Oracle has patched 120 vulnerabilities in Oracle E-Business Suite 12.2.3 through 12.2.15, with flaws spanning General Ledger, Payments, Workflow, Sales, Purchasing, Call Center Technology, and other business modules. The Dutch NCSC says the issues range from information exposure and denial of service to cases that can lead to full system takeover.
The mix matters because some flaws need only network access, some need low privileges, and some can be triggered without authentication at all. In practical terms, a compromise of the ERP layer can expose, alter, or delete records across finance and other shared business processes, so the blast radius is bigger than any single module name suggests.
For teams running Oracle EBS as a control plane for payments, purchasing, and customer-service data, the exposure sits in the platform itself: patching one workflow does not separate the rest of the business from a shared trust break. The advisory does not add exploitation evidence, but it does show that the environment now carries a broad, mixed-privilege attack surface.
6 sources · Aug 19
CVEs in this update
120 CVEs
Across E-Business Suite, Oracle Payments, Oracle Workflow, and related packages.
Oracle ha rilasciato il Critical Patch Update di agosto che mira a correggere numerose vulnerabilità su più prodotti, di cui 145 con gravità “critica” e 520 con gravità “alta”.