What is the official website of Oracle Security ?

The official website of Oracle Security is https://www.oracle.com/security/.

What is Oracle Security's cybersecurity risk score?

Oracle Security has an AI-generated cybersecurity risk score of 517 out of 1000, indicating a Critical security posture according to Rankiteo's assessment.

How many security incidents has Oracle Security experienced?

According to Rankiteo, Oracle Security currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Has Oracle Security been affected by any supply chain cyber incidents ?

According to Rankiteo, Oracle Security has been affected by multiple supply chain cyber incidents. The affected supply chain sources and their corresponding incident IDs are: AsyncAPI Initiative (Incident ID: CISSONMICORAASYKNX1784341544) OpenSSL Corporation (Incident ID: THEOPEOPEMYS1784312702) Oracle (Incident ID: ORA1782750283) Cerner Corporation (Incident ID: ORA1782239736) Oracle (Incident ID: MOO1781786358) Oracle (Incident ID: ORA1781526596) Oracle (Incident ID: ORA1782728779) Oracle (Incident ID: ORA1781180663) Oracle (Incident ID: ORAUNI1781123069) Oracle (Incident ID: ORA1780418023) Oracle (Incident ID: SALORAEAS1781684937) Oracle (Incident ID: TULORA1777415654) Snowflake (Incident ID: JONGENMCDGOL1775507547) Oracle (Incident ID: BROBECTHEORAABB1773750615) Oracle (Incident ID: NO-SHOPRELOB1773534483) Oracle (Incident ID: MSG1772483822) Oracle (Incident ID: MGMCAEORAWYN1771962331) Oracle (Incident ID: HYPORA1773686454) Oracle (Incident ID: CONDAVORASANASA1770645741) Oracle (Incident ID: NIS1768273584) Oracle (Incident ID: DARHARPRICOLCLE1767881845) Oracle (Incident ID: MADMICKORORA1773232260) ConnectWise (Incident ID: ARCCONO&OLOGKASORAWEBGOO1784262481) Oracle (Incident ID: ORA1782556111) Oracle (Incident ID: ADIHEAHARMARTHEJAG1767017696) Microsoft Security (Incident ID: AMAORAMIC1770695748) Tencent Cloud (Incident ID: CLO1769705152) Oracle (Incident ID: ORAMSG1772238496) Snowflake (Incident ID: MEREQUUNIMAEMGMGOOTOYSNOALLORARIPTIC1775528897) Oracle (Incident ID: PRIORAUNI1766419165) Oracle (Incident ID: ORA1766435444) Oracle (Incident ID: NHS3432334111425) Oracle (Incident ID: BAR1765043770) BleepingComputer (Incident ID: F50032500101925) Oracle (Incident ID: ORAWIT1773930753) Oracle (Incident ID: ORAPAR1766015901) Oracle (Incident ID: TULORA1779078400) Oracle (Incident ID: MARORA1772484170) Oracle (Incident ID: ORATHE1784810063) Oracle (Incident ID: COX53102453112425) Oracle (Incident ID: ORATHE1770237797) Oracle (Incident ID: THEORA1784580016) Salesloft (Incident ID: SAL0932309111025) Oracle (Incident ID: ANYSOT1770810849) Oracle (Incident ID: ORAHYP1773650183) Salesloft (Incident ID: ORA1692116100725) moveIT Software (Incident ID: ORA4202442101025) Oracle (Incident ID: JAG2592025111525) Oracle (Incident ID: BRO3105131112625) Oracle (Incident ID: ORA5662156100625) Fortinet (Incident ID: SAMFOXORAFORDHL1781785487) Oracle Health (Incident ID: ORA455040125) Oracle Health (Incident ID: ORA526032825) Salesforce (Incident ID: THEINGSALJAGORASYNDAV1769095448)

Does Oracle Security have SOC 2 Type 1 certification ?

According to Rankiteo, Oracle Security is not certified under SOC 2 Type 1.

Does Oracle Security have SOC 2 Type 2 certification ?

According to Rankiteo, Oracle Security does not hold a SOC 2 Type 2 certification.

Does Oracle Security comply with GDPR ?

According to Rankiteo, Oracle Security is not listed as GDPR compliant.

Does Oracle Security have PCI DSS certification ?

According to Rankiteo, Oracle Security does not currently maintain PCI DSS compliance.

Does Oracle Security comply with HIPAA ?

According to Rankiteo, Oracle Security is not compliant with HIPAA regulations.

Does Oracle Security have ISO 27001 certification ?

According to Rankiteo,Oracle Security is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Which industry does Oracle Security operate in ?

Oracle Security operates primarily in the IT Services and IT Consulting industry.

How many employees does Oracle Security have ?

Oracle Security employs approximately None employees people worldwide.

Does Oracle Security own any subsidiaries ?

Oracle Security presently has no subsidiaries across any sectors.

How many LinkedIn followers does Oracle Security have ?

Oracle Security's official LinkedIn profile has approximately 11,377 followers.

What is the NAICS classification code for Oracle Security ?

Oracle Security is classified under the NAICS code 5415, which corresponds to Computer Systems Design and Related Services.

Does Oracle Security have a Crunchbase profile ?

No, Oracle Security does not have a profile on Crunchbase.

Does Oracle Security have a LinkedIn profile ?

Yes, Oracle Security maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/oracle-security.

How many cybersecurity incidents has Oracle Security experienced ?

As of August 2, 2026, Rankiteo reports that Oracle Security has experienced 80 cybersecurity incidents.

How many peer or competitor companies does Oracle Security have ?

Oracle Security has an estimated 41,229 peer or competitor companies worldwide.

What types of cybersecurity incidents has Oracle Security faced ?

Incident Types: The types of cybersecurity incidents that have occurred include Vulnerability, Breach, Ransomware and Cyber Attack.

NEWRankiteo Cyber Underwriting Desktop - Score, price, and bind from your desktop

WindowsmacOSLinux

Download

Badge your company to reduce your risk score and your cyber insurance costs!

Link verified badges to your company page to build trust with insurers and customers.

Apply now and get your badge!

Internal validation & live display

Insurers and partners see a safer profile

Faster underwriting decisions

Trusted by insurers. Chosen by leaders.

Proud contributor to the Society of Actuaries.

Oracle Security

Boost Score +25 with badge (5 left)

517

/1000

Critical

542

/1000

Critical

Oracle Security Vendor Cyber Rating & Cyber Score

oracle.com

Add Your Compliance Badge

Protect your most valuable data in the cloud and on-premises with Oracle’s security-first approach. Oracle has decades of experience securing data and applications; Oracle Cloud Infrastructure delivers a more secure cloud to our customers, building trust and protecting their most valuable data.

Oracle Security A.I CyberSecurity Scoring

Scoring History

Oracle Security

Oracle Security CyberSecurity News & History

Past Incidents

Attack Types

Entity

Type

Severity

Impact

Seen

Blog Details

Supply Chain Source

Incident Details

View

Oracle Linux

Vulnerability

100

7/2026

AMAORATUXROC178...

Oracle

Vulnerability

7/2026

AsyncAPI Initia...

CISSONMICORAASY...

Oracle MySQL

Vulnerability

100

7/2026

OpenSSL Corpora...

THEOPEOPEMYS178...

Oracle

Vulnerability

100

6/2026

Oracle

ORA1782750283

Oracle Health

Breach

6/2026

Cerner Corporat...

ORA1782239736

Oracle

Breach

100

6/2026

Oracle

MOO1781786358

Oracle Security

Vulnerability

6/2026

ORAMOZ178165696...

Oracle

Vulnerability

100

6/2026

Oracle

ORA1781526596

Oracle

Vulnerability

6/2026

Oracle

ORA1782728779

Oracle

Vulnerability

100

6/2026

Oracle

ORA1781180663

Oracle Security

Vulnerability

6/2026

ORAJOOMANWPMDIG...

Oracle

Cyber Attack

100

6/2026

Oracle

ORAUNI178112306...

Oracle

Vulnerability

100

6/2026

Oracle

ORA1780418023

Oracle

Vulnerability

5/2026

Oracle

SALORAEAS178168...

Oracle

Breach

5/2026

METORATICBANYAH...

Oracle

Vulnerability

100

4/2026

Oracle

TULORA177741565...

Oracle

Breach

100

4/2026

ORABUS177558268...

Oracle

Breach

4/2026

Snowflake

JONGENMCDGOL177...

