Actively exploited in the wild
Oracle Fusion Middleware Unspecified Vulnerability
Oracle - Fusion Middleware · Listed in the CISA KEV since 2022-03-28. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2012-0518
MediumCVSS 4.7KEVSummary
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects. This is a different vulnerability than CVE-2012-3175.
Risk Assessment
A remote attacker could compromise the integrity of authentication or data flows in Oracle Fusion Middleware, potentially leading to unauthorized modifications or bypass of security controls.
Recommendation
Apply the available Oracle security updates for Oracle Fusion Middleware 10.1.4.3.0 as soon as possible and consider restricting access to the Single Sign-On component from untrusted networks.
Other vulnerabilities in Oracle Fusion Middleware
See all- CVE-2026-101590Critical
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security) affecting versions 4.0.0-4.5.5. An unauthenticated attacker with network access via HTTP can easily exploit it to gain unauthorized creation, deletion, or modification access to critical data.
- CVE-2026-60388Critical
Vulnerability in Oracle Fusion Middleware Service Delivery Platform (component: Messaging Enabler). Unauthenticated attacker via network (T3, IIOP) can take over the platform.
- CVE-2026-60387Critical
Vulnerability in Oracle Fusion Middleware Service Delivery Platform (component: Messaging Enabler). Unauthenticated attacker via network (T3, IIOP) can take over the platform.
- CVE-2026-60380Critical
Vulnerability in Oracle Fusion Middleware Service Delivery Platform (component: Messaging Enabler). Unauthenticated attacker via network (HTTP) can take over the platform.
- CVE-2026-60374Critical
Vulnerability in Oracle Fusion Middleware Service Delivery Platform (component: Messaging Enabler). Unauthenticated attacker via network (T3, IIOP) can take over the platform.
- CVE-2026-61099High
Vulnerability in Oracle WebCenter Enterprise Capture product (Oracle Fusion Middleware) in Client Bundle component. Affects versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can take over the system.
- CVE-2026-61098High
Vulnerability in Oracle WebCenter Enterprise Capture product (Oracle Fusion Middleware) in Client Bundle component. Affects versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can take over the system.
- CVE-2026-60657High
Vulnerability in Oracle WebCenter Content (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit, requires low privileges and user interaction, but may affect other products. Allows unauthorized access and modification of critical data.
- CVE-2026-60654High
Vulnerability in Oracle WebCenter Content (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can take over the system.
- CVE-2026-60563High
Vulnerability in Oracle WebCenter Portal (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can take over the portal.
Original NVD description (English source)
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-3175.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS