Actively exploited vulnerabilities affecting Oracle products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2026-46817https://wildfortech.com/security#CVE-2026-46817This vulnerability in Oracle E-Business Suite allows an unauthenticated attacker to remotely compromise Oracle Payments over HTTP — no credentials required. A successful exploit can result in a full takeover of the Oracle Payments component, meaning an attacker could manipulate financial transactions, access sensitive payment data, or disrupt payment processing entirely. Because no authentication barrier exists, any internet-exposed instance is at heightened risk and should be treated as a priority.Wed, 15 Jul 2026 00:00:00 GMTOracleE-Business Suitehttps://wildfortech.com/security#CVE-2026-35273https://wildfortech.com/security#CVE-2026-35273This vulnerability in Oracle PeopleSoft Enterprise PeopleTools allows an unauthenticated attacker — someone with no credentials whatsoever — to completely take over the affected system. PeopleSoft is widely used for HR, finance, and enterprise management, making a full takeover especially damaging. The flaw is already being exploited in ransomware campaigns, meaning real-world attacks are active and the window for remediation is narrow. Any internet-exposed PeopleSoft instance should be treated as critically at risk.Fri, 12 Jun 2026 00:00:00 GMTOracle PeopleSoft Enterprise PeopleToolshttps://wildfortech.com/security#CVE-2024-21182https://wildfortech.com/security#CVE-2024-21182Oracle WebLogic Server contains a flaw reachable over the T3 and IIOP network protocols without any authentication. An attacker who can reach the server on these ports could silently read sensitive data or gain complete access to everything the server can access. Because no credentials are required, the attack surface extends to any network-exposed WebLogic instance, making this a high-priority risk for organizations running WebLogic in internet-facing or multi-tenant environments.Mon, 01 Jun 2026 00:00:00 GMTOracleWebLogic Serverhttps://wildfortech.com/security#CVE-2025-61757https://wildfortech.com/security#CVE-2025-61757Oracle Fusion Middleware's Identity Manager can be fully taken over by an unauthenticated remote attacker due to a missing authentication check on a critical function. This means no credentials are required to exploit it — an internet-exposed instance could be compromised by anyone who can reach it. Identity Manager controls user provisioning and access across enterprise systems, so a takeover could lead to unauthorized account creation, privilege escalation, or broad lateral movement across the organization.Fri, 21 Nov 2025 00:00:00 GMTOracleFusion Middlewarehttps://wildfortech.com/security#CVE-2025-61884https://wildfortech.com/security#CVE-2025-61884This unauthenticated SSRF flaw in Oracle E-Business Suite's Configurator component allows a remote attacker to force the server to make arbitrary internal network requests without needing any credentials. In practice, this can be used to probe internal infrastructure, bypass network perimeter controls, or pivot deeper into an environment. The fact that ransomware operators are already exploiting this vulnerability makes it an urgent priority for any organization running Oracle E-Business Suite.Mon, 20 Oct 2025 00:00:00 GMTOracleE-Business Suitehttps://wildfortech.com/security#CVE-2025-61882https://wildfortech.com/security#CVE-2025-61882This vulnerability in Oracle E-Business Suite's BI Publisher Integration component allows an unauthenticated attacker over a standard HTTP connection to fully take over Oracle Concurrent Processing — the system that manages background jobs and batch operations. No credentials are required to exploit this, making it particularly dangerous on any internet-exposed or network-accessible EBS instance. It has already been linked to active ransomware campaigns, meaning real-world attackers are actively exploiting it.Mon, 06 Oct 2025 00:00:00 GMTOracleE-Business Suite