Oracle patches 194 E-Business Suite flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
Oracle fixed 194 vulnerabilities in E-Business Suite 12.2.3–12.2.15, including a maximum-severity 10.0 unauthenticated RCE flaw.
NCSC-NL has published an advisory summarizing Oracle's patch release addressing 194 vulnerabilities across Oracle E-Business Suite and related components, affecting versions 12.2.3 through 12.2.15. The flaws vary in impact and exploitation requirements: some can be exploited remotely without authentication, while others require valid credentials, specific access rights, or user interaction. Depending on the specific vulnerability, successful exploitation can lead to unauthorized data access, data creation, modification or deletion, and in the most severe cases, Remote Code Execution (RCE) allowing an attacker to run arbitrary code on the affected system.
CVSS 3.1 scores for the referenced vulnerabilities range up to the maximum of 10.0, with numerous flaws scoring 8.1–9.8, reflecting a high concentration of critical and high-severity issues including a missing authentication for critical function weakness. No exploitation in the wild is reported in this advisory. Defenders running Oracle E-Business Suite in the affected version range should apply Oracle's released updates as a priority, given the unauthenticated remote exploitation path present in a subset of these flaws and the scale of the patch set.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0442.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,820 reports from 143 sources, 505 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs