Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in

Oracle E-Business Suite (September 2026 CSPU)

🗓️ 24 Sep 2026 00:00:00Reported by TenableType 
nessus
 nessus🔗 www.tenable.com👁 1 Views

Unauthenticated takeover in Oracle E-Business Suite 12.2.3-12.2.15 via network access.

Related
Refs
Code
ReporterTitlePublishedViews
Family
cve
CVE		CVE-2026-70755
15 Sep 202620:02
–cve
cve
CVE		CVE-2026-83044
15 Sep 202620:03
–cve
cve
CVE		CVE-2026-83072
15 Sep 202620:03
–cve
cve
CVE		CVE-2026-83076
15 Sep 202620:03
–cve
cve
CVE		CVE-2026-83082
15 Sep 202620:03
–cve
cve
CVE		CVE-2026-83083
15 Sep 202620:03
–cve
cve
CVE		CVE-2026-83084
15 Sep 202620:03
–cve
cve
CVE		CVE-2026-83089
15 Sep 202620:03
–cve
cve
CVE		CVE-2026-83090
15 Sep 202620:03
–cve
cve
CVE		CVE-2026-83091
15 Sep 202620:03
–cve
Rows per page
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(349717);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/24");

  script_cve_id(
    "CVE-2026-70755",
    "CVE-2026-83044",
    "CVE-2026-83072",
    "CVE-2026-83076",
    "CVE-2026-83082",
    "CVE-2026-83083",
    "CVE-2026-83084",
    "CVE-2026-83089",
    "CVE-2026-83090",
    "CVE-2026-83091",
    "CVE-2026-83092",
    "CVE-2026-83110",
    "CVE-2026-83111",
    "CVE-2026-83112",
    "CVE-2026-83113",
    "CVE-2026-83114",
    "CVE-2026-83115",
    "CVE-2026-83116",
    "CVE-2026-83117",
    "CVE-2026-83118",
    "CVE-2026-83119",
    "CVE-2026-83120",
    "CVE-2026-83121",
    "CVE-2026-83122",
    "CVE-2026-83123",
    "CVE-2026-83124",
    "CVE-2026-83125",
    "CVE-2026-83126",
    "CVE-2026-83127",
    "CVE-2026-83128",
    "CVE-2026-83129",
    "CVE-2026-83130",
    "CVE-2026-83131",
    "CVE-2026-83132",
    "CVE-2026-83133",
    "CVE-2026-83134",
    "CVE-2026-83135",
    "CVE-2026-83136",
    "CVE-2026-83137",
    "CVE-2026-83138",
    "CVE-2026-83140",
    "CVE-2026-83141",
    "CVE-2026-83142",
    "CVE-2026-83152",
    "CVE-2026-83157",
    "CVE-2026-83158",
    "CVE-2026-83159",
    "CVE-2026-83161",
    "CVE-2026-83162",
    "CVE-2026-83163",
    "CVE-2026-83164",
    "CVE-2026-83165",
    "CVE-2026-83166",
    "CVE-2026-83167",
    "CVE-2026-83168",
    "CVE-2026-83169",
    "CVE-2026-83170",
    "CVE-2026-83171",
    "CVE-2026-83172",
    "CVE-2026-83173",
    "CVE-2026-83174",
    "CVE-2026-83175",
    "CVE-2026-83176",
    "CVE-2026-83177",
    "CVE-2026-83178",
    "CVE-2026-83179",
    "CVE-2026-83184",
    "CVE-2026-83185",
    "CVE-2026-83186",
    "CVE-2026-83187",
    "CVE-2026-83188",
    "CVE-2026-83189",
    "CVE-2026-83194",
    "CVE-2026-83198",
    "CVE-2026-83200",
    "CVE-2026-83204",
    "CVE-2026-83205",
    "CVE-2026-83300",
    "CVE-2026-83327",
    "CVE-2026-83328",
    "CVE-2026-83329",
    "CVE-2026-83331",
    "CVE-2026-83332",
    "CVE-2026-83338",
    "CVE-2026-83341",
    "CVE-2026-83345",
    "CVE-2026-83352",
    "CVE-2026-83356",
    "CVE-2026-83425",
    "CVE-2026-83428",
    "CVE-2026-83429",
    "CVE-2026-83430",
    "CVE-2026-83431",
    "CVE-2026-83432",
    "CVE-2026-83433",
    "CVE-2026-83434",
    "CVE-2026-83435",
    "CVE-2026-83436",
    "CVE-2026-83437",
    "CVE-2026-83438",
    "CVE-2026-83440",
    "CVE-2026-83441",
    "CVE-2026-83442",
    "CVE-2026-83443",
    "CVE-2026-83444",
    "CVE-2026-83445",
    "CVE-2026-83446",
    "CVE-2026-83447",
    "CVE-2026-83448",
    "CVE-2026-83449",
    "CVE-2026-83450",
    "CVE-2026-83451",
    "CVE-2026-83452",
    "CVE-2026-83453",
    "CVE-2026-83454",
    "CVE-2026-83455",
    "CVE-2026-83456",
    "CVE-2026-83457",
    "CVE-2026-83461",
    "CVE-2026-83462",
    "CVE-2026-83463",
    "CVE-2026-83464",
    "CVE-2026-83465",
    "CVE-2026-83477",
    "CVE-2026-83479",
    "CVE-2026-83481",
    "CVE-2026-83482",
    "CVE-2026-83483",
    "CVE-2026-83484",
    "CVE-2026-83485",
    "CVE-2026-83486",
    "CVE-2026-83487",
    "CVE-2026-83490",
    "CVE-2026-83491",
    "CVE-2026-87124",
    "CVE-2026-87125",
    "CVE-2026-87126",
    "CVE-2026-87127",
    "CVE-2026-87149",
    "CVE-2026-87150",
    "CVE-2026-87151",
    "CVE-2026-87152",
    "CVE-2026-87153",
    "CVE-2026-87154",
    "CVE-2026-87155",
    "CVE-2026-87156",
    "CVE-2026-87157",
    "CVE-2026-87158",
    "CVE-2026-87159",
    "CVE-2026-87160",
    "CVE-2026-87161",
    "CVE-2026-87162",
    "CVE-2026-87163",
    "CVE-2026-87165",
    "CVE-2026-87166",
    "CVE-2026-87167",
    "CVE-2026-87168",
    "CVE-2026-87169",
    "CVE-2026-87265"
  );
  script_xref(name:"IAVA", value:"2026-A-1001");

