Oracle Critical Patch Update — October 2020

Exploited 4

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

• Critical 10.0
  CVE-2020-14871 Exploited Public exploit Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11.…
  EPSS 80%
• Critical 9.8
  CVE-2020-14882 Exploited Public exploit Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1…
  EPSS 100%
• High 7.5
  CVE-2020-14864 Exploited Public exploit Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Installation). Supported versions that are…
  EPSS 97%
• High 7.2
  CVE-2020-14883 Exploited Public exploit Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1…
  EPSS 98%

Critical 7

• Critical 9.8
  CVE-2020-14825 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.…
  EPSS 30%
• Critical 9.8
  CVE-2020-14841 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.…
  EPSS 50%
• Critical 9.8
  CVE-2020-14855 Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Administration). The supported version that is af…
  EPSS 2.2%
• Critical 9.8
  CVE-2020-14859 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.…
  EPSS 3.8%
• Critical 9.1
  CVE-2020-14805 Vulnerability in the Oracle E-Business Suite Secure Enterprise Search product of Oracle E-Business Suite (component: Search Integration Engine). Supported vers…
  EPSS 1.6%
• Critical 9.1
  CVE-2020-14875 Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are affected are 12.1.1…
  EPSS 2.2%
• Critical 9.1
  CVE-2020-14876 Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.1.1 - …
  EPSS 2.8%

All vulnerabilities 160