Oracle · E-Business Suite

CVE-2022-21587

Oracle E-Business Suite Unspecified Vulnerability

Exploited in attacks Used by ransomware Critical 9.8 Attack chance: 98%

What it is

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CISA: Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: February 23, 2023

Added to the CISA list: February 2, 2023
Published: October 18, 2022
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 98% in the top 0.1% of all known vulnerabilities
Weakness: CWE-306
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from Oracle

Added	Vulnerability	Product	Severity	Attack chance
Jul 15, 2026	Improper Privilege ManagementCVE-2026-46817	E-Business Suite	Critical 9.8	12%
Oct 20, 2025	Server-Side Request Forgery (SSRF)CVE-2025-61884used by ransomware	E-Business Suite	High 7.5	96%
Oct 6, 2025	UnspecifiedCVE-2025-61882used by ransomware	E-Business Suite	Critical 9.8	99.7%
Aug 24, 2026	Improper Access ControlCVE-2026-21962	HTTP Server and Oracle Weblogic Server Proxy Plug-in	Critical 10.0	73%
Jun 12, 2026	PeopleSoft Enterprise PeopleTools Missing Authentication for Critical FunctionCVE-2026-35273used by ransomware	PeopleSoft Enterprise PeopleTools	Critical 9.8	97%
Jun 1, 2026	UnspecifiedCVE-2024-21182	WebLogic Server	High 7.5	74%
Nov 21, 2025	Missing Authentication for Critical FunctionCVE-2025-61757	Fusion Middleware	Critical 9.8	89%
Feb 24, 2025	DeserializationCVE-2024-20953	Agile Product Lifecycle Management (PLM)	High 8.8	3.9%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.