Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .9834 99.9 YES
AFFECTED Product Versions Fixed Web Applications Desktop Integrator 12.2.3-12.2.11 – —
TIMELINE Nov 15 Reserved by oracle Oct 18 Published (CNA: oracle) Feb 2 Added to CISA KEV, remediation due 2023-02-23
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in takeover of Oracle Web Applications Desktop Integrator. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
| Date | Event | Detail |
|---|---|---|
| November 15, 2021 | Reserved | Reserved by oracle |
| October 18, 2022 | Published | Published (CNA: oracle) |
| February 2, 2023 | KEV ADDED | Added to CISA KEV, remediation due 2023-02-23 |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Oracle Corporation | Web Applications Desktop Integrator | — | 12.2.3-12.2.11 | — |
Authoritative record: CVE-2022-21587 at cve.org
Vendors: oracle
Weaknesses: CWE-306
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2022-21587 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
