{"id":"CVE-2022-21587","published":"2022-10-18T21:15:10Z","modified":"2026-06-17T04:26:34Z","title":"Oracle E-Business Suite Unspecified Vulnerability","vendor":"Oracle","product":"E-Business Suite","tier":"core","eol":null,"description":{"text":"Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","provenance":"source","from":"NVD"},"summary":{"text":"An unspecified flaw in the Upload component of Oracle Web Applications Desktop Integrator, part of Oracle E-Business Suite, affects supported versions 12.2.3 through 12.2.11. An unauthenticated attacker with network access over HTTP can compromise the Desktop Integrator and take it over, with no user interaction or special configuration required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:41Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.98342,"percentile":0.99917,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-02-02","dueDate":"2023-02-23","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://www.oracle.com/security-alerts/cpuoct2022.html;  https://nvd.nist.gov/vuln/detail/CVE-2022-21587","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-02-02","exploitedFirstSeen":"2023-02-02","ransomware":true,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-02-02"},{"url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/report-crowdstrike-2023-threat-hunting-report.pdf","date":"2023-08-08"},{"url":"https://information.rapid7.com/rs/411-NAK-970/images/Rapid7-2023-Mid-Year-Threat-Review.pdf","date":"2023-08-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-03&host_type=src&vulnerability=cve-2022-21587","date":"2023-12-03"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-12-05&host_type=src&vulnerability=cve-2022-21587","date":"2023-12-05"},{"url":"https://25491742.fs1.hubspotusercontent-eu1.net/hubfs/25491742/WAZAWAKA_TLPCLEAR_Report.pdf","date":"2023-12-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-01&host_type=src&vulnerability=cve-2022-21587","date":"2024-01-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-14&host_type=src&vulnerability=cve-2022-21587","date":"2024-01-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-17&host_type=src&vulnerability=cve-2022-21587","date":"2024-01-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2022-21587","date":"2024-01-22"}],"evidenceTotal":592,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"http://packetstormsecurity.com/files/171208/Oracle-E-Business-Suite-EBS-Unauthenticated-Arbitrary-File-Upload.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2022.html","tags":["Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/171208/Oracle-E-Business-Suite-EBS-Unauthenticated-Arbitrary-File-Upload.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2022.html","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21587","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated network HTTP exploitation of public-facing application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP","start":177,"end":270}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: takeover implies access to application accounts","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator","start":329,"end":438}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-26811","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-26811","exploited":true,"exploitedSince":"2023-02-02","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2023-02-06","earliestUrl":"https://github.com/hieuminhnv/CVE-2022-21587-POC","repos":[{"name":"hieuminhnv/CVE-2022-21587-POC","url":"https://github.com/hieuminhnv/CVE-2022-21587-POC","stars":15,"created":"2023-02-06"},{"name":"sahabrifki/CVE-2022-21587-Oracle-EBS-","url":"https://github.com/sahabrifki/CVE-2022-21587-Oracle-EBS-","stars":6,"created":"2023-03-03"},{"name":"rockmelodies/Oracle-E-BS-CVE-2022-21587-Exploit","url":"https://github.com/rockmelodies/Oracle-E-BS-CVE-2022-21587-Exploit","stars":2,"created":"2023-02-22"}]},"metasploit":[{"name":"Oracle E-Business Suite (EBS) Unauthenticated Arbitrary File Upload","module":"exploit/linux/http/oracle_ebs_rce_cve_2022_21587","type":"exploit","disclosureDate":"2022-10-01","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/oracle_ebs_rce_cve_2022_21587.rb"}],"nuclei":[{"id":"CVE-2022-21587","name":"Oracle E-Business Suite 12.2.3 -12.2.11 - Remote Code Execution","severity":"critical","path":"http/cves/2022/CVE-2022-21587.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-21587.yaml"}],"first":{"date":"2022-10-01","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/oracle_ebs_rce_cve_2022_21587.rb"},"provenance":"source"},"detections":{"cveRules":[{"title":"Potential CVE-2022-21587 Exploitation Attempt","id":"d033cb8a-8669-4a8e-a974-48d4185a8503","level":"high","status":"test","path":"rules-emerging-threats/2022/Exploits/CVE-2022-21587/web_cve_2022_21587_oracle_ebs.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-21587/web_cve_2022_21587_oracle_ebs.yml","techniques":["T1190"]}]},"exploitRefs":["http://packetstormsecurity.com/files/171208/Oracle-E-Business-Suite-EBS-Unauthenticated-Arbitrary-File-Upload.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1078"],"provenance":"ai"}],"timeline":[{"date":"2022-10-01","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2023-02-06","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/oracle_ebs_rce_cve_2022_21587.rb","provenance":"source"},{"date":"2022-10-18","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21587","provenance":"source"},{"date":"2023-02-02","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2023-02-02","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-02-02","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-26811","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":107},"priority":{"score":79.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1365 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9992"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 3 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}