BaseFortify

Publication date: 2026-01-20

Last updated on: 2026-01-29

Assigner: Oracle

Description

Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Scripting Admin). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Scripting, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Scripting accessible data as well as unauthorized read access to a subset of Oracle Scripting accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-20

Last Modified

2026-01-29

Generated

2026-07-06

AI Q&A

2026-01-21

EPSS Evaluated

2026-07-05

NVD

CVE-2026-21943

EUVD

EUVD-2026-3566

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	scripting	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Oracle Scripting product of Oracle E-Business Suite (versions 12.2.3 to 12.2.15). It allows an unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. The attack requires human interaction from someone other than the attacker. Successful exploitation can lead to unauthorized update, insert, or delete access to some Oracle Scripting accessible data, as well as unauthorized read access to a subset of that data. The vulnerability impacts confidentiality and integrity but not availability.

Impact Analysis

If exploited, this vulnerability can allow an attacker to gain unauthorized access to Oracle Scripting data, including the ability to read, update, insert, or delete certain data. This can lead to data compromise, data integrity issues, and potentially affect other related products due to scope change. The attacker does not need prior authentication but requires another person to interact with the attack.

Hi! I’m here to help you understand CVE-2026-21943. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70