Fusion Middleware Control.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Fusion Middleware Control. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-14309V-12.2.1.4.0","P-14309V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14309V-12.2.1.4.0","P-14309V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-14309V-12.2.1.4.0","P-14309V-14.1.2.0.0"]}]},{"cve":"CVE-2026-91468","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39651626"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: QAS).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-91471","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise CC Common Application Objects","text":"39670671"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: BAM Framework).   The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CC Common Application Objects.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise CC Common Application Objects accessible data. CVSS 3.1 Base Score 3.7 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8911V-9.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8911V-9.2"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-8911V-9.2"]}]},{"cve":"CVE-2026-91473","ids":[{"system_name":"Oracle Bug ID of Oracle HTTP Server","text":"39704265"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1042(Oracle HTTP Server_Web Listener)V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1042(Oracle HTTP Server_Web Listener)V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1042(Oracle HTTP Server_Web Listener)V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91474","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise FIN Common Objects Brazil","text":"39435857"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement).   The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the PeopleSoft Enterprise FIN Common Objects Brazil executes to compromise PeopleSoft Enterprise FIN Common Objects Brazil.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise FIN Common Objects Brazil accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise FIN Common Objects Brazil accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8936V-9.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8936V-9.1"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-8936V-9.1"]}]},{"cve":"CVE-2026-91475","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39725789"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Clean Content SDK).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Outside In Technology accessible data as well as  unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":6.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-91476","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise FIN Common Objects Brazil","text":"39435961"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement).   The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Brazil.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of PeopleSoft Enterprise FIN Common Objects Brazil accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8936V-9.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8936V-9.1"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-8936V-9.1"]}]},{"cve":"CVE-2026-91477","ids":[{"system_name":"Oracle Bug ID of Oracle JavaFX","text":"39732289"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle JavaFX product of Oracle Java SE (component: JavaFX).  Supported versions that are affected are Oracle JavaFX: 25.0.4 and  27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle JavaFX.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle JavaFX accessible data.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-856(JavaFX)V-27","P-856(JavaFX)V-25.0.4"]}]},{"cve":"CVE-2026-91478","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise SCM Strategic Sourcing","text":"39740897"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle PeopleSoft (component: Strategic Sourcing).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Strategic Sourcing.  Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise SCM Strategic Sourcing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5136V-9.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5136V-9.2"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5136V-9.2"]}]},{"acknowledgments":[{"names":["Xiang Chen"]}],"cve":"CVE-2026-91479","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"39761802"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS component of Oracle Database Server.  Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the RDBMS executes to compromise RDBMS.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of RDBMS. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS)V-23.4.0-23.26.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS)V-23.4.0-23.26.3"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-5(RDBMS)V-23.4.0-23.26.3"]}]},{"cve":"CVE-2026-91480","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise SCM Strategic Sourcing","text":"39762682"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle PeopleSoft (component: Strategic Sourcing).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Strategic Sourcing.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Strategic Sourcing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5136V-9.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5136V-9.2"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-5136V-9.2"]}]},{"cve":"CVE-2026-91481","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise SCM Purchasing","text":"39762773"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Supplier Registration).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Purchasing.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise SCM Purchasing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM Purchasing accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise SCM Purchasing accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5133V-9.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5133V-9.2"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-5133V-9.2"]}]},{"cve":"CVE-2026-91482","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise SCM Strategic Sourcing","text":"39768839"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise SCM Strategic Sourcing product of Oracle PeopleSoft (component: Bidder Registration).   The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Strategic Sourcing.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise SCM Strategic Sourcing accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5136V-9.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5136V-9.2"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-5136V-9.2"]}]},{"acknowledgments":[{"names":["Mat Powell"],"organization":"TrendAI Zero Day Initiative"}],"cve":"CVE-2026-91483","ids":[{"system_name":"Oracle Bug ID of Oracle Outside In Technology","text":"39793176"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).   The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2276V-8.5.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2276V-8.5.8"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2276V-8.5.8"]}]},{"cve":"CVE-2026-91484","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39811394"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Java SE (component: Java plugin).  Supported versions that are affected are Oracle Java SE: 8u503 and  8u503-perf. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE executes to compromise Oracle Java SE.  While the vulnerability is in Oracle Java SE, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data as well as  unauthorized access to critical data or complete access to all Oracle Java SE accessible data.  Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-8u503-perf","P-856(Java SE)V-8u503"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-8u503","P-856(Java SE)V-8u503-perf"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-856(Java SE)V-8u503","P-856(Java SE)V-8u503-perf"]}]},{"cve":"CVE-2026-91485","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise FIN Cash Management","text":"39827910"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise FIN Cash Management product of Oracle PeopleSoft (component: Cash Management).   The supported version that is affected is 9.2. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Cash Management executes to compromise PeopleSoft Enterprise FIN Cash Management.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Cash Management accessible data as well as  unauthorized read access to a subset of PeopleSoft Enterprise FIN Cash Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Cash Management. CVSS 3.1 Base Score 3.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4979V-9.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4979V-9.2"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":3.8,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-4979V-9.2"]}]},{"cve":"CVE-2026-91486","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise FIN General Ledger Brazil","text":"39436015"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise FIN General Ledger Brazil product of Oracle PeopleSoft (component: General Ledger).   The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN General Ledger Brazil executes to compromise PeopleSoft Enterprise FIN General Ledger Brazil.