Vulnerabilities · 55 days ago

Oracle EBS Patches 120 Flaws Across Core Modules

Oracle has patched 120 vulnerabilities in Oracle E-Business Suite 12.2.3 through 12.2.15, with flaws spanning General Ledger, Payments, Workflow, Sales, Purchasing, Call Center Technology, and other business modules. The Dutch NCSC says the issues range from information exposure and denial of service to cases that can lead to full system takeover.

The mix matters because some flaws need only network access, some need low privileges, and some can be triggered without authentication at all. In practical terms, a compromise of the ERP layer can expose, alter, or delete records across finance and other shared business processes, so the blast radius is bigger than any single module name suggests.

For teams running Oracle EBS as a control plane for payments, purchasing, and customer-service data, the exposure sits in the platform itself: patching one workflow does not separate the rest of the business from a shared trust break. The advisory does not add exploitation evidence, but it does show that the environment now carries a broad, mixed-privilege attack surface.

CVEs in this update

120 CVEs

Across E-Business Suite, Oracle Payments, Oracle Workflow, and related packages.

2 critical · 110 high · 8 medium · 0 low

0 in CISA KEV · 0 with EPSS above 1%

Highest severity: CVE-2026-60782 · 9.8 CRITICAL

Showing the top 10 by KEV, EPSS, and severity.

Timeline

Sources

6 sources covering this story

Entities

Part of the PlainSec briefing for 2026-08-19

Editions

Related stories