Skip to content
Critical Vulnerabilities in Oracle E-Business Suite and Middleware Exposed

Critical Vulnerabilities in Oracle E-Business Suite and Middleware Exposed

First seen 28 Oct 2026, 18:40 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 28, 2026 at 20:38 UTC

Oracle's October Critical Patch Update addressed 1,295 vulnerabilities, including six rated 10.0 on the CVSS scale. Among these, CVE-2026-91231, CVE-2026-91221, and CVE-2026-91216 affect the Oracle SOA Suite, allowing remote control without authentication. Additionally, CVE-2026-101809 in Oracle E-Business Suite and CVE-2026-87337 in Oracle Access Manager also pose significant risks. The vulnerabilities can lead to unauthorized access and potential exploitation of connected systems. The situation is exacerbated by reports of active attempts to exploit CVE-2026-101767, which allows SQL injection without authentication. Organizations using Oracle products are urged to apply the latest patches immediately to mitigate these risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-20
Critical vulnerabilities published
Oracle disclosed six critical vulnerabilities with a CVSS score of 10.0, affecting key enterprise products.
Ciberseguridadlatam
2026-10-20
CVE-2026-91221 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-20
CVE-2026-91231 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-20
CVE-2026-91216 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-20
CVE-2026-91299 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-20
CVE-2026-87337 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-24
Oracle's Critical Patch Update released
Oracle released a patch addressing 1,295 vulnerabilities, urging immediate application by users.
Ciberseguridadlatam
2026-10-28
Active exploitation attempts reported
Monitoring systems detected attempts to exploit CVE-2026-101767 in Oracle E-Business Suite, indicating urgent need for patching.
sempreupdate.com.br

More articles in this cluster (2)

Following this threat?

Track CVE-2026-101767 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (15)

1 / 3

Common questions

Which Oracle products are affected?
The vulnerabilities affect Oracle SOA Suite, E-Business Suite, and Access Manager.
What is the status of exploitation?
Active exploitation attempts have been reported for CVE-2026-101767, indicating immediate risk.
What should organizations do?
Organizations should apply the latest patches from Oracle immediately to mitigate risks.