What is the CVSS score of CVE-2026-22011?

CVE-2026-22011 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Oracle E-Business Suite are affected by CVE-2026-22011?

Oracle Applications DBA in E-Business Suite 12.2.3-12.2.15 is vulnerable to privilege escalation by high-privileged attackers with HTTP access, potentially compromising critical database…

How to fix or mitigate CVE-2026-22011?

Within 24 hours: identify and document all Oracle E-Business Suite 12.2.3-12.2.15 instances running ADPatch and immediately restrict HTTP network access to affected components via firewall rules, limiting exposure to authorized administrative networks only. Within 7 days: audit all high-privileged accounts with ADPatch access, implement enhanced logging and alerting on DBA system activities, and establish monitoring for suspicious authentication patterns. Within 30 days: monitor Oracle security advisories for patch availability and develop an upgrade roadmap; if no patch is released within 60 days, document compensating control effectiveness and formally assess risk acceptance with stakeholders.

Oracle E-Business Suite CVE-2026-22011

EUVD-2026-24320 HIGH

Improper Access Control (CWE-284)

2026-04-21 oracle

Authentication Bypass Oracle Oracle Applications Dba Oracle Corporation

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

7.6 HIGH

HTTP-reachable so AV:N, but exploitation needs pre-existing high privileges (PR:H), a second human actor (UI:R) and is difficult (AC:H), with cross-component total impact (S:C, C/I/A:H).

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 06:34 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24320

CVE Published

Apr 21, 2026 - 20:35 nvd

HIGH 7.6

DescriptionCVE.org

Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: ADPatch). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications DBA. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications DBA, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Applications DBA. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege-based compromise of the Oracle Applications DBA product (ADPatch component) within Oracle E-Business Suite 12.2.3 through 12.2.15 allows an already high-privileged attacker with HTTP network access to fully take over the Applications DBA and, via a scope change, significantly impact additional products. Exploitation is rated difficult and requires human interaction from a victim other than the attacker. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%, 10th percentile), and it is not in CISA KEV, indicating low real-world exploitation pressure despite the high CVSS score.

Technical ContextAI

The affected component is ADPatch, the patching utility of the Oracle Applications DBA (AD) toolset used to apply and manage code-level changes across the Oracle E-Business Suite 12.2 (Applications Technology) stack. The CPE cpe:2.3:a:oracle_corporation:oracle_applications_dba covers the affected surface. The root cause is classified as CWE-284 (Improper Access Control), meaning the utility does not correctly enforce authorization boundaries on privileged operations. Because ADPatch operates against shared middle-tier and database code, a successful abuse can cross trust boundaries (CVSS scope change, S:C), letting the impact extend beyond the DBA component itself into other E-Business Suite products.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle Critical Patch Update of April 2026 (https://www.oracle.com/security-alerts/cpuapr2026.html) to all Oracle E-Business Suite 12.2.3-12.2.15 environments; Oracle does not publish a standalone semantic fix version, so the CPU patch bundle is the released remediation and an exact patched version is not independently confirmed here. Until the CPU is applied, reduce exposure by restricting HTTP/network access to the E-Business Suite middle tier and ADPatch administrative interfaces to trusted admin networks only, tightly limiting the set of high-privileged AD/apps accounts (since exploitation requires PR:H), and enforcing separation-of-duties and change-control review on ADPatch operations to blunt the required social-engineering/user-interaction step (trade-off: added operational friction on patching workflows). Because a second user's interaction is required, admin security awareness on suspicious patch/apply requests is a meaningful compensating control.