Vulnerabilidades de Oracle
CVEs publicadas que afetam produtos de Oracle: 4614 registro(s), com severidade, exploração e correções.
Mysql Server 192Peoplesoft Enterprise Peopletools 173Hyperion Financial Management 163Jd Edwards Enterpriseone Tools 144Helidon 138E-business Suite 133Mysql Cluster 130Webcenter Content 128WebCenter Portal 128Coherence 118Weblogic Server 112Vm Virtualbox 108Commerce Guided Search 106Oracle Commerce Guided Search / Oracle Commerce Experience Manager 105Jre 92Java Se 92Jdk 87Hyperion Infrastructure Technology 77Siebel Crm 75Commerce Experience Manager 75Enterprise Manager Base Platform 74Siebel CRM Deployment 73Agile Product Lifecycle Management 68Business Intelligence Enterprise Edition 66Retail Xstore Point Of Service 62Siebel CRM Cloud Applications 61Communications Cloud Native Core Policy 59Oracle GraalVM Enterprise Edition 59Webcenter Sites 58Graalvm For Jdk 58Solaris 57Hyperion Data Relationship Management 56Communications Unified Inventory Management 56Database Server 51Essbase 50Zfs Storage Appliance Kit 49Access Manager 47Outside In Technology 46Identity Manager Connector 45Rest Data Services 45
CVE-2026-35273
Crítica · 9.8
KEV Urgente · 93 Exploit público Ransomware CWE-306 11/06/2026
Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-8863
Alta · 7.8
09/06/2026
CVE-2026-8863
Multiple Microsoft-sigend UEFI SHIM bootloaders are vulnerable to SecureBoot bypass. An attacker with administrative privileges or the ability to modify the boot process could use one of the vulnerable shim bootloaders to bypass Secure Boot protections and execute arbitrary code before the operating system loads. Specific UEFI DBX update is required to block these vulnerable boot loaders.
CVE-2026-46843
Média · 5.3
CWE-400 28/05/2026
Uncontrolled Resource Consumption em Oracle Rest Data Services
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVE-2026-46842
Média · 5.3
CWE-284 28/05/2026
Improper Access Control em Oracle Rest Data Services
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVE-2026-46841
Média · 5.3
CWE-200 28/05/2026
Exposure of Sensitive Information em Oracle Rest Data Services
Vulnerability in Oracle REST Data Services (component: General). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVE-2026-46840
Crítica · 10.0
CWE-284 28/05/2026
Oracle REST Data Services Controle de Acesso Inadequado (CVE-2026-46840)
Vulnerabilidade no Oracle REST Data Services (componente: Backend-as-a-Service). As versões suportadas afetadas são 24.2.0-26.1.0. Uma vulnerabilidade facilmente explorável permite que um atacante não autenticado com acesso à rede via HTTPS comprometa o Oracle REST Data Services. Embora a vulnerabilidade esteja no Oracle REST Data Services, ataques podem impactar significativamente produtos adicionais (mudança de escopo). Ataques bem-sucedidos contra essa vulnerabilidade podem resultar na tomada de controle do Oracle REST Data Services. Pontuação base CVSS 3.1 de 10.0 (impactos de confidencialidade, integridade e disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-46839
Crítica · 9.9
CWE-284 28/05/2026
Controle de acesso inadequado no Oracle REST Data Services
Vulnerabilidade no Oracle REST Data Services (componente: Core). As versões suportadas afetadas são 24.2.0-26.1.0. Vulnerabilidade facilmente explorável permite que um atacante com baixo privilégio e acesso à rede via HTTPS comprometa o Oracle REST Data Services. Embora a vulnerabilidade esteja no Oracle REST Data Services, ataques podem impactar significativamente produtos adicionais (mudança de escopo). Ataques bem-sucedidos podem resultar na tomada do Oracle REST Data Services. Pontuação base CVSS 3.1 de 9.9 (impactos de confidencialidade, integridade e disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-46837
Alta · 8.8
CWE-269 28/05/2026
Improper Privilege Management em Oracle E-business Suite
Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Security). Supported versions that are affected are 12.2.9-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Flow Manufacturing. Successful attacks of this vulnerability can result in takeover of Oracle Flow Manufacturing. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-46835
Alta · 7.5
CWE-400 28/05/2026
Uncontrolled Resource Consumption em Oracle Database Server
Vulnerability in the Net Service component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Net Service. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Net Service. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-46834
Alta · 7.5
CWE-400 28/05/2026
Uncontrolled Resource Consumption em Oracle Database Server
Vulnerability in the Net Service component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise Net Service. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Net Service. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-46833
Crítica · 9.0
28/05/2026
Vulnerabilidade no Net Service do Oracle Database Server (CVE-2026-46833)
Vulnerabilidade no componente Net Service do Oracle Database Server. As versões suportadas afetadas são 23.4.0-23.26.2. Vulnerabilidade difícil de explorar permite que um atacante não autenticado com acesso à rede via TLS comprometa o Net Service. Embora a vulnerabilidade esteja no Net Service, ataques podem impactar significativamente produtos adicionais (mudança de escopo). Ataques bem-sucedidos podem resultar na tomada do Net Service. Pontuação Base CVSS 3.1 de 9.0 (impactos de Confidencialidade, Integridade e Disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-46830
Média · 5.3
CWE-200 28/05/2026
Exposure of Sensitive Information em Oracle Rest Data Services
Vulnerability in Oracle REST Data Services (component: Mongoapi). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVE-2026-46829
Alta · 7.5
CWE-400 28/05/2026
Uncontrolled Resource Consumption em Oracle Rest Data Services
Vulnerability in Oracle REST Data Services (component: Mongoapi). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-46828
Alta · 8.1
CWE-284 28/05/2026
Improper Access Control em Oracle E-business Suite
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Payroll accessible data as well as unauthorized access to critical data or complete access to all Oracle Payroll accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVE-2026-46827
Alta · 8.8
CWE-269 28/05/2026
Improper Privilege Management em Oracle E-business Suite
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Self Service Manager). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-46826
Alta · 8.8
CWE-306 28/05/2026
Missing Authentication for Critical Function em Oracle E-business Suite
Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Payroll. Successful attacks of this vulnerability can result in takeover of Oracle Payroll. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-46824
Crítica · 9.9
CWE-269 28/05/2026
Falha de Gerenciamento Inadequado de Privilégios no Oracle Universal Work Queue (CVE-2026-46824)
Vulnerabilidade no produto Oracle Universal Work Queue do Oracle E-Business Suite (componente: Work Provider Site Level Administration). As versões suportadas afetadas são 12.2.3-12.2.15. Vulnerabilidade facilmente explorável permite que um atacante com baixo nível de privilégio e acesso à rede via HTTP comprometa o Oracle Universal Work Queue. Embora a vulnerabilidade esteja no Oracle Universal Work Queue, ataques podem impactar significativamente produtos adicionais (mudança de escopo). Ataques bem-sucedidos podem resultar na tomada do Oracle Universal Work Queue. CVSS 3.1 Base Score 9.9 (impactos de Confidencialidade, Integridade e Disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-46823
Alta · 7.7
CWE-863 28/05/2026
Incorrect Authorization em Oracle Public Sector Financials
Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). Supported versions that are affected are 12.2.6-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Public Sector Financials (International). While the vulnerability is in Oracle Public Sector Financials (International), attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Public Sector Financials (International) accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
CVE-2026-46822
Crítica · 9.9
CWE-284 28/05/2026
Oracle iAssets (E-Business Suite): Controle de Acesso Inadequado
Vulnerabilidade no Oracle iAssets do Oracle E-Business Suite (componente: Internal Operations). As versões suportadas afetadas são 12.2.3-12.2.15. Vulnerabilidade de fácil exploração que permite a um atacante com baixo privilégio e acesso à rede via HTTP comprometer o Oracle iAssets. Embora a vulnerabilidade esteja no Oracle iAssets, ataques podem impactar significativamente outros produtos (mudança de escopo). Ataques bem-sucedidos podem resultar na tomada de controle do Oracle iAssets. CVSS 3.1 Base Score 9.9 (impactos de Confidencialidade, Integridade e Disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-46821
Alta · 7.7
CWE-284 28/05/2026
Improper Access Control em Oracle Financials Common Modules
Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financials Common Modules. While the vulnerability is in Oracle Financials Common Modules, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financials Common Modules accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
CVE-2026-46820
Alta · 8.5
CWE-284 28/05/2026
Improper Access Control em Oracle Financials Common Modules
Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financials Common Modules. While the vulnerability is in Oracle Financials Common Modules, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financials Common Modules accessible data as well as unauthorized update, insert or delete access to some of Oracle Financials Common Modules accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
CVE-2026-46819
Crítica · 9.1
CWE-284 28/05/2026
Oracle E-Business Suite Internet Procurement Connector: Controle de Acesso Inadequado
Vulnerabilidade no produto Oracle Internet Procurement Connector do Oracle E-Business Suite (componente: Internal Operations). As versões suportadas afetadas são 12.2.3-12.2.15. Vulnerabilidade facilmente explorável permite que um atacante não autenticado com acesso à rede via HTTP comprometa o Oracle Internet Procurement Connector. Ataques bem-sucedidos podem resultar em acesso não autorizado para criação, exclusão ou modificação de dados críticos ou de todos os dados acessíveis do Oracle Internet Procurement Connector, bem como acesso não autorizado a dados críticos ou acesso completo a todos os dados acessíveis do Oracle Internet Procurement Connector. CVSS 3.1 Base Score 9.1 (impactos de confidencialidade e integridade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVE-2026-46818
Alta · 7.4
CWE-284 28/05/2026
Improper Access Control em Oracle E-business Suite
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Payments. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Payments accessible data as well as unauthorized access to critical data or complete access to all Oracle Payments accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVE-2026-46775
Crítica · 9.9
CWE-400 28/05/2026
Vulnerabilidade no componente Core do Oracle REST Data Services (CVE-2026-46775)
Vulnerabilidade no Oracle REST Data Services (componente: Core). As versões suportadas afetadas são 24.2.0-26.1.0. Vulnerabilidade facilmente explorável que permite a um atacante com baixos privilégios e acesso à rede via HTTPS comprometer o Oracle REST Data Services. Embora a vulnerabilidade esteja no Oracle REST Data Services, ataques podem impactar significativamente outros produtos (mudança de escopo). Ataques bem-sucedidos podem resultar na tomada de controle do Oracle REST Data Services. CVSS 3.1 Base Score 9.9 (impactos de Confidencialidade, Integridade e Disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-46817
Crítica · 9.8
KEV Alta · 68 Exploit público CWE-269 28/05/2026
Oracle E-Business Suite Improper Privilege Management Vulnerability
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).