High WID-SEC-2026-3399 7 CVEs

Oracle Enterprise Manager: Mehrere Schwachstellen

Published Sep 15, 2026 · Updated Sep 15, 2026 · de-DE

Vendor: Oracle Product: Enterprise Manager Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Enterprise Manager ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle Enterprise Manager (OEM) ist ein Set von System Management Werkzeugen von Oracle für Oracle Umgebungen. Es beinhaltet Werkzeuge zum Monitoring von Oracle Umgebung und zur Automatisierung von Datenbank- und Applikations Administration.

Vulnerabilities 7

Critical 9.8

CVE-2026-41635

Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE

Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to be executed. The fix checks if the class…

Apache Software Foundation Apache MINA jenkins-2-openjdk-21 jenkins-2-openjdk-25 Debian Ubuntu Wolfi Maven

Apr 27, 2026
Critical 9.8

CVE-2026-83355

Vulnerability in the Oracle Enterprise Manager for Fusion Middleware product of Oracle Enterprise Manager (component: M…

Oracle Oracle Enterprise Manager for Fusion Middleware

Sep 15, 2026
High 7.7

CVE-2026-83068

Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Cor…

Oracle Oracle Enterprise Manager for Oracle Database

Sep 15, 2026
High 7.4

CVE-2026-2332 Public exploit

HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.htm…

Eclipse Foundation Eclipse Jetty druid trino Debian Ubuntu Wolfi Maven

Apr 14, 2026
Medium 6.5

CVE-2026-62597

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Man…

Oracle Oracle Enterprise Manager Base Platform

Sep 15, 2026
Medium 6.3

CVE-2025-68161

Apache Log4j Core: Missing TLS hostname verification in Socket appender

The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-att…

Apache Software Foundation Apache Log4j Core airflow-3 celeborn-0.6 Debian Ubuntu Wolfi Maven

Dec 18, 2025
Medium 6.3

CVE-2026-49844 Public exploit

Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-…

Apache Software Foundation Apache Log4j API druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

Jul 10, 2026

Revision history

2026-09-15 #1
Initiale Fassung

References

Oracle Critical Security Patch Update Advisory - September 2026 - Appendix Oracle Enterprise Manager vom 2026-09-15
https://www.oracle.com/security-alerts/cspusep2026.html#AppendixEM