Vulnerability record · CVE-2016-3444 · published 21 July 2016

CVE-2016-3444: Oracle retail integration bus vulnerability

Oracle · Retail Integration Bus

Unspecified vulnerability in the Oracle Retail Integration Bus component in Oracle Retail Applications 13.0, 13.1, 13.2, 14.0, 14.1, and 15.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Install.

9.8 CVSS 3.0 Critical EPSS 5.5% · top 7.5%

9.8CVSS 3.0 base score, v2 10.0

5.5%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Retail Integration Bus Oracle

References

Link	Tags
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html	PatchVendor Advisory
http://www.securityfocus.com/bid/91787	Third Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/91883
http://www.securitytracker.com/id/1036397
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html	PatchVendor Advisory
http://www.securityfocus.com/bid/91787	Third Party AdvisoryVDB Entry
http://www.securityfocus.com/bid/91883
http://www.securitytracker.com/id/1036397

Track CVE-2016-3444 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-22965Spring Framework data binding remote code execution (Spring4Shell)Spring MVC and Spring WebFlux applications on JDK 9+ can be exploited through data binding to achieve remote code execution. The known exploit path r…KEVEPSS 100%analysed1 Apr 2022 9.8CVE-2026-46982Oracle retail integration bus improper access control vulnerabilityVulnerability in the Oracle Retail Integration Bus product of Oracle Retail Applications (component: RIB Kernal). The supported version that is affec…EPSS 0.51%21 Jul 2026 9.8CVE-2026-46983Oracle retail integration bus improper access control vulnerabilityVulnerability in the Oracle Retail Integration Bus product of Oracle Retail Applications (component: RIB Kernal). The supported version that is affec…EPSS 0.51%21 Jul 2026 9.8CVE-2020-10683Dom4j project dom4j xml external entity (xxe) vulnerabilitydom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is po…EPSS 7.3%1 May 2020 9.8CVE-2019-13990Softwareag quartz xml external entity (xxe) vulnerabilityinitDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.EPSS 16%26 Jul 2019 9.8CVE-2018-8013Apache batik deserialization of untrusted data vulnerabilityIn Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name w…EPSS 19%24 May 2018 9.8CVE-2018-1270Spring Framework STOMP over WebSocket broker remote code executionSpring Framework versions 5.0 before 5.0.5 and 4.3 before 4.3.15 (plus older unsupported versions) allow applications to expose STOMP over WebSocket …EPSS 77%analysed6 Apr 2018 9.8CVE-2017-5645Apache Log4j 2 socket server deserialization allows remote code executionApache Log4j 2.x before 2.8.2 deserializes binary log events received over its TCP or UDP socket server without validating the payload. A crafted ser…EPSS 90%analysed17 Apr 2017

Source: NIST National Vulnerability Database (record CVE-2016-3444), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.