Oracle

Vulnerability

3/2026

ORA1774088623

Oracle

Cyber Attack

3/2026

Oracle

BROBECTHEORAABB...

Oracle

Breach

100

3/2026

Oracle

NO-SHOPRELOB177...

Oracle

Breach

3/2026

RAYORAFED177252...

Oracle

Breach

3/2026

Oracle

MSG1772483822

Oracle

Cyber Attack

2/2026

Oracle

MGMCAEORAWYN177...

Oracle

Ransomware

100

2/2026

Oracle

HYPORA177368645...

Oracle

Breach

2/2026

ORA1770195349

Oracle

Vulnerability

100

1/2026

ORA1768994894

Oracle

Ransomware

100

1/2026

Oracle

CONDAVORASANASA...

Oracle

Ransomware

100

1/2026

Oracle

NIS1768273584

Oracle

Breach

1/2026

Oracle

DARHARPRICOLCLE...

Oracle

Breach

1/2026

Oracle

MADMICKORORA177...

Oracle

Cyber Attack

1/2026

ConnectWise

ARCCONO&OLOGKAS...

Oracle Cloud HCM

Vulnerability

1/2026

Oracle

ORA1782556111

Oracle

Cyber Attack

12/2025

Oracle

ADIHEAHARMARTHE...

Oracle Cloud

Cyber Attack

100

12/2025

Microsoft Secur...

AMAORAMIC177069...

Oracle Cloud

Cyber Attack

100

12/2025

Tencent Cloud

CLO1769705152

Oracle

Vulnerability

12/2025

Oracle

ORAMSG177223849...

Oracle

Ransomware

100

12/2025

Snowflake

MEREQUUNIMAEMGM...

Oracle

Cyber Attack

11/2025

Oracle

PRIORAUNI176641...

Oracle

Vulnerability

11/2025

Oracle

ORA1766435444

Oracle

Cyber Attack

100

11/2025

Oracle

NHS343233411142...

Oracle

Ransomware

100

11/2025

Oracle

BAR1765043770

Oracle Security

Breach

100

10/2025

BleepingCompute...

F50032500101925

Oracle

Cyber Attack

10/2025

Oracle

ORAWIT177393075...

Oracle

Vulnerability

10/2025

Oracle

ORAPAR176601590...

Oracle Security

Cyber Attack

9/2025

ORA805090225

Oracle

Breach

8/2025

Oracle

TULORA177907840...

Oracle

Vulnerability

8/2025

Oracle

MARORA177248417...

Oracle

Breach

8/2025

Oracle

ORATHE178481006...

Oracle

Breach

100

8/2025

Oracle

COX531024531124...

Oracle

Vulnerability

8/2025

Oracle

ORATHE177023779...

Oracle

Vulnerability

8/2025

Oracle

THEORA178458001...

Oracle

Breach

8/2025

Salesloft

SAL093230911102...

Oracle

Ransomware

100

8/2025

Oracle

ANYSOT177081084...

Oracle

Vulnerability

8/2025

Oracle

ORAHYP177365018...

Oracle Communicatio...

Ransomware

100

8/2025

Salesloft

ORA169211610072...

Oracle

Ransomware

100

7/2025

moveIT Software

ORA420244210102...

Oracle

Cyber Attack

100

7/2025

Oracle

JAG259202511152...

Oracle

Ransomware

100

6/2025

Oracle

BRO310513111262...

Oracle Security

Vulnerability

6/2025

ORA083260810142...

Oracle

Ransomware

100

5/2025

Oracle

ORA566215610062...

Oracle Security

Breach

100

5/2025

Fortinet

SAMFOXORAFORDHL...

Oracle Security

Breach

100

4/2025

ORA656040225

Oracle

Ransomware

100

4/2025

ORA1784644706

Oracle Health

Breach

4/2025

Oracle Health

ORA455040125

Oracle Security

Breach

100

3/2025

ORA344032125

Oracle Health

Breach

1/2025

Oracle Health

ORA526032825

Oracle

Cyber Attack

100

1/2025

UNIORA178210972...

Oracle Cloud SCM

Ransomware

100

1/2025

Salesforce

THEINGSALJAGORA...

Oracle Security

Vulnerability

8/2024

ORA499324910062...

Oracle

Vulnerability

7/2024

ORA1780446221

Oracle Security

Ransomware

6/2024

ORA406214010022...

Oracle Security

Ransomware

100

1/2024

ORA109221010022...

Oracle Security

Ransomware

100

6/2023

ORA523325211212...

Oracle

Ransomware

100

1/2023

ORAMIC177555100...

Oracle Security

Breach

100

6/2021

ORA615032225

Oracle Security

Breach

100

6/2020

ORA956040325

Oracle Security

Ransomware

100

6/2019

ORA433274311212...

Oracle Security

Breach

100

08/2016

ORA392622

Oracle Security

Breach

7/2013

ORA720082025

Loading…

A.I.

Oracle Security Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

Actual

Prediction

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

Actual

Prediction A

Prediction B

Prediction C

Prediction D

A.I. Risk Score Predictions locked

Access Monitoring Plan

Loading…

Underwriter Stats for Oracle Security

Incidents vs IT Services and IT Consulting Industry Avg (This Year)

Oracle Security has 33.33% more incidents than the average of same-industry companies with at least one recorded incident.

Incidents vs All-Companies Average (This Year)

Oracle Security has 94.17% more incidents than the average of all companies with at least one recorded incident.

Incident Types Oracle Security vs IT Services and IT Consulting Industry Avg (This Year)

Oracle Security reported 2 incidents this year: 0 cyber attacks, 0 ransomware, 2 vulnerabilities, 0 data breaches, compared to industry peers with at least 1 incident.

Incident History - Oracle Security (X = Date, Y = Severity)

Loading…

SUBSIDIARY

Oracle Security Subsidiaries

Oracle Security

IT Services and IT Consulting

Website: https://www.oracle.com/security/

Company Size: 10,001+ employees

OracleIT Services and IT Consulting

Oracle AI DatabaseInformation Technology & Services

NetSuiteSoftware Development

Inside the SuiteSoftware Development

NetSuite Sales Development Representative ProgramSoftware Development

NetSuite Partner CommunitySoftware Development

Oracle Japan 日本オラクルInformation Technology & Services

Oracle AI DatabaseInformation Technology & Services

Oracle RestaurantsIT Services and IT Consulting

Loading…

Oracle Security Similar Companies

Hitachi

hitachi.com

For over 100 years, Hitachi has been committed to developing innovations that improve lives. Today, this means creating superior technology and products that balance environment, well-being, and economic growth. We integrate IT, operational technology (OT), and products to transform critical infrastructure and industrial systems. Through Hitachi’s process for creating value from data, which we call Lumada, we combine rich industry insight and infrastructure expertise to create measurable, positive change. We operate across four global sectors – Digital Systems & Services, Energy, Mobility, and Connective Industries – plus a Strategic Social Innovation Business Unit developing next-generation solutions. With over 280,000 employees across 618 consolidated subsidiaries in over 140 countries, we partner with our customers to create a harmonized society and build what’s next for people and planet.

Capita

capita.com

Capita is an outsourcer, helping clients across the public and private sectors run complex business processes more efficiently, creating better consumer experiences. Operating across eight countries, Capita’s 34,000 colleagues support primarily UK and European clients with people-based services underpinned by market-leading technology. We’re a vital support service for our clients, enabling the everyday interactions that we expect to run seamlessly, to run seamlessly. A publicly listed business with adjusted revenue of £2.4bn, Capita’s areas of focus are Central Government, Local Public Service, Defence, Learning, Fire & Security, Contact Centres and Pensions Solutions. We’re embracing change to respond to the ever-changing needs of society, creating better outcomes for all our stakeholders.

Coforge

cb coforge.com

Coforge is a global digital services and solutions provider that fuses deep domain expertise with emerging technologies to deliver real-world business impact. With a sharp focus on select industries and an execution intensity that’s uniquely our own, Coforge has emerged as the 7th largest Indian IT services firm, with a revenue growth rate nearly 8x the industry average. We help enterprises transform into intelligent, high-growth businesses through a wide gamut of digital transformation capabilities and deep experience across industries, including Agentic AI, Cloud, Data & Analytics, Low-Code Platforms, Intelligent Automation, Cybersecurity, and the setup and scaling of Global Capability Centers (GCCs). We deliver a wide range of digital engineering services—enabling modernization, operational agility, customer experience transformation, and industry-specific platform solutions. We operate across 24 countries, with 30 global delivery centers and a thriving workforce of 33,497 employees. “We are somewhat atypical in our approach to solving business problems. We are specialists, not just engineers and technologists, who spend an inordinate amount of time understanding the targeted functional spaces that we focus on.” — Sudhir Singh, CEO Coforge is a certified Great Place to Work® (5 years in a row), recognized for excellence in Employee Engagement, Learning & Development, and Corporate Social Responsibility. Our Greater Noida HQ runs entirely on 100% green energy. Through initiatives like The Coforge Public Library, we provide free, inclusive access to knowledge in Noida and Gurugram—and intend to expand this network across India. Coforge has been recognized by leading analysts and advisory firms, including Gartner, Forrester, Everest Group, Zinnov, and more.

DXC Technology

dxc.com

DXC Technology helps global companies run their mission-critical systems and operations while modernizing IT, optimizing data architectures, and ensuring security and scalability across public, private and hybrid clouds. The world's largest companies and public sector organizations trust DXC to deploy services to drive new levels of performance, competitiveness, and customer experience across their IT estates. Instagram: https://www.instagram.com/dxctechnology Youtube: https://www.youtube.com/DXCTechnology TikTok: https://www.tiktok.com/@dxc_technology

Apex Systems

apexsystems.com

Apex Systems is a leading global technology services firm that incorporates industry insights and experience to deliver solutions that fulfill our clients’ digital visions. We offer a continuum of services, specializing in strategy, transformation, and managed services across application development, data, enterprise platforms, cloud and infrastructure, and cybersecurity. Through our ability to innovate alongside our customers, we build and deploy the right artificial intelligence solutions to realize business value and improve customer experiences. Our alliances with cutting-edge technology partners empower our customers by providing them with the latest advancements. Apex has a presence in over 70 markets across North America, Europe, and India. Apex is a part of the commercial segment of ASGN Incorporated (NYSE: ASGN). To learn more, visit www.apexsystems.com. Apex strives to provide our talent with the best possible experience, from start to finish. Our commitment to excellence is reflected in many awards, including ClearlyRated's Best of Staffing® in Talent Satisfaction in the United States and Great Place to Work® in the United Kingdom and Mexico. Visit us today to join our team: www.apexsystems.com/careers.

CenturyLink

centurylink.com

CenturyLink (NYSE: CTL) is a technology leader delivering hybrid networking, cloud connectivity, and security solutions to customers around the world. Through its extensive global fiber network, CenturyLink provides secure and reliable services to meet the growing digital demands of businesses and consumers. CenturyLink strives to be the trusted connection to the networked world and is focused on delivering technology that enhances the customer experience. Learn more at http://news.centurylink.com/.

Orange Business

orange-business.com

At Orange Business, our ambition is to become the leading european Network and Digital Integrator by leveraging our proven expertise in next-generation connectivity solutions, the cloud and cybersecurity. Our 30,000 women and men are present in 65 countries, where every voice counts. Together, we are driven by the same determination and the same team spirit, to build the digital solutions of today and tomorrow and create a positive impact for our customers, for their employees and for the planet. We offer exciting opportunities through innovative projects in data and digital, cloud, AI, cybersecurity, IoT, or digital workspace and big data. Join us and be part of this adventure!

TELUS Digital

telusdigital.com

TELUS Digital crafts unique and enduring experiences for customers and employees, and creates future-focused digital transformations that stand the test of time. We are the brand behind the brands. Our global team members are both passionate ambassadors of our clients’ products and services, and visionary technology experts resolute in our pursuit to elevate their end customer journeys, solve business challenges, mitigate risks, and drive continuous innovation. Our portfolio of end-to-end, integrated capabilities include digital IT services, such as cloud solutions and AI-fueled automation, trust and safety services, AI data solutions, including expertise in computer vision, and front-end digital design and consulting services. Fuel iX™ is TELUS Digital’s proprietary GenAI engine at the heart of our innovation, helping enterprises advance their GenAI pilots to working prototypes and production at scale, quickly, securely and responsibly across multiple environments, applications and clouds. Powered by purpose, TELUS Digital leverages technology, human ingenuity and compassion to fuel remarkable outcomes and create inclusive, thriving communities in the regions where we operate around the world. Guided by our Humanity-in-the-loop principles, we take a responsible approach to the transformational technologies we develop and deploy by proactively considering and addressing the broader impacts of our work.

Inetum

inetum.com

Inetum is a European leader in digital services. Inetum’s team of 27,000 consultants and specialists strive every day to make a digital impact for businesses, public sector entities and society. Inetum’s solutions aim at contributing to its clients’ performance and innovation as well as the common good. Present in 19 countries with a dense network of sites, Inetum partners with major software publishers to meet the challenges of digital transformation with proximity and flexibility. Driven by its ambition for growth and scale, Inetum generated sales of 2.4 billion euros in 2024. 🏅 Top Employer Europe 2025

Loading…

NEWS

Oracle Security CyberSecurity News

Latest updates, reports, and threat intel affecting the global network.

December 30, 2025 08:00 AM

80 Hospitals May Have Been Affected by the Oracle Health Data Breach

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a security alert about the recently confirmed Oracle data breach.

Read Article

December 18, 2025 08:00 AM

Protect your Data with Oracle’s MAA and MSA (Part I)

Cyber Crime has been up 600% Since COVID-19. Is Your Data Secure? The Covid-19 pandemic affected the world in many ways, not the least of...

Read Article

December 02, 2025 08:00 AM

Penn investigating business software data breach affecting personal records

Penn is investigating a cybersecurity breach of its Oracle E-Business Suite servers that compromised the personal information of...

Read Article

November 24, 2025 08:00 AM

U.S. Cyber Agency Flags Critical Oracle Identity Manager Flaw Amid Evidence of Active Attacks

Read Article

November 24, 2025 08:00 AM

CISA Warns of Oracle’s Identity Manager RCE Vulnerability Actively Exploited in Attacks

The Cybersecurity and Infrastructure Security Agency (CISA) is urging organizations to immediately address a critical security flaw in...

Read Article

November 22, 2025 08:00 AM

CISA Warns of Actively Exploited Critical Oracle Identity Manager Zero-Day Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical security flaw impacting Oracle Identity Manager...

Read Article

November 20, 2025 08:00 AM

Lessons from Oracle E-Business Suite Hack That Allegedly Compromises Nearly 30 Organizations Worldwide

A sophisticated cyberattack targeting Oracle E-Business Suite (EBS) customers has exposed critical vulnerabilities in enterprise resource...

Read Article

November 14, 2025 08:00 AM

Cl0P Ransomware Group Allegedly Claims Breach of Entrust in Oracle 0-Day EBS Hack

The notorious Cl0P ransomware group has claimed responsibility for breaching digital security firm Entrust, exploiting a critical zero-day...

Read Article

November 13, 2025 08:00 AM

Read our guide to utility cybersecurity

Learn about the security challenges that water and power companies face and best practices for protecting their infrastructure against...

Read Article

Loading…

CVE

Latest

Global CVEs (Not Company-Specific)

CVE-2026-18556

SUMMARY

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

https://uptime.n-able.com/

CVE-2026-55735

SUMMARY

Improper Verification of Cryptographic Signature in ueberauth guardian allows an unauthenticated attacker to revoke a victim's session with a forged token. Guardian.revoke/3 in lib/guardian.ex decodes the supplied token with peek/1, which performs no signature verification (it only base64-decodes the JWT header and payload). The resulting unverified claims are forwarded directly to the configured token module's revoke callback and the implementation's on_revoke callback, a state-mutating sink. The sibling operations refresh/2 and exchange/4 both call decode_and_verify first, so the signature is checked before anything acts on the claims; revoke/3 is the only state-mutating path that acts on claims without verifying the signature. An attacker who knows or guesses a victim's identifying claim values (jti, sub) can forge a JWT carrying those claims, sign it with an arbitrary key, and submit it to any endpoint that funnels a caller-supplied token into Guardian.revoke/3 (the standard logout / session-revocation pattern). When the token module mutates state keyed by the claims (whitelist deletion or blacklist insertion, for example a GuardianDb-style store), the victim's legitimate session is evicted. This is an unauthenticated session-revocation denial of service; the attacker never needs the signing secret. This issue affects guardian: from 1.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 8.2

