Skip to main content

Configurator CVE-2026-21972

MEDIUM
2026-01-20 secalert_us@oracle.com
Oracle Configurator
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 20, 2026 - 22:16 nvd
MEDIUM 5.3

DescriptionCVE.org

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Configurator accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Configurator contains a vulnerability that allows attackers to unauthorized read access to a subset of Oracle Configurator accessible data (CVSS 5.3).

Technical ContextAI

affects Configurator. Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Configurator accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in Configurator

View all
CVE-2025-61884 HIGH POC
7.5 Oct 12

Unauthenticated path traversal in Oracle Configurator's Runtime UI (part of Oracle E-Business Suite 12.2.3-12.2.14) expo
CVE-2023-43986 CRITICAL
9.8 Oct 19

DM Concept configurator before v4.9.4 was discovered to contain a SQL injection vulnerability via the component Configur
CVE-2016-3438 HIGH
8.2 Apr 21

Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 12.0.6, 12.1, and 1
CVE-2021-2080 HIGH
8.2 Jan 20

Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Rated high severity (CV
CVE-2021-2079 HIGH
8.2 Jan 20

Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Rated high severity (CV
CVE-2021-2078 HIGH
8.2 Jan 20

Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Rated high severity (CV
CVE-2020-14669 HIGH
8.2 Jul 15

Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Rated high severity (CV
CVE-2025-30728 HIGH
7.5 Apr 15

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Core). Rated high severity (CVSS
CVE-2019-2567 HIGH
7.5 Apr 23

Vulnerability in the Oracle Configurator component of Oracle Supply Chain Products Suite (subcomponent: Active Model Gen
CVE-2025-30720 MEDIUM
6.1 Apr 15

Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Orders). Rated medium severity (
CVE-2020-2865 MEDIUM
5.3 Apr 15

Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: Installation). Rated medium severity
CVE-2016-0541 MEDIUM
5.0 Jan 21

Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 11.5.10.2, 12.1, an

Share

CVE-2026-21972 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy