Oracle Configurator vulnerabilities

17 CVEs affecting Oracle Configurator, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-34274, published 2026-04-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-61884: Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability, published 2025-10-12. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2025-10-20. EPSS: 95.9% chance of exploitation in the next 30 days. Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows…
CVE-2002-1639, published 2002-04-01. High severity, CVSS 7.5. EPSS: 5.3% chance of exploitation in the next 30 days. Oracle Configurator before 11.5.7.17.32 and 11.5.6.16.53 allows remote attackers to obtain sensitive information via a request to the oracle.apps.cz.servlet.UiServlet servlet with the test parameter…
CVE-2002-1640, published 2002-04-01. Medium severity, CVSS 6.8. EPSS: 5.2% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Oracle Configurator before 11.5.7.17.32 and 11.5.6.16.53 allows remote attackers to inject arbitrary web script or HTML via (1) Text Features in…
CVE-2016-3438, published 2016-04-21. High severity, CVSS 8.2. EPSS: 2.1% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 12.0.6, 12.1, and 12.2 allows remote attackers to affect confidentiality and integrity via vectors…
CVE-2016-0541, published 2016-01-21. Medium severity, CVSS 5.0. EPSS: 1.8% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 11.5.10.2, 12.1, and 12.2 allows remote attackers to affect confidentiality via unknown vectors…
CVE-2016-0540, published 2016-01-21. Medium severity, CVSS 5.0. EPSS: 1.8% chance of exploitation in the next 30 days. Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 11.5.10.2, 12.1, and 12.2 allows remote attackers to affect confidentiality via unknown vectors…
CVE-2019-2567, published 2019-04-23. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. Vulnerability in the Oracle Configurator component of Oracle Supply Chain Products Suite (subcomponent: Active Model Generation). Supported versions that are affected are 12.1 and 12.2. Easily…
CVE-2020-2865, published 2020-04-15. Medium severity, CVSS 5.3. EPSS: 1.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: Installation). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows…
CVE-2020-14669, published 2020-07-15. High severity, CVSS 8.2. EPSS: 1.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows…
CVE-2021-2080, published 2021-01-20. High severity, CVSS 8.2. EPSS: 1.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows…

Latest

CVE-2026-34274, published 2026-04-21. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability…
CVE-2026-21972, published 2026-01-20. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability…
CVE-2025-30728, published 2025-04-15. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows…
CVE-2025-30720, published 2025-04-15. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Orders). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows…
CVE-2022-21255, published 2022-01-19. High severity, CVSS 8.1. EPSS: 1.1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: UI Servlet). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows…
CVE-2021-2079, published 2021-01-20. High severity, CVSS 8.2. EPSS: 1.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows…
CVE-2021-2078, published 2021-01-20. High severity, CVSS 8.2. EPSS: 1.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Configurator product of Oracle Supply Chain (component: UI Servlet). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows…