CVE-2022-21587: Oracle E-Business Suite Desktop Integrator unauthenticated file upload RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable takeover with CVSS 9.8, KEV listing, known ransomware use and near-maximum EPSS makes this an urgent patch.

What it is

Oracle Web Applications Desktop Integrator in Oracle E-Business Suite (versions 12.2.3-12.2.11) fails to require authentication for a critical upload function, allowing an unauthenticated network attacker to upload arbitrary files. Because the affected component is reachable over HTTP and the flaw maps to CWE-306, it can lead to full takeover of the component.

Impact

An unauthenticated attacker can upload arbitrary files and achieve takeover of Oracle Web Applications Desktop Integrator, gaining high confidentiality, integrity and availability impact. In practice this can mean remote code execution and full compromise of the affected EBS deployment.

Attack surface

Reached over the network via HTTP against the Desktop Integrator upload component; the CVSS vector shows no privileges required and no user interaction. No authentication is needed, so any host that can reach the endpoint can attempt it.

Exploitation

The vulnerability is listed in CISA KEV (added 2023-02-02) with known ransomware campaign use, and EPSS is 0.98342 (99.9th percentile). Public exploit code is referenced on Packet Storm, so exploitation is active and widespread.

What to do

• Apply the Oracle October 2022 Critical Patch Update (cpuoct2022) for E-Business Suite 12.2.3-12.2.11 as directed by the vendor.
• If patching cannot be done immediately, restrict network access to the Desktop Integrator upload endpoints to trusted hosts only.
• Place the EBS application behind a WAF or reverse proxy and block unauthenticated upload requests to the affected component.
• Review and remove any unexpected files or web shells written to the EBS application directories.
• Monitor CISA KEV guidance and confirm remediation by the listed due date.

Detection

• Inspect HTTP logs for unauthenticated POST or multipart upload requests to Desktop Integrator upload paths.
• Alert on new or modified files in EBS web and application directories, especially executable or script files.
• Look for outbound connections or process execution spawned by the EBS application server that are not part of normal operation.
• Correlate EBS access logs with file integrity monitoring to catch uploads followed by execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.