# Oracle patches 194 E-Business Suite flaws

Published: 2026-10-21 · Severity: routine
Canonical: https://vorant.io/reports/f4dcf555-256e-5fe7-82f6-b893cd3d052e/oracle-patches-194-e-business-suite-flaws

> Oracle fixed 194 vulnerabilities in E-Business Suite 12.2.3–12.2.15, including a maximum-severity 10.0 unauthenticated RCE flaw.

NCSC-NL has published an advisory summarizing Oracle's patch release addressing 194 vulnerabilities across Oracle E-Business Suite and related components, affecting versions 12.2.3 through 12.2.15. The flaws vary in impact and exploitation requirements: some can be exploited remotely without authentication, while others require valid credentials, specific access rights, or user interaction. Depending on the specific vulnerability, successful exploitation can lead to unauthorized data access, data creation, modification or deletion, and in the most severe cases, Remote Code Execution (RCE) allowing an attacker to run arbitrary code on the affected system.

CVSS 3.1 scores for the referenced vulnerabilities range up to the maximum of 10.0, with numerous flaws scoring 8.1–9.8, reflecting a high concentration of critical and high-severity issues including a missing authentication for critical function weakness. No exploitation in the wild is reported in this advisory. Defenders running Oracle E-Business Suite in the affected version range should apply Oracle's released updates as a priority, given the unauthenticated remote exploitation path present in a subset of these flaws and the scale of the patch set.

## Mentioned in this report

- Vulnerabilities: CVE-2026-101534, CVE-2026-101542, CVE-2026-101557, CVE-2026-101567, CVE-2026-101634, CVE-2026-101635, CVE-2026-101640, CVE-2026-101648, CVE-2026-101653, CVE-2026-101654, CVE-2026-101655, CVE-2026-101656, CVE-2026-101664, CVE-2026-101672, CVE-2026-101684, CVE-2026-101685, CVE-2026-101686, CVE-2026-101688, CVE-2026-101690, CVE-2026-101692, CVE-2026-101700, CVE-2026-101704, CVE-2026-101742, CVE-2026-101767, CVE-2026-101808, CVE-2026-101809, CVE-2026-101813, CVE-2026-101824, CVE-2026-101831, CVE-2026-101834, CVE-2026-101841, CVE-2026-101842, CVE-2026-101852, CVE-2026-101853, CVE-2026-101854, CVE-2026-83363, CVE-2026-83393, CVE-2026-87408, CVE-2026-91347, CVE-2026-91532

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0442.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f4dcf555-256e-5fe7-82f6-b893cd3d052e/oracle-patches-194-e-business-suite-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup