Oracle Configurator vulnerabilities

3 known CVE vulnerabilities in Oracle Configurator, translated and rated.

CVE-2016-3438High
Unspecified vulnerability in the Oracle Configurator component in Oracle Supply Chain Products Suite 12.0.6, 12.1, and 12.2 allows remote attackers to affect confidentiality and integrity via vectors related to JRAD Heartbeat.
CVE-2025-61884HighActively exploited
Vulnerability in Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI) affects versions 12.2.3-12.2.14. It is easily exploitable by an unauthenticated attacker with network access via HTTP, potentially resulting in unauthorized access to critical data or complete access to all Oracle Configurator data. CVSS 3.1 Base Score is 7.5 (Confidentiality impact).
CVE-2026-34274Medium
Vulnerability in Oracle Configurator (component: User Interface) affecting versions 12.2.3-12.2.15. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the product with human interaction, resulting in unauthorized update, insert or delete access and unauthorized read access to a subset of data, with potential impact on additional products (scope change).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS