⚠ Reference material — not professional advice. Test in staging, back up first, verify against your specific version. Use your own judgment for your environment.
● Critical · CVSS 9.8 ⚠ ACTIVELY EXPLOITED — CISA KEV

How to Fix CVE-2022-21587: Oracle Web Applications Desktop Integrator Unauthenticated RCE

*By Sai Kiran Pandrala*

⚡ At a glance
SeverityCVSS 9.8, Critical
Actively exploited?Yes, listed in CISA KEV
AffectedOracle E-Business Suite Web Applications Desktop Integrator versions 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7, 12.2.8, 12.2.9, 12.2.10, 12.2.11
Fixed inApply the Oracle Critical Patch Update (CPU) for October 2022 or any later quarterly CPU
Type (CWE)Unauthenticated Remote Code Execution

⚠️ Patch immediately. Oracle E-Business Suite handles core ERP data, financials, HR, supply chain. Compromise here is a tier-1 incident.

What is CVE-2022-21587?

Oracle Web Applications Desktop Integrator (WebADI) is a component of Oracle E-Business Suite that lets desktop spreadsheets integrate with EBS via Excel and similar tools. The vulnerability in WebADI's handling of HTTP requests lets an unauthenticated remote attacker compromise the EBS server.

Oracle's CVSS scoring (9.8) plus unauthenticated network attack vector plus full confidentiality / integrity / availability impact = full takeover of the EBS application tier. From there: financial data, HR records, vendor master data, payment workflows, and the database credentials EBS uses.

Am I affected?

You are affected if you run Oracle E-Business Suite with WebADI versions 12.2.3 through 12.2.11 without the October 2022 (or later) Critical Patch Update applied.

To check WebADI version, log into EBS Sysadmin responsibility → OAM → Applications Dashboard → look for Web Applications Desktop Integrator and its current patch level.

How to fix CVE-2022-21587

  1. Open the Oracle Critical Patch Update Advisory, October 2022 (linked below) and identify the specific patch number for CVE-2022-21587.
  2. Download the patch from My Oracle Support (requires CSI / support contract).
  3. Apply the patch via Oracle's standard patching mechanism (adpatch, AD Online Patching for EBS 12.2). EBS 12.2 uses the online patching cycle:

# Vendor advisory: https://www.oracle.com/security-alerts/cpuoct2022.html
   adop phase=prepare
   adop phase=apply patches=<patch-number>
   adop phase=finalize
   adop phase=cutover
   adop phase=cleanup
  1. Re-test critical EBS forms and concurrent programs after the cutover phase.

Apply the latest available Oracle CPU rather than just October 2022, newer CPUs include CVE-2022-21587's fix plus dozens of subsequent EBS security fixes.

Patch via your OS package manager


# The exact package name and patched version are listed in the vendor advisory:
# https://www.oracle.com/security-alerts/cpuoct2022.html
# Debian / Ubuntu
sudo apt update
sudo apt install --only-upgrade webapplicationsdesktopintegrator

# RHEL / Rocky / AlmaLinux / Fedora
sudo dnf upgrade webapplicationsdesktopintegrator

# openSUSE
sudo zypper update webapplicationsdesktopintegrator

# Verify the running version matches the fixed version
dpkg -s webapplicationsdesktopintegrator 2>/dev/null | grep -i version || rpm -q webapplicationsdesktopintegrator 2>/dev/null


# Windows: pull the cumulative update that ships this fix.
Install-Module PSWindowsUpdate -Force -SkipPublisherCheck
Get-WindowsUpdate -AcceptAll -Install -AutoReboot

Verify the fix landed


# 1. Confirm the running version matches the fixed-in version from the advisory:
#    https://www.oracle.com/security-alerts/cpuoct2022.html
#    Use the platform-specific version probe above.

# 2. Re-scan with your vulnerability scanner (Nessus, Qualys, Tenable, OpenVAS).
#    The scanner should no longer flag CVE-2022-21587 on the patched target.

# 3. Inspect recent service / kernel logs for crash loops or rollback events.
journalctl -u <service> --since "10 minutes ago"
dmesg --since "10 minutes ago"

If you can't patch immediately

How to verify the fix worked

  1. EBS Sysadmin → OAM → Applications Dashboard → WebADI patch level reflects the applied CPU.
  2. Test the previously-vulnerable endpoint with an unauthenticated client, expect rejection.
  3. Run an authenticated vulnerability scan against the EBS URL. CVE-2022-21587 detection should clear.

Frequently asked questions

Is CVE-2022-21587 actively exploited?

Yes. CVE-2022-21587 is on the CISA Known Exploited Vulnerabilities catalog, so federal civilian agencies are required to patch on the published deadline. Most enterprises treat the same date as the practical floor.

What is the CVSS severity of CVE-2022-21587?

Critical. See the advisory for the full CVSS vector.

Where can I read the official advisory?

See https://www.oracle.com/security-alerts/cpuoct2022.html

Does the patch require a reboot?

It depends on the deployment. Service-only updates usually need a service restart; OS-level fixes require a full reboot. Check the vendor release notes for the exact post-upgrade steps.

References

*This guide was assembled from the Oracle CPU October 2022 advisory, NVD record, and CISA KEV listing on 2026-05-25. Always confirm against the Oracle CPU advisory before applying changes in production.*

Other vulnerabilities in the same area that are worth patching alongside this one: