Technology · Oracle
Oracle E-Business Suite vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 110 vulnerabilities in Oracle E-Business Suite: 0 in the last 7 days and 79 in the last 90 days, 8 of them critical and 4 exploited in the wild. The most recent, CVE-2026-91496, was published on 20 October 2026. 13 vulnerabilities in the last four weeks, down 69% on the four before (42). 1 critical against 1.
- Last 7 days
- 0
- Last 90 days
- 79
- Critical, all time
- 8
- Exploited in the wild
- 4
About Oracle E-Business Suite
Oracle E-Business Suite is an integrated suite of enterprise resource planning applications for business operations and financial management.
Latest Oracle E-Business Suite vulnerabilities
- CVE-2026-91496: Oracle E-Business Suite Workflow Notification Mailer privilege escalationhighCVSS 7.5
- CVE-2026-87408: Oracle Applications Framework XSS/CSRF in PersonalizationhighCVSS 8.7
- CVE-2026-87366: Oracle E-Business Suite Applications Framework information disclosure in Web UtilitiesmediumCVSS 4.9
- CVE-2026-87357: Oracle E-Business Suite Order Capture privilege escalationhighCVSS 7.2
- CVE-2026-87356: Oracle E-Business Suite Applications Platform Engineering privilege escalationhighCVSS 7.8
- CVE-2026-101809: Oracle E-Business Suite Workflow Notification Mailer remote code executioncriticalCVSS 10
- CVE-2026-101711: Oracle E-Business Suite Payroll privilege escalationmediumCVSS 6.6
- CVE-2026-101705: Oracle E-Business Suite Common Applications privilege escalation in Role SummaryhighCVSS 7.7
- CVE-2026-101700: Oracle Application Object Library remote compromisehighCVSS 8.1
- CVE-2026-101681: Oracle E-Business Suite Applications DBA privilege escalation in AD UtilitieshighCVSS 7
- CVE-2026-101642: Oracle E-Business Suite Report Manager unauthorized access and denial of servicehighCVSS 7.1
- CVE-2026-101638: Oracle E-Business Suite Applications DBA privilege escalation in AD UtilitieshighCVSS 7.3
- CVE-2026-101536: Oracle Cost Management complete system compromise via Cost MaintenancehighCVSS 7.5
- CVE-2026-87167: Oracle Purchasing unauthorized data access and modificationhighCVSS 8.1EPSS 0.4%
- CVE-2026-87163: Oracle E-Business Suite Purchasing privilege escalationhighCVSS 8.8EPSS 0.4%
- CVE-2026-87156: Oracle E-Business Suite Product Hub unauthorized data access via HTTPhighCVSS 7.1EPSS 0.3%
- CVE-2026-87155: Oracle E-Business Suite Product Hub remote code executionhighCVSS 8.8EPSS 0.4%
- CVE-2026-87154: Oracle E-Business Suite Product Hub unauthorized data accesshighCVSS 8.1EPSS 0.4%
- CVE-2026-87152: Oracle E-Business Suite Installed Base unauthorized data access in Create Item InstancehighCVSS 8.1EPSS 0.4%
- CVE-2026-87127: Oracle Purchasing unauthorized data access in E-Business SuitehighCVSS 7.7EPSS 0.4%
- CVE-2026-87126: Oracle E-Business Suite Report Manager authorization bypasshighCVSS 7.1EPSS 0.4%
- CVE-2026-87125: Oracle Financials for Asia/Pacific privilege escalation in E-Business SuitehighCVSS 8.3EPSS 0.4%
- CVE-2026-83487: Oracle E-Business Suite Product Hub data exposurehighCVSS 7.7EPSS 0.4%
- CVE-2026-83486: Oracle E-Business Suite Product Hub information disclosure in Item CataloghighCVSS 7.7EPSS 0.4%
- CVE-2026-83485: Oracle E-Business Suite Product Hub unauthorized data accesshighCVSS 7.7EPSS 0.4%
Most severe Oracle E-Business Suite vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2025-61882: Oracle E-Business Suite improper authentication in BI Publisher Integrationcriticalexploited in the wildCVSS 9.8EPSS 99.7%
- CVE-2026-46817: Oracle E-Business Suite remote compromise in Oracle Paymentscriticalexploited in the wildCVSS 9.8EPSS 0.7%
- CVE-2022-21587: Oracle E-Business Suite Unspecified Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2025-61884: Oracle E-Business Suite SSRF in Configurator Runtime UIcriticalexploited in the wildCVSS 7.5EPSS 95.9%
- CVE-2026-101809: Oracle E-Business Suite Workflow Notification Mailer remote code executioncriticalCVSS 10
- CVE-2026-46933: Oracle Applications Manager privilege escalation in Internal OperationscriticalCVSS 9.9EPSS 0.4%
- CVE-2026-70926: Oracle E-Business Suite Workflow remote code execution via SMTPcriticalCVSS 9.8EPSS 0.5%
- CVE-2026-83327: Oracle E-Business Suite Applications Framework SOAP authentication bypasscriticalCVSS 9.8EPSS 0.5%
- CVE-2026-46916: Oracle E-Business Suite improper access control in Quality Management SpecshighCVSS 8.8EPSS 0.5%
- CVE-2026-87163: Oracle E-Business Suite Purchasing privilege escalationhighCVSS 8.8EPSS 0.4%
Vulnerabilities per week
13 vulnerabilities in the last four weeks, down 69% on the four before (42). 1 critical against 1. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 24 | 1 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 42 | 1 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 13 | 1 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Oracle E-Business Suite vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/e-business-suite)<a href="https://junglewise.ai/threats/technologies/e-business-suite"><img src="https://junglewise.ai/threats/technologies/e-business-suite/badge.svg" alt="Oracle E-Business Suite vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/e-business-suite.json, and this page as text at https://junglewise.ai/threats/technologies/e-business-suite.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Oracle E-Business Suite vulnerabilities", https://junglewise.ai/threats/technologies/e-business-suite, 9 November 2026.