🚨 Oracle Service Bus Flaw Enables Full Takeover by Low-Privilege Attackers
Teams running affected Oracle Service Bus versions should prioritize patching immediately, especially where HTTP endpoints are externally accessible. The low attack complexity and potential for full takeover make this a serious risk even when attackers need limited credentials.
CVE-2026-87419 is a HIGH-severity vulnerability (CVSS 8.8) affecting Oracle Service Bus in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0. An attacker with low privileges and HTTP network access can easily exploit the flaw without user interaction. Successful exploitation can lead to complete takeover of Oracle Service Bus, compromising confidentiality, integrity, and availability.
🔗 Read more 🔗
Source: NVD
🔓 Oracle Solaris Vulnerability Exposes Critical Data Without Authentication
Oracle Solaris 11.4 administrators should apply the relevant security updates urgently. Prioritize systems with reachable HTTP services, as attackers do not need credentials to exploit this information-disclosure vulnerability.
CVE-2026-87417 is a HIGH-severity vulnerability (CVSS 7.5) affecting the Image Packaging System component of Oracle Solaris 11.4. An unauthenticated attacker with HTTP network access can exploit the flaw without user interaction. Successful attacks may expose critical information or all data accessible to Oracle Solaris, with a high confidentiality impact.
🔗 Read more 🔗
Source: NVD
⚠️ Oracle E-Business Suite Flaw Threatens Sensitive Data Across Products
Oracle E-Business Suite administrators should prioritize patching affected Applications Framework installations. The combination of sensitive data exposure, unauthorized modification, and potential cross-product impact makes this particularly concerning in enterprise environments.
CVE-2026-87408 is a HIGH-severity vulnerability (CVSS 8.7) affecting the Personalization component of Oracle Applications Framework in Oracle E-Business Suite versions 12.2.3-12.2.15. A low-privileged attacker with HTTP network access can exploit it if another person interacts with the attack. Successful exploitation can enable unauthorized access to, modification of, or deletion of critical data, potentially affecting additional products beyond the vulnerable framework.
🔗 Read more 🔗
Source: NVD
🔐 Oracle Applications DBA Flaw Lets Low-Privilege Users Tamper With Critical Data
Organizations using affected Oracle E-Business Suite versions should patch their Applications DBA components promptly. Since exploitation requires infrastructure logon access, review local account permissions and restrict unnecessary access while deploying updates.
CVE-2026-87403 is a HIGH-severity vulnerability (CVSS 7.1) affecting the AD Utilities component of Applications DBA in Oracle E-Business Suite versions 12.2.3-12.2.15. An attacker with low privileges and logon access to the infrastructure running Applications DBA can exploit the flaw without additional user interaction. Successful exploitation enables unauthorized access to sensitive data and the creation, deletion, or modification of critical information.
🔗 Read more 🔗
Source: NVD
🚨 Oracle Applications DBA Vulnerability Opens Path to Complete Takeover
Oracle E-Business Suite administrators should treat this as a high-priority patch, particularly on systems with multiple users or shared administrative infrastructure. Restrict local logon permissions and review access controls until the vulnerability is remediated.
CVE-2026-87402 is a HIGH-severity vulnerability (CVSS 7.3) affecting the AD Utilities component of Oracle E-Business Suite Applications DBA versions 12.2.3-12.2.15. A low-privileged attacker with logon access to the infrastructure can exploit the flaw when another person performs a required interaction. Successful exploitation can result in complete takeover of Applications DBA, with high confidentiality, integrity, and availability impacts.
🔗 Read more 🔗
Source: NVD
💥 Oracle Outside In Flaw Allows Unauthenticated Denial-of-Service Attacks
Teams relying on Oracle Outside In Technology should patch version 8.5.8 urgently, especially when the service is reachable over HTTP. The lack of authentication requirements makes service disruption a significant operational risk.
CVE-2026-87398 is a HIGH-severity vulnerability (CVSS 7.5) affecting Oracle Outside In Technology 8.5.8 in Oracle Fusion Middleware. An unauthenticated remote attacker with HTTP network access can easily exploit the vulnerability without user interaction. Successful exploitation can cause the affected service to hang or repeatedly crash, resulting in a complete denial of service.