Complexity: LOW

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55734

SUMMARY

Allocation of Resources Without Limits or Throttling vulnerability in ueberauth guardian (Guardian.Permissions module) allows a denial of service via BEAM atom-table exhaustion. This vulnerability is associated with program file lib/guardian/permissions.ex and program routines 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2. The Guardian.Permissions mixin installs a public encode_permissions!/1 function on every module that does use Guardian.Permissions. For each key of the supplied map, encode_permissions!/1 calls String.to_atom(to_string(k)) before any validation runs. The integer-value clause of do_encode_permissions!/2 then short-circuits straight to encoding without validating the key against the configured permission set, so a key with an integer value is interned as a fresh atom with no exception raised. Atoms are never garbage collected and the BEAM atom table is a fixed-size resource (default roughly 1,048,576 entries), so each unique attacker-chosen key permanently consumes one slot. An attacker who can influence a permission map that reaches encode_permissions!/1 (for example a permissions map read from a request body and passed into token issuance via encode_permissions_into_claims!/2) can mint an unbounded number of atoms and exhaust the atom table, crashing the entire BEAM node and every service running on it. The sibling decode_permissions/1 is not affected because it skips keys absent from the configured permission set. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-55733

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-controlled binary input. Guardian.Permissions.AtomEncoding encodes permission scopes by passing arbitrary binaries to String.to_atom/1. When encode/3 in lib/guardian/permissions/atom_encoding.ex is called with a list, each binary entry is handled by the encode_value/3 binary clause, which calls String.to_atom(value) with no allow-list check. The perm_set argument (the application's small, finite set of legitimate permission names) is discarded, so any external string flows straight into atom creation. This encoder is selected with use Guardian.Permissions, encoding: Guardian.Permissions.AtomEncoding and reached through the imported encode/3 entry point. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that funnels attacker-influenced permission scopes (from a request body, a JWT claim, or other external input) into encode/3 therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node with system_limit, taking down every application running on it. The default encoder is Guardian.Permissions.BitwiseEncoding, which is not affected. This issue affects guardian: from 2.0.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

CVE-2026-54894

SUMMARY

Allocation of Resources Without Limits or Throttling in ueberauth guardian allows denial of service via unbounded atom creation from attacker-influenced binary input. Guardian.Plug.Keys derives connection and session namespace keys by passing arbitrary binaries to String.to_atom/1. base_key/1 in lib/guardian/plug/keys.ex converts any binary into the atom :"guardian_<input>", and the derived helpers claims_key/1, resource_key/1, and token_key/1 create a second atom on top of that. key_from_other/1 likewise converts a regex-captured binary through String.to_atom/1. The public specs advertise String.t() as a valid argument, so passing a string is documented usage, and higher-level entry points such as Guardian.Plug.current_token(conn, key: key) thread the caller-supplied key straight into these functions. String.to_atom/1 creates a brand-new atom for every previously unseen binary, atoms are never garbage collected, and the BEAM atom table is fixed at roughly 1,048,576 entries by default. An application that routes attacker-influenced data (a tenant identifier, header, or other request input) into a Guardian key therefore mints one permanent atom per distinct value. A modest stream of varied, unauthenticated input permanently consumes the atom table and crashes the BEAM node, taking down every application running on it. This issue affects guardian: from 0.1.0 before 2.4.1.

Published

Date2026-08-01

Updated

Date2026-08-01

RISK INFORMATION (Score: )

cvss4

Base Score: 6.9

Complexity: LOW

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact Score

Exploitability

REFERENCES

Loading…

API

Access Data Using Our API

Get company history

curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?
linkedin_id=axa' -H 'apikey: YOUR_API_KEY_HERE'

Try It API Documentation Rapid

MEASURE

What Do We Measure ?

Incident

Finding

Grade

Digital Assets

Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.

These are some of the factors we use to calculate the overall score:

Network SecurityIdentify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.

SBOM (Software Bill of Materials)Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.

CMDB (Configuration Management Database)Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.

Threat IntelligenceLeverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.

Rankiteo

By Rankiteo

★ ★ ★ ★ ★

View on G2.com

Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.

View latest plans →View all security reports →

MILESTONEG

Users
Love Us

Loading…