Applications Dba
Monthly
Full takeover of Oracle Applications DBA within Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible via an unauthenticated, network-based HTTP attack targeting the JRI and associated Java utility components. Exploitation is rated difficult (CVSS AC:H) and requires human interaction from a legitimate user, but successful compromise yields complete loss of confidentiality, integrity, and availability of the affected component. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Oracle's August 2026 Critical Patch Update addresses this issue.
Oracle Applications DBA, the administrative component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, exposes critical internal operations over HTTP to low-privileged attackers. Successful exploitation enables unauthorized access to critical or complete data accessible by the Applications DBA component, along with the ability to trigger partial denial-of-service conditions against the same component. No public exploit has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog, though the low complexity and broad network accessibility make it a meaningful risk in unpatched EBS deployments.
Privilege escalation to full component takeover in Oracle E-Business Suite (Oracle Applications DBA, ADPatch component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the Oracle Applications DBA subsystem, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). Disclosed in Oracle's July 2026 Critical Patch Update, this is easily exploitable per Oracle's own rating. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a strong patching priority.
Full compromise of the Oracle Applications DBA component (Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible for an authenticated, high-privileged attacker with HTTP network access, resulting in complete takeover with high confidentiality, integrity, and availability impact. Rated CVSS 3.1 7.2 (High) by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Local privilege abuse in Oracle Applications DBA (E-Business Suite component: Internal Operations) allows a low-privileged authenticated user with local system access to achieve full confidentiality compromise of DBA-accessible data, with scope change enabling impact on additional Oracle products beyond the directly targeted component. Affected versions span 12.2.3 through 12.2.15, covering a broad range of the E-Business Suite 12.2 release train. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle's own advisory classifies the vulnerability as 'easily exploitable,' lowering the bar for threat actors with local infrastructure access.
Oracle Applications DBA versions 12.2.3-12.2.15 contain an authorization flaw in the Java utilities component that allows high-privileged attackers to gain unauthorized read and write access to sensitive data via HTTP. An authenticated attacker with administrative credentials can exploit this vulnerability to create, modify, or delete critical application data without restriction. A patch is available and should be prioritized for deployment in affected Oracle E-Business Suite environments.
Vulnerability in the Oracle Applications DBA component of Oracle Database Server. Rated low severity (CVSS 3.9), this vulnerability is low attack complexity.
Vulnerability in the Oracle Applications DBA component of Oracle Database Server. Rated low severity (CVSS 3.9), this vulnerability is low attack complexity.
Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: ADPatch). Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity.
Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: AD Utilities). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: AD Utilities). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: Patching). Rated medium severity (CVSS 6.0), this vulnerability is low attack complexity.
Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.1.3 and 12.2.3 through 12.2.6 allows remote administrators to affect confidentiality and integrity via. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.2.3 through 12.2.6 allows remote administrators to affect confidentiality and integrity via vectors. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.1.3 and 12.2.3 through 12.2.6 allows remote administrators to affect confidentiality and integrity via. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.1.3 allows local users to affect confidentiality via vectors related to AD Utilities. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Full takeover of Oracle Applications DBA within Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible via an unauthenticated, network-based HTTP attack targeting the JRI and associated Java utility components. Exploitation is rated difficult (CVSS AC:H) and requires human interaction from a legitimate user, but successful compromise yields complete loss of confidentiality, integrity, and availability of the affected component. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Oracle's August 2026 Critical Patch Update addresses this issue.
Oracle Applications DBA, the administrative component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, exposes critical internal operations over HTTP to low-privileged attackers. Successful exploitation enables unauthorized access to critical or complete data accessible by the Applications DBA component, along with the ability to trigger partial denial-of-service conditions against the same component. No public exploit has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog, though the low complexity and broad network accessibility make it a meaningful risk in unpatched EBS deployments.
Privilege escalation to full component takeover in Oracle E-Business Suite (Oracle Applications DBA, ADPatch component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to fully compromise the Oracle Applications DBA subsystem, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 8.8). Disclosed in Oracle's July 2026 Critical Patch Update, this is easily exploitable per Oracle's own rating. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a strong patching priority.
Full compromise of the Oracle Applications DBA component (Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible for an authenticated, high-privileged attacker with HTTP network access, resulting in complete takeover with high confidentiality, integrity, and availability impact. Rated CVSS 3.1 7.2 (High) by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Local privilege abuse in Oracle Applications DBA (E-Business Suite component: Internal Operations) allows a low-privileged authenticated user with local system access to achieve full confidentiality compromise of DBA-accessible data, with scope change enabling impact on additional Oracle products beyond the directly targeted component. Affected versions span 12.2.3 through 12.2.15, covering a broad range of the E-Business Suite 12.2 release train. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle's own advisory classifies the vulnerability as 'easily exploitable,' lowering the bar for threat actors with local infrastructure access.
Oracle Applications DBA versions 12.2.3-12.2.15 contain an authorization flaw in the Java utilities component that allows high-privileged attackers to gain unauthorized read and write access to sensitive data via HTTP. An authenticated attacker with administrative credentials can exploit this vulnerability to create, modify, or delete critical application data without restriction. A patch is available and should be prioritized for deployment in affected Oracle E-Business Suite environments.
Vulnerability in the Oracle Applications DBA component of Oracle Database Server. Rated low severity (CVSS 3.9), this vulnerability is low attack complexity.
Vulnerability in the Oracle Applications DBA component of Oracle Database Server. Rated low severity (CVSS 3.9), this vulnerability is low attack complexity.
Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: ADPatch). Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity.
Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: AD Utilities). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: AD Utilities). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Vulnerability in the Oracle Applications DBA component of Oracle E-Business Suite (subcomponent: Patching). Rated medium severity (CVSS 6.0), this vulnerability is low attack complexity.
Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.1.3 and 12.2.3 through 12.2.6 allows remote administrators to affect confidentiality and integrity via. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.2.3 through 12.2.6 allows remote administrators to affect confidentiality and integrity via vectors. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.1.3 and 12.2.3 through 12.2.6 allows remote administrators to affect confidentiality and integrity via. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.1.3 allows local users to affect confidentiality via vectors related to AD Utilities. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.