Exploited vulnerability · CISA KEV

Is CVE-2022-21587 exploited? Yes: in CISA KEV since 2 Feb 2023

Gociux · Oracle E-Business Suite · data: CISA KEV, CVE record, FIRST EPSS

Yes. CVE-2022-21587, Oracle E-Business Suite Unspecified Vulnerability, is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities catalog on 2 Feb 2023, 107 days after it was published. It is known to be used in ransomware campaigns. It affects Oracle E-Business Suite. If you run it, CISA's required action is: Apply updates per vendor instructions.

What it is

Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.

What to do

1. Check whether you run it. Look for E-Business Suite in your asset inventory, including appliances and cloud images. Stack check lists every exploited Oracle CVE at once.
2. Apply the fix. Apply updates per vendor instructions.
3. If you can't patch today, take the affected service off the internet or restrict who can reach it, and check its logs for signs of compromise since 18 Oct 2022.
4. Get told next time. Email alerts when CISA adds a CVE for Oracle.

Other exploited CVEs in E-Business Suite

• CVE-2026-46817: Oracle E-Business Suite Improper Privilege Management Vulnerability (15 Jul 2026)
• CVE-2025-61884: Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability (20 Oct 2025)
• CVE-2025-61882: Oracle E-Business Suite Unspecified Vulnerability (6 Oct 2025)

References

• www.oracle.com/security-alerts/cpuoct2022.html
• nvd.nist.gov/vuln/detail/CVE-2022-21587

Sources: CISA KEV (exploitation, ransomware use, required action, due date), the CVE record (publication date, CVSS, CNA), NVD and FIRST EPSS (live score). More: all KEV additions in February 2023 · Oracle scorecard · act-now radar.