Applications Framework

CVE-2026-62546 Jul 21, 22:19 CRITICAL Act Now

Full takeover of the Oracle Applications Framework (Web Utilities component) is possible in Oracle E-Business Suite 12.2.8 through 12.2.15, where a high-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability. Oracle rates it CVSS 9.1 largely because the scope-changed impact extends beyond the framework to additional bundled EBS products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but it was fixed in Oracle's July 2026 Critical Patch Update.

CVE-2026-62534 Jul 21, 22:19 HIGH This Week

Privilege-abusing account takeover in Oracle Applications Framework (Web Utilities component) of Oracle E-Business Suite 12.2.11 through 12.2.15 lets a low-privileged, network-authenticated attacker fully compromise the framework over HTTP, gaining full confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis and the CVE is not on CISA KEV; it was disclosed through the Oracle July 2026 Critical Patch Update.

CVE-2026-60774 Jul 21, 22:18 HIGH This Week

Unauthorized data access in Oracle Applications Framework (the OAF layer of Oracle E-Business Suite) lets a low-privileged, network-based attacker abuse the Search Bean [Incl. Advanced] component to read all OAF-accessible data and perform limited unauthorized updates, inserts, or deletes. Affected releases span EBS 12.2.3 through 12.2.15, and the flaw is rated CVSS 3.1 7.1 with high confidentiality and low integrity impact. No public exploit has been identified at time of analysis, and it is addressed in Oracle's July 2026 Critical Patch Update.

CVE-2026-60768 Jul 21, 22:18 HIGH This Week

Data compromise in Oracle Applications Framework (12.2.3 through 12.2.15), a core component of Oracle E-Business Suite, allows a low-privileged authenticated attacker with HTTP network access to read, create, modify, or delete all data accessible to the framework via the Graph/Charting component. The Oracle-assigned CVSS 3.1 base score is 8.1 (C:H/I:H) with no availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor-supplied 'Authentication Bypass' tag suggests low authentication barriers relative to the damage achievable.

CVE-2026-60684 Jul 21, 22:18 MEDIUM This Month

Unauthorized data manipulation in Oracle Applications Framework (Oracle E-Business Suite) versions 12.2.8 through 12.2.15 exposes the Upload Attachments component to low-privileged network attackers who can read and modify a subset of accessible application data. Exploitation requires human interaction from a third party, consistent with a cross-site request forgery or social-engineering-assisted vector. No public exploit code or CISA KEV listing has been identified at time of analysis; CVSS 3.1 base score of 4.6 (Medium) reflects limited impact scope with no availability impact.

CVE-2026-60676 Jul 21, 22:18 HIGH This Week

Account takeover in Oracle Applications Framework (Search Bean component) affects Oracle E-Business Suite versions 12.2.3 through 12.2.15, allowing a low-privileged, authenticated attacker with HTTP network access to fully compromise the Applications Framework. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as easily exploitable and results in complete takeover of the component. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, though its inclusion in Oracle's July 2026 Critical Patch Update signals vendor-confirmed severity.

CVE-2026-60675 Jul 21, 22:18 HIGH This Week

Account or application takeover of Oracle Applications Framework - the presentation-layer component of Oracle E-Business Suite - is possible when a low-privileged, authenticated attacker reaches the vulnerable Search Bean over HTTP. Affected releases span 12.2.3 through 12.2.15, and a successful attack yields full confidentiality, integrity, and availability compromise of the framework (CVSS 3.1 8.8). This was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

CVE-2025-30718 Apr 15, 21:16 MEDIUM This Month

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments, File Upload). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2025-30711 Apr 15, 21:16 MEDIUM PATCH This Month

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments, File Upload). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2024-21080 Apr 16, 22:15 MEDIUM This Month

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: REST Services). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2023-22042 Jul 18, 21:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Diagnostics). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2022-21636 Oct 18, 21:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Session Management). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.

CVE-2022-21477 Apr 19, 21:15 MEDIUM This Month

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments, File Upload). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2022-21468 Apr 19, 21:15 MEDIUM This Month

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Popups). Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-2477 Oct 20, 11:16 MEDIUM This Month

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Session Management). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2021-2380 Jul 21, 15:15 HIGH This Week

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments / File Upload). Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2021-2200 Apr 22, 22:15 CRITICAL PATCH Act Now

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Home page). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2020-14746 Oct 21, 15:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Popup windows). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2020-14610 Jul 15, 18:15 HIGH PATCH This Week

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments / File Upload). Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2020-14590 Jul 15, 18:15 LOW PATCH Monitor

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Page Request). Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity.

CVE-2020-14534 Jul 15, 18:15 HIGH This Week

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Popups). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-2890 Apr 15, 14:15 HIGH This Week

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Diagnostics). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-2866 Apr 15, 14:15 MEDIUM This Month

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments / File Upload). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-2666 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments / File Upload). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2020-2566 Jan 15, 17:15 MEDIUM PATCH This Month

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Attachments / File Upload). Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2019-2682 Apr 23, 19:32 HIGH PATCH This Week

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Attachments / File Upload). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2018-3243 Oct 17, 01:31 HIGH PATCH This Week

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: None). Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2018-2971 Oct 17, 01:31 MEDIUM PATCH This Month

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: REST Services). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

CVE-2017-3528 Apr 24, 19:59 MEDIUM POC PATCH THREAT This Month

Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (lists of values, datepicker, etc.)). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 43.2%.

CVE-2016-3447 Apr 21, 11:00 MEDIUM This Month

Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.