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN General Ledger Brazil accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN General Ledger Brazil. CVSS 3.1 Base Score 4.4 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4994V-9.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4994V-9.1"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":4.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"products":["P-4994V-9.1"]}]},{"cve":"CVE-2026-91487","ids":[{"system_name":"Oracle Bug ID of Oracle Java SE","text":"39842641"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Java SE (component: Compiler).  Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and  21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Java SE accessible data as well as  unauthorized read access to a subset of Oracle Java SE accessible data.  Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"],"url":"https://support.oracle.com/support/?documentId=CPU388"}],"scores":[{"cvss_v3":{"baseScore":4.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-856(Java SE)V-21.0.12.1","P-13497V-21.0.12.1","P-856(Java SE)V-27","P-856(Java SE)V-25.0.4.1","P-13497V-17.0.20.1","P-856(Java SE)V-8u503-perf","P-856(Java SE)V-11.0.32.1","P-13497V-21.3.19.1.1","P-856(Java SE)V-17.0.20.1"]}]},{"cve":"CVE-2026-91488","ids":[{"system_name":"Oracle Bug ID of Oracle Identity Manager Connector","text":"39844820"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1999V-12.2.1.4.0","P-1999V-14.1.2.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1999V-14.1.2.1.0","P-1999V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-1999V-14.1.2.1.0","P-1999V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91489","ids":[{"system_name":"Oracle Bug ID of Oracle Identity Manager Connector","text":"39844951"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1999V-12.2.1.4.0","P-1999V-14.1.2.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1999V-14.1.2.1.0","P-1999V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-1999V-14.1.2.1.0","P-1999V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91490","ids":[{"system_name":"Oracle Bug ID of Oracle Identity Manager Connector","text":"39844963"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1999V-12.2.1.4.0","P-1999V-14.1.2.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1999V-14.1.2.1.0","P-1999V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-1999V-14.1.2.1.0","P-1999V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91491","ids":[{"system_name":"Oracle Bug ID of Oracle Identity Manager Connector","text":"39844971"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1999V-12.2.1.4.0","P-1999V-14.1.2.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1999V-14.1.2.1.0","P-1999V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1999V-14.1.2.1.0","P-1999V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91492","ids":[{"system_name":"Oracle Bug ID of Oracle Identity Manager Connector","text":"39844977"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: SAP ERP+).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager Connector.  While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1999V-12.2.1.4.0","P-1999V-14.1.2.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1999V-14.1.2.1.0","P-1999V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-1999V-14.1.2.1.0","P-1999V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91493","ids":[{"system_name":"Oracle Bug ID of Oracle Identity Manager Connector","text":"39844987"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1999V-12.2.1.4.0","P-1999V-14.1.2.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1999V-14.1.2.1.0","P-1999V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-1999V-14.1.2.1.0","P-1999V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91494","ids":[{"system_name":"Oracle Bug ID of Oracle Identity Manager Connector","text":"39844999"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: LDAP Gateway).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Identity Manager Connector.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as  unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1999V-12.2.1.4.0","P-1999V-14.1.2.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1999V-14.1.2.1.0","P-1999V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-1999V-14.1.2.1.0","P-1999V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91495","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Content","text":"39858715"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91496","ids":[{"system_name":"Oracle Bug ID of Workflow","text":"39494644"}],"notes":[{"category":"description","text":"Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Workflow.  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-174V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-174V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-174V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-91497","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39899710"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"acknowledgments":[{"names":["Xiang Chen"]}],"cve":"CVE-2026-91499","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"39905017"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS component of Oracle Database Server.  Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having DBMS_VECTOR privilege with network access via Oracle Net to compromise RDBMS.  Successful attacks of this vulnerability can result in takeover of RDBMS. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS)V-23.4.0-23.26.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS)V-23.4.0-23.26.3"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5(RDBMS)V-23.4.0-23.26.3"]}]},{"cve":"CVE-2026-91501","ids":[{"system_name":"Oracle Bug ID of Oracle Identity Manager","text":"39905374"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Identity Manager executes to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1980V-12.2.1.4.0","P-1980V-14.1.2.1.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1980V-14.1.2.1.0","P-1980V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-1980V-14.1.2.1.0","P-1980V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91502","ids":[{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39912126"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data as well as  unauthorized read access to a subset of Oracle WebLogic Server accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5242V-15.1.1.0.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0","P-5242V-14.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0","P-5242V-14.1.1.0.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-5242V-15.1.1.0.0","P-5242V-14.1.1.0.0","P-5242V-12.2.1.4.0","P-5242V-14.1.2.0.0"]}]},{"cve":"CVE-2026-91503","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"39918439"}],"notes":[{"category":"description","text":"Vulnerability in the VPD component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32, 21.3-21.23 and  23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create Table privilege with network access via Oracle Net to compromise VPD.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all VPD accessible data as well as  unauthorized access to critical data or complete access to all VPD accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(VPD)V-19.3-19.32","P-5(VPD)V-23.4.0-23.26.3","P-5(VPD)V-21.3-21.23"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(VPD)V-19.3-19.32","P-5(VPD)V-23.4.0-23.26.3","P-5(VPD)V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-5(VPD)V-19.3-19.32","P-5(VPD)V-23.4.0-23.26.3","P-5(VPD)V-21.3-21.23"]}]},{"cve":"CVE-2026-91504","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Content","text":"39923954"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Portal Suite).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content.  Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2271V-14.1.2.0.0","P-2271V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91505","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39927592"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Porting).  Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61","P-5085V-8.62"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61","P-5085V-8.62"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-5085V-8.61","P-5085V-8.62"]}]},{"cve":"CVE-2026-91506","ids":[{"system_name":"Oracle Bug ID of Workflow","text":"39494647"}],"notes":[{"category":"description","text":"Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Workflow.  Successful attacks of this vulnerability can result in takeover of Workflow. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-174V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-174V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-174V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-91511","ids":[{"system_name":"Oracle Bug ID of Oracle Purchasing","text":"39496786"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing.  