🔗 Read more 🔗
Source: NVD
🚨 Oracle Outside In Critical Takeover Risk Requires User Interaction
Administrators should prioritize updating affected Oracle Outside In deployments immediately. Although user interaction is required, the absence of an authentication requirement and the possibility of complete takeover make this one of the more serious vulnerabilities in this batch.
CVE-2026-87397 is a HIGH-severity vulnerability (CVSS 8.8) affecting Oracle Outside In Technology 8.5.8 in Oracle Fusion Middleware. An unauthenticated attacker with HTTP network access can exploit the flaw, although successful exploitation requires interaction from another person. The vulnerability can lead to complete takeover of Oracle Outside In Technology, compromising confidentiality, integrity, and availability.
🔗 Read more 🔗
Source: NVD
🛑 Oracle Outside In Vulnerability Enables Remote Service Crashes
Organizations using Oracle Outside In Technology 8.5.8 should apply security updates as soon as possible. Internet-facing or business-critical deployments deserve particular attention because exploitation requires no credentials and can disrupt availability.
CVE-2026-87395 is a HIGH-severity vulnerability (CVSS 7.5) affecting the Outside In Core component of Oracle Outside In Technology 8.5.8. An unauthenticated attacker with HTTP network access can easily exploit the flaw without user interaction. Successful exploitation can trigger persistent hangs or repeated crashes, causing a complete denial of service.
🔗 Read more 🔗
Source: NVD
🔓 Oracle Outside In Flaw Combines Sensitive Data Exposure With Service Disruption
Security teams should prioritize patching affected Oracle Outside In installations, especially those processing sensitive information. Because exploitation requires no authentication and can expose data while degrading service, restricting network access is a sensible interim precaution.
CVE-2026-87394 is a HIGH-severity vulnerability (CVSS 8.2) affecting Oracle Outside In Technology 8.5.8 in Oracle Fusion Middleware. An unauthenticated attacker with HTTP network access can easily exploit the flaw without user interaction. Successful attacks can expose critical or all accessible data and cause a partial denial of service, affecting both confidentiality and availability.
🔗 Read more 🔗
Source: NVD
🖨️ Oracle E-Business Suite Printing Engine Flaw Could Enable Full Takeover
Oracle E-Business Suite administrators should schedule this patch promptly, particularly where Pasta printing services are accessible across networks. The higher exploitation complexity reduces immediate exposure compared with easier flaws, but the potential for complete takeover still warrants serious attention.
CVE-2026-87404 is a HIGH-severity vulnerability (CVSS 7.5) affecting the Pasta Printing Engine component of Oracle E-Business Suite versions 12.2.3-12.2.15. A low-privileged attacker with HTTP network access can exploit the vulnerability without user interaction, although exploitation is considered difficult. Successful attacks can result in complete takeover of Pasta, compromising confidentiality, integrity, and availability.
🔗 Read more 🔗
Source: NVD
💥 Oracle Service Bus Exposed to Unauthenticated Remote Denial-of-Service Attacks
Organizations running affected Oracle Service Bus versions should prioritize patching, especially where middleware services support critical business integrations. Since attackers need no credentials, HTTP exposure increases the risk of straightforward service disruption.
CVE-2026-87369 is a HIGH-severity vulnerability (CVSS 7.5) affecting the Core component of Oracle Service Bus in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with HTTP network access can easily exploit the vulnerability without user interaction. Successful exploitation can cause the service to hang or crash repeatedly, resulting in a complete denial of service.
🔗 Read more 🔗
Source: NVD
🚨 Oracle Service Bus Vulnerability Allows Low-Privilege Attackers Full Control
Oracle Service Bus administrators should treat this as an urgent patching priority, particularly for externally reachable deployments. Limited credentials are sufficient for exploitation, so review service account permissions and restrict unnecessary HTTP access while rolling out fixes.
CVE-2026-87364 is a HIGH-severity vulnerability (CVSS 8.8) affecting Oracle Service Bus in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with HTTP network access can easily exploit the vulnerability without user interaction. Successful exploitation may lead to complete takeover of Oracle Service Bus, with high impacts on confidentiality, integrity, and availability.
🔗 Read more 🔗
Source: NVD