High WID-SEC-2026-2895 5 CVEs

Oracle Financial Services Applications: Mehrere Schwachstellen

Published Aug 18, 2026 · Updated Aug 18, 2026 · de-DE

Vendor: Oracle Product: Financial Services Applications Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Financial Services Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle Financial Services ist eine Zusammenstellung von Anwendungen für den Finanzsektor und eine Technologiebasis zur Erfüllung von IT- und Geschäftsanforderungen.

Vulnerabilities 5

Critical 9.1

CVE-2026-33557

Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication

A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without valida…

Apache Software Foundation Apache Kafka apache-nifi debezium-3.5-connector-jdbc Ubuntu Wolfi Maven

Apr 20, 2026
High 8.8

CVE-2026-70922

Vulnerability in the Oracle Financial Services Enterprise Case Management product of Oracle Financial Services Applicat…

Oracle Oracle Financial Services Enterprise Case Management

Aug 18, 2026
High 8.1

CVE-2026-41855

Spring Framework Unsafe Deserialization via Jackson JMS Converters

In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions vi…

Spring Spring Framework libspring-java libspring-java Debian Ubuntu Maven

Jun 9, 2026
Medium 6.3

CVE-2026-34481

Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout

Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinit…

Apache Software Foundation Apache Log4j JSON Template Layout spark-4.0-scala-2.13 spark-4.1-scala-2.13 Debian Ubuntu Wolfi Maven

Apr 10, 2026
Medium 4.3

CVE-2026-33929

Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache PDFBox Examples. This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.36, from 3.0.0 through 3.0.7. Users are recom…

Apache Software Foundation Apache PDFBox Examples libpdfbox-java libpdfbox2-java Debian Ubuntu Maven

Apr 14, 2026

Revision history

2026-08-18 #1
Initiale Fassung

References

Oracle Critical Security Patch Update Advisory - August 2026 - Appendix Oracle Financial Services Applications vom 2026-08-18
https://www.oracle.com/security-alerts/cspuaug2026.html#AppendixIFLX