While the vulnerability is in Oracle Purchasing, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Purchasing accessible data as well as  unauthorized update, insert or delete access to some of Oracle Purchasing accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-502V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-502V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"products":["P-502V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-91512","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Product Lifecycle Management for Process","text":"39530656"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4445V-6.2.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4445V-6.2.4"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":7.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4445V-6.2.4"]}]},{"cve":"CVE-2026-91514","ids":[{"system_name":"Oracle Bug ID of Oracle BI Publisher","text":"39540677"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0","P-1479V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0","P-1479V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0","P-1479V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91515","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Product Lifecycle Management for Process","text":"39530676"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4445V-6.2.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4445V-6.2.4"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4445V-6.2.4"]}]},{"cve":"CVE-2026-91517","ids":[{"system_name":"Oracle Bug ID of Oracle Management Pack for Oracle GoldenGate","text":"39549313"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Management Pack for Oracle GoldenGate product of Oracle GoldenGate (component: EM Plugin).  Supported versions that are affected are 13.4.1.0.1-13.5.2.0.6. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Management Pack for Oracle GoldenGate executes to compromise Oracle Management Pack for Oracle GoldenGate.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Management Pack for Oracle GoldenGate. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5759V-13.4.1.0.1-13.5.2.0.6"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5759V-13.4.1.0.1-13.5.2.0.6"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":8.0,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-5759V-13.4.1.0.1-13.5.2.0.6"]}]},{"cve":"CVE-2026-91518","ids":[{"system_name":"Oracle Bug ID of Oracle BI Publisher","text":"39540707"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Publisher Security).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data as well as  unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0","P-1479V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0","P-1479V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0","P-1479V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91519","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39675718"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-91520","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Product Lifecycle Management for Process","text":"39530631"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4445V-6.2.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4445V-6.2.4"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4445V-6.2.4"]}]},{"cve":"CVE-2026-91521","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Product Lifecycle Management for Process","text":"39530645"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4445V-6.2.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4445V-6.2.4"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4445V-6.2.4"]}]},{"cve":"CVE-2026-91523","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39574697"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0","P-2025V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-12.2.1.4.0","P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-2025V-12.2.1.4.0","P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"]}]},{"cve":"CVE-2026-91524","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39574700"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 4.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-2025V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91526","ids":[{"system_name":"Oracle Bug ID of Oracle BI Publisher","text":"39574726"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data as well as  unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 4.7 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0","P-1479V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0","P-1479V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":4.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0","P-1479V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91527","ids":[{"system_name":"Oracle Bug ID of Oracle ZFS Storage Appliance Kit","text":"39697887"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core).   The supported version that is affected is 8.8. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit.  Successful attacks of this vulnerability can result in takeover of Oracle ZFS Storage Appliance Kit. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10026V-8.8"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10026V-8.8"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-10026V-8.8"]}]},{"cve":"CVE-2026-91528","ids":[{"system_name":"Oracle Bug ID of Oracle BI Publisher","text":"39636124"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle BI Publisher.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1479V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1479V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-1479V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91530","ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate","text":"39706140"}],"notes":[{"category":"description","text":"Vulnerability in Oracle GoldenGate (component: Admin Client Executable).  Supported versions that are affected are 23.4-23.26.2.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle GoldenGate.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data. CVSS 3.1 Base Score 4.4 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5757V-23.4-23.26.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5757V-23.4-23.26.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":4.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-5757V-23.4-23.26.2.0.0"]}]},{"cve":"CVE-2026-91532","ids":[{"system_name":"Oracle Bug ID of Oracle Applications Manager","text":"39711578"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-99V-12.2.3-12.2.15"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-99V-12.2.3-12.2.15"],"url":"https://support.oracle.com/support/?documentId=KA923"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-99V-12.2.3-12.2.15"]}]},{"cve":"CVE-2026-91534","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39638336"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Business Intelligence Enterprise Edition as well as  unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data and  unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0","P-2025V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-12.2.1.4.0","P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":8.6,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"products":["P-2025V-12.2.1.4.0","P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"]}]},{"cve":"CVE-2026-91535","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39638345"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0","P-2025V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-12.2.1.4.0","P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2025V-12.2.1.4.0","P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"]}]},{"cve":"CVE-2026-91536","ids":[{"system_name":"Oracle Bug ID of Oracle SOA Suite","text":"39722746"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle SOA Suite.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle SOA Suite accessible data as well as  unauthorized read access to a subset of Oracle SOA Suite accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle SOA Suite. CVSS 3.1 Base Score 5.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":5.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-1162V-14.1.2.0.0","P-1162V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91537","ids":[{"system_name":"Oracle Bug ID of Oracle Solaris","text":"39725531"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility).   The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris.  Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10006V-11.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10006V-11.4"],"url":"https://support.oracle.com/support/?documentId=CPU366"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-10006V-11.4"]}]},{"cve":"CVE-2026-91539","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39638361"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2025V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91541","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise FIN Common Objects Brazil","text":"39871726"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: Common Objects).   The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Common Objects Brazil.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Common Objects Brazil accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Common Objects Brazil. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8936V-9.