CVE-2022-21587: Oracle E-Business Suite unauthenticated file-upload RCE, exploited
The short version: CVE-2022-21587 is an unauthenticated arbitrary file-upload flaw in the Web Applications Desktop Integrator component of Oracle E-Business Suite. An attacker with HTTP access writes files to the server and reaches remote code execution — no login required. It's exploited in the wild and in CISA's KEV catalog with a very high EPSS. Steady hands — but move: patch and review for prior compromise.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 98.3% · 99.9th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2023-02-23 |
| Known exploited? | Yes — active in-the-wild exploitation; public exploit available (known ransomware use) |
| Vulnerability type | CWE-306 missing authentication → arbitrary file upload (ZipSlip) → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Oracle E-Business Suite (Web Applications Desktop Integrator) 12.2.3 through 12.2.11 |
| Fixed in | Oracle Critical Patch Update, October 2022 |
What you need to know
Oracle E-Business Suite (EBS) is a large, often internet-facing enterprise application platform. CVE-2022-21587 is a missing-authentication flaw in the Upload component of Oracle Web Applications Desktop Integrator: an unauthenticated attacker can reach the upload function and write arbitrary files.
The mechanics turn a file write into full compromise:
- Two steps to code execution. The payload is uudecoded and then unzipped; a ZipSlip path-traversal in the unzip step lets the attacker write files anywhere, leading to remote code execution.
- It's unauthenticated and easy. Network access over HTTP is enough; a public exploit followed the vulnerability research.
- It's confirmed exploited. CISA added it to the KEV catalog on evidence of active exploitation, and its EPSS is very high.
How serious we see it
Critical — the 9.8 is fully earned.
Unauthenticated code execution on an internet-facing enterprise application, exploited in the wild with a public exploit and in CISA's KEV catalog, is top-of-queue. Paper and practice agree.
The bounded, reassuring part: it affects a specific EBS version range, Oracle's October 2022 fix is published, and exposure is quick to confirm. The catch is history — an exposed, unpatched EBS has likely been probed, so pair patching with a compromise review (look for dropped files and webshells).
Recommendations
Straight from Oracle's October 2022 CPU and CISA:
- Patch now. Apply the October 2022 Critical Patch Update to affected EBS 12.2.3–12.2.11.
- Reduce exposure. Restrict internet access to EBS where you can while you patch and investigate.
- Hunt. Review the server for unexpected uploaded files and webshells, and review logs for requests to the Web Applications Desktop Integrator upload endpoint.
- If you find indicators, respond fully. Remove dropped files, rebuild where warranted, and rotate credentials and secrets.
- Confirm your exposure first. Verify whether you run an affected EBS version and whether it's internet-reachable.
How BreachRisk sees it
BreachRisk works from the outside in. From little more than your domain it discovers internet-facing Oracle E-Business Suite interfaces, fingerprints the product and version, and flags exposure tied to this KEV-listed, actively exploited flaw so it rises to the top of your results. Because reliable verification would require uploading a persistent file to the server, BreachRisk detects and flags the exposed, affected instance rather than writing to it — the honest, non-disruptive line.
That outside-in view answers the first question fast — do we run an exposed EBS that needs this patch? — so you can act ahead of a public exploit.