CVE-2026-22011

OVERVIEW CVE-2026-22011 is a vulnerability in the ADPatch component of Oracle E-Business Suite's Oracle Applications DBA product, affecting versions 12.2.3 through 12.2.15. The vulnerability allows an attacker to compromise the Oracle Applications DBA system, though it may also significantly impact additional connected products due to scope changes. SEVERITY The vulnerability carries a CVSS 3.1 base score of 7.6 (HIGH), with a network attack vector requiring high privileges and human interaction to exploit. Attack complexity is rated as high, mitigating somewhat against widespread exploitation. However, successful exploitation results in complete compromise of the affected system with high impacts to confidentiality, integrity, and availability. EXPLOITATION STATUS CVE-2026-22011 is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog and shows no active exploitation in the wild, with an EPSS score of 0.00033 indicating minimal probability of exploitation. The vulnerability is inactive on the Hot List, and community attention appears limited. However, organizations running affected versions should still prioritize remediation given the high potential impact and the requirement for only high-privileged network access to attempt exploitation.