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8936V-9.1"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"products":["P-8936V-9.1"]}]},{"acknowledgments":[{"names":["Zorta Zenith"]}],"cve":"CVE-2026-91542","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Sites","text":"39892633"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9617V-12.2.1.4.0","P-9617V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9617V-12.2.1.4.0","P-9617V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-9617V-12.2.1.4.0","P-9617V-14.1.2.0.0"]}]},{"cve":"CVE-2026-91545","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39638387"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security).  Supported versions that are affected are 8.2.0.0.0 and  12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-8.2.0.0.0","P-2025V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-12.2.1.4.0","P-2025V-8.2.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2025V-12.2.1.4.0","P-2025V-8.2.0.0.0"]}]},{"cve":"CVE-2026-91546","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39638389"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2025V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91547","ids":[{"system_name":"Oracle Bug ID of Oracle GoldenGate","text":"39892694"}],"notes":[{"category":"description","text":"Vulnerability in Oracle GoldenGate (component: Vendor Access Module).  Supported versions that are affected are 19.1.0.0.0-19.32.0.0,   21.3-21.23 and   23.4-23.26.3.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle GoldenGate accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5757V-23.4-23.26.3.0.0","P-5757V-21.3-21.23","P-5757V-19.1.0.0.0-19.32.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5757V-19.1.0.0.0-19.32.0.0","P-5757V-23.4-23.26.3.0.0","P-5757V-21.3-21.23"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-5757V-19.1.0.0.0-19.32.0.0","P-5757V-23.4-23.26.3.0.0","P-5757V-21.3-21.23"]}]},{"cve":"CVE-2026-91549","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39638406"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).  Supported versions that are affected are 8.2.0.0.0 and  12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-8.2.0.0.0","P-2025V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-12.2.1.4.0","P-2025V-8.2.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2025V-12.2.1.4.0","P-2025V-8.2.0.0.0"]}]},{"cve":"CVE-2026-91550","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Product Lifecycle Management for Process","text":"39530661"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4445V-6.2.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4445V-6.2.4"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4445V-6.2.4"]}]},{"acknowledgments":[{"names":["Zorta Zenith"]}],"cve":"CVE-2026-91552","ids":[{"system_name":"Oracle Bug ID of Oracle WebCenter Sites","text":"39924207"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9617V-12.2.1.4.0","P-9617V-14.1.2.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9617V-12.2.1.4.0","P-9617V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-9617V-12.2.1.4.0","P-9617V-14.1.2.0.0"]}]},{"cve":"CVE-2026-91553","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise FIN Product Configurator Brazil","text":"39931418"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise FIN Product Configurator Brazil product of Oracle PeopleSoft (component: Product Configurator).   The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Product Configurator Brazil executes to compromise PeopleSoft Enterprise FIN Product Configurator Brazil.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Product Configurator Brazil accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Product Configurator Brazil. CVSS 3.1 Base Score 4.4 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8870V-9.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8870V-9.1"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":4.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"products":["P-8870V-9.1"]}]},{"cve":"CVE-2026-91554","ids":[{"system_name":"Oracle Bug ID of Oracle BI Publisher","text":"39638491"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data as well as  unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1479V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1479V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"products":["P-1479V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91555","ids":[{"system_name":"Oracle Bug ID of Oracle BI Publisher","text":"39638493"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data as well as  unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0","P-1479V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0","P-1479V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":6.1,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0","P-1479V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91557","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39638501"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Foundation).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":7.0,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2025V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91559","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise FIN Manufacturing Brazil","text":"39931438"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise FIN Manufacturing Brazil product of Oracle PeopleSoft (component: Integration).   The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Manufacturing Brazil executes to compromise PeopleSoft Enterprise FIN Manufacturing Brazil.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Manufacturing Brazil accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Manufacturing Brazil. CVSS 3.1 Base Score 4.4 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8867V-9.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8867V-9.1"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":4.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"products":["P-8867V-9.1"]}]},{"cve":"CVE-2026-91562","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise FIN Inventory Brazil","text":"39931445"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise FIN Inventory Brazil product of Oracle PeopleSoft (component: Inventory).   The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN Inventory Brazil executes to compromise PeopleSoft Enterprise FIN Inventory Brazil.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of PeopleSoft Enterprise FIN Inventory Brazil accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise FIN Inventory Brazil. CVSS 3.1 Base Score 4.4 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4998V-9.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4998V-9.1"],"url":"https://support.oracle.com/support/?documentId=CPU418"}],"scores":[{"cvss_v3":{"baseScore":4.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"products":["P-4998V-9.1"]}]},{"cve":"CVE-2026-91563","ids":[{"system_name":"Oracle Bug ID of Oracle OLAP","text":"39969362"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle OLAP component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32, 21.3-21.23 and  23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having DBMS_AW privilege with network access via Oracle Net to compromise Oracle OLAP.  Successful attacks of this vulnerability can result in takeover of Oracle OLAP. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1163V-21.3-21.23","P-1163V-19.3-19.32","P-1163V-23.4.0-23.26.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1163V-21.3-21.23","P-1163V-19.3-19.32","P-1163V-23.4.0-23.26.3"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1163V-21.3-21.23","P-1163V-19.3-19.32","P-1163V-23.4.0-23.26.3"]}]},{"cve":"CVE-2026-91565","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Product Lifecycle Management for Process","text":"39530670"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4445V-6.2.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4445V-6.2.4"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":6.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L","version":"3.1"},"products":["P-4445V-6.2.4"]}]},{"cve":"CVE-2026-91568","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"39969665"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS component of Oracle Database Server.  Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows low privileged attacker having Create Session privilege with network access via Oracle Net to compromise RDBMS.  While the vulnerability is in RDBMS, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all RDBMS accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS)V-23.4.0-23.26.3"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS)V-23.4.0-23.26.3"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-5(RDBMS)V-23.4.0-23.26.3"]}]},{"cve":"CVE-2026-91573","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Product Lifecycle Management for Process","text":"39530672"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4445V-6.2.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4445V-6.2.4"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-4445V-6.2.4"]}]},{"cve":"CVE-2026-91574","ids":[{"system_name":"Oracle Bug ID of Oracle BI Publisher","text":"39638624"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Publisher Security).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0","P-1479V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0","P-1479V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0","P-1479V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91576","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39638636"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-2025V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91577","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39638638"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Business Intelligence Enterprise Edition accessible data as well as  unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":6.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-2025V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91579","ids":[{"system_name":"Oracle Bug ID of Oracle BI Publisher","text":"39638649"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0","P-1479V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0","P-1479V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0","P-1479V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91582","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39638673"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search).   The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 3.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-2025V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91584","ids":[{"system_name":"Oracle Bug ID of Oracle BI Publisher","text":"39638688"}],"notes":[{"category":"description","text":"Security-in-Depth issue in the Oracle BI Publisher product of Oracle Analytics (component: Administration). This vulnerability cannot be exploited in the context of this product.","title":"Vulnerability Description"}],"product_status":{"known_not_affected":["P-1479V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1479V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":0.0,"baseSeverity":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N","version":"3.1"},"products":["P-1479V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91588","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39638734"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search).  Supported versions that are affected are 8.2.0.0.0 and  12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 6.5 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-8.2.0.0.0","P-2025V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-12.2.1.4.0","P-2025V-8.2.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"products":["P-2025V-12.2.1.4.0","P-2025V-8.2.0.0.0"]}]},{"cve":"CVE-2026-91590","ids":[{"system_name":"Oracle Bug ID of Oracle BI Publisher","text":"39638862"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle BI Publisher accessible data as well as  unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1479V-8.2.0.0.0","P-1479V-26.01.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"products":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0"]}]},{"cve":"CVE-2026-91597","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39638983"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Business Intelligence Enterprise Edition executes to compromise Oracle Business Intelligence Enterprise Edition.  While the vulnerability is in Oracle Business Intelligence Enterprise Edition, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":8.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"]}]},{"cve":"CVE-2026-91598","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39638987"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Majel Mobile Service).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"]}]},{"cve":"CVE-2026-91600","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39639017"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Visual Analyzer).   The supported version that is affected is 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-26.01.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-2025V-26.01.0.0.0"]}]},{"cve":"CVE-2026-91604","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Product Lifecycle Management for Process","text":"39530679"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in takeover of Oracle Agile Product Lifecycle Management for Process. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4445V-6.2.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4445V-6.2.4"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4445V-6.2.4"]}]},{"cve":"CVE-2026-91607","ids":[{"system_name":"Oracle Bug ID of Oracle Business Intelligence Enterprise Edition","text":"39699749"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).  Supported versions that are affected are 8.2.0.0.0 and  26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Business Intelligence Enterprise Edition accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-2025V-8.2.0.0.0","P-2025V-26.01.0.0.0"]}]},{"cve":"CVE-2026-91608","ids":[{"system_name":"Oracle Bug ID of Oracle BI Publisher","text":"39746732"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).  Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and  26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0","P-1479V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0","P-1479V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU361"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-1479V-26.01.0.0.0","P-1479V-8.2.0.0.0","P-1479V-12.2.1.4.0"]}]},{"acknowledgments":[{"names":["Co-tang X"]},{"names":["Zheng Yu"],"organization":"depthfirst"}],"cve":"CVE-2026-91609","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39767071"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: Graph QL).  Supported versions that are affected are 24.2.0-26.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle REST Data Services accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.2.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.2.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-9456V-24.2.0-26.2.1"]}]},{"acknowledgments":[{"names":["Co-tang X"]}],"cve":"CVE-2026-91610","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39767081"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: General).  Supported versions that are affected are 24.2.0-26.2.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in takeover of Oracle REST Data Services. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.2.2"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.2.2"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-9456V-24.2.0-26.2.2"]}]},{"cve":"CVE-2026-91612","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Inventory Management","text":"39899323"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security).  Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Inventory Management executes to compromise Oracle Communications Unified Inventory Management.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Communications Unified Inventory Management accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4516V-7.7.0","P-4516V-7.8.0","P-4516V-8.0.1","P-4516V-7.5.0","P-4516V-7.5.1","P-4516V-7.6.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4516V-7.7.0","P-4516V-7.8.0","P-4516V-8.0.1","P-4516V-7.5.0","P-4516V-7.5.1","P-4516V-7.6.0"],"url":"https://support.oracle.com/support/?documentId=CPU365"}],"scores":[{"cvss_v3":{"baseScore":3.3,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-4516V-7.7.0","P-4516V-7.8.0","P-4516V-8.0.1","P-4516V-7.5.0","P-4516V-7.5.1","P-4516V-7.6.0"]}]},{"cve":"CVE-2026-91613","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Inventory Management","text":"39899325"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security).  Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Inventory Management executes to compromise Oracle Communications Unified Inventory Management.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Communications Unified Inventory Management accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4516V-7.7.0","P-4516V-7.8.0","P-4516V-8.0.1","P-4516V-7.5.0","P-4516V-7.5.1","P-4516V-7.6.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4516V-7.7.0","P-4516V-7.8.0","P-4516V-8.0.1","P-4516V-7.5.0","P-4516V-7.5.1","P-4516V-7.6.0"],"url":"https://support.oracle.com/support/?documentId=CPU365"}],"scores":[{"cvss_v3":{"baseScore":3.3,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-4516V-7.7.0","P-4516V-7.8.0","P-4516V-8.0.1","P-4516V-7.5.0","P-4516V-7.5.1","P-4516V-7.6.0"]}]},{"cve":"CVE-2026-91614","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Unified Inventory Management","text":"39899383"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security).  Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Inventory Management executes to compromise Oracle Communications Unified Inventory Management.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Communications Unified Inventory Management accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4516V-7.7.0","P-4516V-7.8.0","P-4516V-8.0.1","P-4516V-7.5.0","P-4516V-7.5.1","P-4516V-7.6.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4516V-7.7.0","P-4516V-7.8.0","P-4516V-8.0.1","P-4516V-7.5.0","P-4516V-7.5.1","P-4516V-7.6.0"],"url":"https://support.oracle.com/support/?documentId=CPU365"}],"scores":[{"cvss_v3":{"baseScore":3.3,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-4516V-7.7.0","P-4516V-7.8.0","P-4516V-8.0.1","P-4516V-7.5.0","P-4516V-7.5.1","P-4516V-7.6.0"]}]},{"cve":"CVE-2026-91615","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"39902682"}],"notes":[{"category":"description","text":"Vulnerability in the Java VM component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32, 21.3-21.23 and  23.4.0-23.26.3. Difficult to exploit vulnerability allows low privileged attacker having None privilege with network access via SOCKS5 to compromise Java VM.  While the vulnerability is in Java VM, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Java VM accessible data. CVSS 3.1 Base Score 6.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(Java VM)V-23.4.0-23.26.3","P-5(Java VM)V-21.3-21.23","P-5(Java VM)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(Java VM)V-23.4.0-23.26.3","P-5(Java VM)V-21.3-21.23","P-5(Java VM)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N","version":"3.1"},"products":["P-5(Java VM)V-23.4.0-23.26.3","P-5(Java VM)V-21.3-21.23","P-5(Java VM)V-19.3-19.32"]}]},{"cve":"CVE-2026-91616","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39905489"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Remote Diagnostic Agent).  Supported versions that are affected are 12.2.1.4.0 and  14.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Middleware Common Libraries and Tools accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4647V-12.2.1.4.0","P-4647V-14.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4647V-14.1.1.0.0","P-4647V-12.2.1.4.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-4647V-14.1.1.0.0","P-4647V-12.2.1.4.0"]}]},{"cve":"CVE-2026-91617","ids":[{"system_name":"Oracle Bug ID of Oracle Middleware Common Libraries and Tools","text":"39905506"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Remote Diagnostic Agent).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and  15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Middleware Common Libraries and Tools executes to compromise Oracle Middleware Common Libraries and Tools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Middleware Common Libraries and Tools accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4647V-12.2.1.4.0","P-4647V-14.1.1.0.0","P-4647V-14.1.2.0.0","P-4647V-15.1.1.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4647V-14.1.1.0.0","P-4647V-14.1.2.0.0","P-4647V-12.2.1.4.0","P-4647V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-4647V-14.1.1.0.0","P-4647V-14.1.2.0.0","P-4647V-12.2.1.4.0","P-4647V-15.1.1.0.0"]}]},{"cve":"CVE-2026-91622","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Product Lifecycle Management for Process","text":"39530751"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Agile Product Lifecycle Management for Process, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4445V-6.2.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4445V-6.2.4"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"products":["P-4445V-6.2.4"]}]},{"cve":"CVE-2026-91623","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Product Lifecycle Management for Process","text":"39530788"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4445V-6.2.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4445V-6.2.4"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":7.4,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-4445V-6.2.4"]}]},{"cve":"CVE-2026-91624","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Product Lifecycle Management for Process","text":"39530863"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4445V-6.2.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4445V-6.2.4"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"products":["P-4445V-6.2.4"]}]},{"cve":"CVE-2026-91625","ids":[{"system_name":"Oracle Bug ID of Oracle Agile Product Lifecycle Management for Process","text":"39530881"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management).   The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data as well as  unauthorized update, insert or delete access to some of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4445V-6.2.4"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4445V-6.2.4"],"url":"https://support.oracle.com/support/?documentId=CPU420"}],"scores":[{"cvss_v3":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","version":"3.1"},"products":["P-4445V-6.2.4"]}]},{"cve":"CVE-2026-91627","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39656926"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in takeover of Oracle Communications Billing and Revenue Management. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.1.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.2.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.1.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.2.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"}],"scores":[{"cvss_v3":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.1.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.2.0.0.0"]}]},{"cve":"CVE-2026-91628","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39666114"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: BRM Server).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"}],"scores":[{"cvss_v3":{"baseScore":5.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.2.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_BRM Server)V-15.1.0.0.0"]}]},{"cve":"CVE-2026-91629","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Billing and Revenue Management","text":"39784402"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform).  Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and  15.2.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Billing and Revenue Management executes to compromise Oracle Communications Billing and Revenue Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Billing and Revenue Management accessible data. CVSS 3.1 Base Score 4.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.1.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.2.0.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.1.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.2.0.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU364"}],"scores":[{"cvss_v3":{"baseScore":4.7,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"products":["P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.1.0.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.0.1.0.0","P-2136(Oracle Communications Billing and Revenue Management_Platform)V-15.2.0.0.0"]}]},{"cve":"CVE-2026-91630","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39800513"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":6.8,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91631","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39800519"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91632","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39800537"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91633","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39800591"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":6.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91634","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39800604"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91635","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39800619"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91636","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39800629"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91637","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39800693"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91638","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39800703"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91639","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39800713"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91640","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39800730"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91641","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39800754"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91642","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39800757"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Essbase accessible data as well as  unauthorized read access to a subset of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":7.3,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91643","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801181"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Java Based Agent).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91644","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801186"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":9.3,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91645","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801192"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91646","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801201"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Essbase accessible data as well as  unauthorized read access to a subset of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 5.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.6,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91647","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801207"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91648","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801211"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Java Based Agent).