  script_name(english:"Oracle E-Business Suite (September 2026 CSPU)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities");
  script_set_attribute(attribute:"description", value:
"The versions of Oracle E-Business Suite installed on the remote host are
affected by multiple vulnerabilities as referenced in the September 2026 CSPU advisory.

  - Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component:
    Personalization). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability
    allows unauthenticated attacker with network access via SOAP to compromise Oracle Applications Framework.
    Successful attacks of this vulnerability can result in takeover of Oracle Applications Framework.
    (CVE-2026-83327)

  - Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite
    (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily
    exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle
    Document Management and Collaboration. Successful attacks of this vulnerability can result in takeover of
    Oracle Document Management and Collaboration. (CVE-2026-83452)

  - Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA
    Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability
    allows unauthenticated attacker with network access via TCP to compromise Oracle Mobile Application Server.
    Successful attacks of this vulnerability can result in takeover of Oracle Mobile Application Server.
    (CVE-2026-83462)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/docs/tech/security-alerts/cspusep2026csaf.json");
  script_set_attribute(attribute:"see_also", value:"https://www.oracle.com/security-alerts/cspusep2026.html");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the September 2026 Oracle CSPU advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-83327");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/24");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:e-business_suite");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("oracle_e-business_query_patch_info.nbin");
  script_require_keys("Oracle/E-Business/Version", "Oracle/E-Business/patches/installed");

  exit(0);
}

include('vcf_extras_oracle.inc');

var app_info = vcf::oracle_ebusiness::get_app_info();