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91649","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801214"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Java Based Agent).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":6.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91650","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801218"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Java Based Agent).   The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":3.7,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91651","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801228"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Essbase Web Platform).   The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":8.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91652","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801233"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 5.0 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":5.0,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91653","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801241"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Essbase Web Platform).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":8.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91654","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801246"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of Oracle Essbase accessible data as well as  unauthorized read access to a subset of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":6.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91655","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801252"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91656","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801258"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Federated Partitions).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":9.1,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91657","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801266"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Essbase accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91658","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801269"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91659","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801277"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Build).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91660","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801282"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Essbase. CVSS 3.1 Base Score 4.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91661","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801286"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91662","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801292"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Java Based Agent).   The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Essbase executes to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as  unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":6.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91663","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801298"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Essbase.  While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":9.9,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91664","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801304"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Essbase. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91665","ids":[{"system_name":"Oracle Bug ID of Oracle Essbase","text":"39801312"}],"notes":[{"category":"description","text":"Vulnerability in Oracle Essbase (component: Security).   The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase.  Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-4379V-21.8.3.0.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-4379V-21.8.3.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-4379V-21.8.3.0.0"]}]},{"cve":"CVE-2026-91668","ids":[{"system_name":"Oracle Bug ID of Oracle Data Integrator","text":"39674781"}],"notes":[{"category":"description","text":"Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Data Integrator.  Successful attacks of this vulnerability can result in takeover of Oracle Data Integrator. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-2196V-14.1.2.0.0","P-2196V-12.2.1.4.0"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-2196V-12.2.1.4.0","P-2196V-14.1.2.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-2196V-12.2.1.4.0","P-2196V-14.1.2.0.0"]}]},{"cve":"CVE-2026-91776","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Unified Data Repository","text":"40121152"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"40112934"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39935172"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform (jackson-databind)).  Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (jackson-databind)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Global Lifecycle Management NextGen OUI Framework. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Unified Data Repository product of Oracle Communications (component: Configuration (jackson-databind)).  Supported versions that are affected are 25.2.200 and 26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Unified Data Repository.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Unified Data Repository.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-12738V-14.1.2.0.0","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-14119V-26.1.200","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9","P-14119V-25.2.200"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14119V-26.1.200","P-14119V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU407"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-12738V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"]}]},{"cve":"CVE-2026-91777","ids":[{"system_name":"Oracle Bug ID of Oracle Communications Cloud Native Core Unified Data Repository","text":"40121152"},{"system_name":"Oracle Bug ID of Oracle Global Lifecycle Management NextGen OUI Framework","text":"40112934"},{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39935172"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform (jackson-databind)).  Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer (jackson-databind)).  Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and  15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Global Lifecycle Management NextGen OUI Framework.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle Communications Cloud Native Core Unified Data Repository product of Oracle Communications (component: Configuration (jackson-databind)).  Supported versions that are affected are 25.2.200 and 26.1.200. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Unified Data Repository.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Communications Cloud Native Core Unified Data Repository.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-15.1.1.0.0","P-10354V-24.12.0-24.12.16","P-14119V-25.2.200","P-10354V-22.12.0-22.12.15","P-12738V-14.1.2.0.0","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-12738V-14.1.2.1.0","P-14119V-26.1.200","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-12738V-14.1.2.0.0","P-12738V-12.2.1.4.0","P-12738V-14.1.1.0.0","P-12738V-14.1.2.1.0","P-12738V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-14119V-26.1.200","P-14119V-25.2.200"],"url":"https://support.oracle.com/support/?documentId=CPU407"}]},{"cve":"CVE-2026-91863","ids":[{"system_name":"Oracle Bug ID of Primavera Unifier","text":"39834530"}],"notes":[{"category":"description","text":"Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform (Apache Neethi)).  Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16, 24.12.0-24.12.16 and  25.12.0-25.12.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera Unifier.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera Unifier.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-10354V-22.12.0-22.12.15","P-10354V-23.12.0-23.12.16","P-10354V-21.12.0-21.12.17","P-10354V-24.12.0-24.12.16","P-10354V-25.12.0-25.12.9"],"url":"https://support.oracle.com/support/?documentId=CPU415"}]},{"cve":"CVE-2026-93492","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40022653"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise RDBMS (Micronaut).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (Micronaut) accessible data as well as  unauthorized read access to a subset of RDBMS (Micronaut) accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-93493","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40022653"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise RDBMS (Micronaut).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (Micronaut) accessible data as well as  unauthorized read access to a subset of RDBMS (Micronaut) accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-93494","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40022653"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise RDBMS (Micronaut).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (Micronaut) accessible data as well as  unauthorized read access to a subset of RDBMS (Micronaut) accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-93560","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40022653"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise RDBMS (Micronaut).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (Micronaut) accessible data as well as  unauthorized read access to a subset of RDBMS (Micronaut) accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-93561","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40022653"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise RDBMS (Micronaut).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (Micronaut) accessible data as well as  unauthorized read access to a subset of RDBMS (Micronaut) accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-93563","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40022653"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise RDBMS (Micronaut).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (Micronaut) accessible data as well as  unauthorized read access to a subset of RDBMS (Micronaut) accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-93564","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40022653"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise RDBMS (Micronaut).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (Micronaut) accessible data as well as  unauthorized read access to a subset of RDBMS (Micronaut) accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-93565","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40022653"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise RDBMS (Micronaut).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (Micronaut) accessible data as well as  unauthorized read access to a subset of RDBMS (Micronaut) accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-93566","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40022653"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise RDBMS (Micronaut).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (Micronaut) accessible data as well as  unauthorized read access to a subset of RDBMS (Micronaut) accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-93567","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40022653"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise RDBMS (Micronaut).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (Micronaut) accessible data as well as  unauthorized read access to a subset of RDBMS (Micronaut) accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-93568","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40022653"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise RDBMS (Micronaut).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (Micronaut) accessible data as well as  unauthorized read access to a subset of RDBMS (Micronaut) accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-93569","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40022653"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise RDBMS (Micronaut).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (Micronaut) accessible data as well as  unauthorized read access to a subset of RDBMS (Micronaut) accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":8.2,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","version":"3.1"},"products":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"]}]},{"cve":"CVE-2026-93572","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40022653"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise RDBMS (Micronaut).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (Micronaut) accessible data as well as  unauthorized read access to a subset of RDBMS (Micronaut) accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-93573","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40022653"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise RDBMS (Micronaut).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (Micronaut) accessible data as well as  unauthorized read access to a subset of RDBMS (Micronaut) accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-93574","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40022653"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise RDBMS (Micronaut).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (Micronaut) accessible data as well as  unauthorized read access to a subset of RDBMS (Micronaut) accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-93575","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40022653"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise RDBMS (Micronaut).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (Micronaut) accessible data as well as  unauthorized read access to a subset of RDBMS (Micronaut) accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-93576","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40022653"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise RDBMS (Micronaut).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (Micronaut) accessible data as well as  unauthorized read access to a subset of RDBMS (Micronaut) accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-93578","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40022653"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise RDBMS (Micronaut).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (Micronaut) accessible data as well as  unauthorized read access to a subset of RDBMS (Micronaut) accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-93579","ids":[{"system_name":"Oracle Bug ID of Oracle Database Server","text":"40022653"}],"notes":[{"category":"description","text":"Vulnerability in the RDBMS (Micronaut) component of Oracle Database Server.  Supported versions that are affected are 19.3-19.32 and  23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise RDBMS (Micronaut).  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all RDBMS (Micronaut) accessible data as well as  unauthorized read access to a subset of RDBMS (Micronaut) accessible data.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5(RDBMS-Micronaut)V-23.4.0-23.26.3","P-5(RDBMS-Micronaut)V-19.3-19.32"],"url":"https://support.oracle.com/support/?documentId=CPU359"}]},{"cve":"CVE-2026-9545","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster.","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup.","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}]},{"cve":"CVE-2026-9547","ids":[{"system_name":"Oracle Bug ID of MySQL Server","text":"40083042"},{"system_name":"Oracle Bug ID of MySQL Enterprise Backup","text":"40114015"}],"notes":[{"category":"description","text":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Compiling (curl)).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the MySQL Enterprise Backup product of Oracle MySQL (component: Enterprise Backup (curl)).  Supported versions that are affected are 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise MySQL Enterprise Backup.  Successful attacks of this vulnerability can result in takeover of MySQL Enterprise Backup. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"],"url":"https://support.oracle.com/support/?documentId=CPU378"}],"scores":[{"cvss_v3":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"products":["P-8478(MySQL Cluster)V-8.4.0-8.4.12","P-4629V-8.4.0-8.4.12","P-4629V-26.7.0","P-8478(MySQL Server)V-9.7.0-9.7.3","P-8478(MySQL Server)V-26.7.0-26.7.1","P-8478(MySQL Cluster)V-9.7.0-9.7.3","P-4629V-8.0.0-8.0.49","P-8478(MySQL Cluster)V-8.0.0-8.0.49","P-4629V-9.7.0-9.7.3","P-8478(MySQL Cluster)V-26.7.0-26.7.1","P-8478(MySQL Server)V-8.4.0-8.4.12"]}]},{"cve":"CVE-2026-9563","ids":[{"system_name":"Oracle Bug ID of PeopleSoft Enterprise PeopleTools","text":"39770706"},{"system_name":"Oracle Bug ID of Oracle WebLogic Server","text":"39961840"}],"notes":[{"category":"description","text":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security (Eclipse Parsson)).  Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"},{"category":"description","text":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars (Eclipse Parsson)).   The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-5242V-15.1.1.0.0","P-5085V-8.61-8.63"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5085V-8.61-8.63"],"url":"https://support.oracle.com/support/?documentId=CPU418"},{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-5242V-15.1.1.0.0"],"url":"https://support.oracle.com/support/?documentId=CPU360"}],"scores":[{"cvss_v3":{"baseScore":7.5,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["P-5242V-15.1.1.0.0","P-5085V-8.61-8.63"]}]},{"cve":"CVE-2026-9753","ids":[{"system_name":"Oracle Bug ID of Oracle REST Data Services","text":"39638090"}],"notes":[{"category":"description","text":"Vulnerability in Oracle REST Data Services (component: General (mongodb)).  Supported versions that are affected are 24.2.0-26.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle REST Data Services accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 8.1 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H).","title":"Vulnerability Description"}],"product_status":{"known_affected":["P-9456V-24.2.0-26.2.1"]},"remediations":[{"category":"vendor_fix","details":"Oracle customers with valid support contracts","product_ids":["P-9456V-24.2.0-26.2.1"],"url":"https://support.oracle.com/support/?documentId=CPU359"}],"scores":[{"cvss_v3":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"products":["P-9456V-24.2.0-26.2.1"]}]}]}