# Patches sourced from MOS note KA1806 (September 2026 EBS CSPU Availability Doc):
var constraints = [
  { 'min_version' : '12.2.3',  'max_version' : '12.2.3.999999',  'fix_patches' : '39902794, 38510732, 39688050, 39866158' },
  { 'min_version' : '12.2.4',  'max_version' : '12.2.4.999999',  'fix_patches' : '39902794, 32636352, 32750949, 34979060, 39355572, 39664473, 39688050, 39706752, 39722060, 39854827, 39866158, 39941128, 39947208, 39958159' },
  { 'min_version' : '12.2.5',  'max_version' : '12.2.5.999999',  'fix_patches' : '39902794, 32750949, 34979060, 36453170, 39392816, 39392856, 39393465, 39836142, 39836629, 39914524, 39941165, 39947229, 40007945' },
  { 'min_version' : '12.2.6',  'max_version' : '12.2.6.999999',  'fix_patches' : '39902794, 34870379, 34979060, 36560216, 37033978, 39392816, 39392856, 39393465, 39788595, 39836639, 39914537, 39941173, 39947241, 40007950' },
  { 'min_version' : '12.2.7',  'max_version' : '12.2.7.999999',  'fix_patches' : '39902794, 27429118, 30058115, 34870379, 36560216, 39382729, 39389795, 39392816, 39392856, 39393465, 39605877, 39836143, 39836606, 39836640, 39869984, 39941250, 39947251, 39958159' },
  { 'min_version' : '12.2.8',  'max_version' : '12.2.8.999999',  'fix_patches' : '39902794, 33623398, 34870379, 36560216, 39382729, 39389795, 39392816, 39392856, 39393465, 39398008, 39605899, 39788610, 39836607, 39836642, 39869984, 39875334, 39941179, 39947276, 39958159' },
  { 'min_version' : '12.2.9',  'max_version' : '12.2.9.999999',  'fix_patches' : '39902794, 36560216, 39382729, 39389795, 39392816, 39392856, 39393465, 39396534, 39398008, 39606094, 39788618, 39836608, 39836999, 39869984, 39875334, 39941183, 39947299, 39958159' },
  { 'min_version' : '12.2.10', 'max_version' : '12.2.10.999999', 'fix_patches' : '39902794, 34979060, 36560216, 39382729, 39389795, 39392816, 39392856, 39396534, 39398008, 39606351, 39788671, 39836610, 39836647, 39941186, 39947340, 39951320, 39958159' },
  { 'min_version' : '12.2.11', 'max_version' : '12.2.11.999999', 'fix_patches' : '39902794, 34979060, 36560216, 39382729, 39389795, 39392816, 39392856, 39396534, 39398008, 39606548, 39836105, 39836611, 39836664, 39941189, 39947353, 39951375, 39958159' },
  { 'min_version' : '12.2.12', 'max_version' : '12.2.12.999999', 'fix_patches' : '39902794, 34979060, 36560216, 37288039, 39382729, 39389795, 39392816, 39392856, 39396534, 39398008, 39606780, 39836107, 39836613, 39854828, 39941190, 39947364, 39951376, 39958159' },
  { 'min_version' : '12.2.13', 'max_version' : '12.2.13.999999', 'fix_patches' : '39902794, 34979060, 36560216, 37287000, 39382729, 39389795, 39392816, 39392856, 39396534, 39398008, 39609846, 39836110, 39836615, 39836659, 39941064, 39941197, 39947367, 39951377, 39958159' },
  { 'min_version' : '12.2.14', 'max_version' : '12.2.14.999999', 'fix_patches' : '39902794, 34979060, 39382729, 39389795, 39392816, 39392856, 39396534, 39398008, 39609996, 39836111, 39836615, 39836658, 39941064, 39941200, 39947380, 39951378, 39958159' },
  { 'min_version' : '12.2.15', 'max_version' : '12.2.15.999999', 'fix_patches' : '39902794, 39382729, 39389795, 39392816, 39392856, 39396534, 39398008, 39610150, 39836120, 39836615, 39836658, 39941064, 39941202, 39947380, 39951379, 39958159' }
];

vcf::oracle_ebusiness::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE, fix_date:'202609');

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
24 Sep 2026 00:00Current
6.1Medium risk
Vulners AI Score6.1
CVSS 3.19.8
EPSS0.00486
SSVC
Oracle E-Business SuiteOracle Applications FrameworkOracle Document Management and CollaborationOracle Mobile Application Servertakeoverunauthenticated
1