CVE-2012-1710: Oracle Fusion Middleware Unspecified Vulnerability

Patch now

CRITICAL 9.8EXPLOITEDREMOTEDOWNGRADE

CVE-2012-1710 is a critical-severity flaw (CVSS 9.8) affecting fusion middleware, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Designer, a different vulnerability than CVE-2012-1709.

Why this priority

Critical severity
EPSS top 5%: very likely to be exploited
Exploited in the wild (CISA KEV)
Used in ransomware campaigns
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	7.8% (top 5%)
CISA exploited list	Yes, fix due 2022-06-15, used in ransomware
Published	2012-05-03
Last modified	2026-10-01

Publisher (CNA): Oracle · Vendor: oracle

Last updated 2026-10-01 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2012-05-03 22:55 UTCPublished CVE record published
2022-05-25Exploited Added to the CISA Known Exploited Vulnerabilities list
2022-06-15Deadline CISA due date for US federal agencies to patch
2026-10-01 20:17 UTCUpdated Record last modified

oracle fusion middleware DOWNGRADE

Affected: 10.1.3.5

Fixed in: no fixed release known

Safe to downgrade to: a release before 10.1.3.5

1. Check installed version

apt-cache policy fusion-middleware || rpm -q fusion-middleware || fusion-middleware --version

2. No fixed release: DOWNGRADE to a release before 10.1.3.5 (Debian / Ubuntu)

apt-cache madison fusion-middleware sudo apt install fusion-middleware=<VERSION_BEFORE_10.1.3.5> sudo apt-mark hold fusion-middleware

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list fusion-middleware sudo dnf downgrade fusion-middleware-<VERSION_BEFORE_10.1.3.5> sudo dnf versionlock add fusion-middleware

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

A distro patch exists: prefer upgrading over downgrading.

Fedora 46 · dupeguru · FIXED · 4.3.1^20261101git7a2c79f-1.fc46 · FEDORA-2026-fe4523382c · source

sudo dnf upgrade --advisory=FEDORA-2026-fe4523382c

Fedora ELN · openexr · FIXED · 3.4.13-3.eln159 · FEDORA-2026-827a613db5 · source

sudo dnf upgrade --advisory=FEDORA-2026-827a613db5

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2012-1710?

fusion middleware: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2012-1710 being exploited?

Yes. CVE-2012-1710 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2012-1710 affect?

CVE-2012-1710 affects fusion middleware. Severity is critical (CVSS 9.8). Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Designer, a dif

How urgent is CVE-2012-1710?

Priority 93/100. Critical severity; EPSS top 5%: very likely to be exploited; Exploited in the wild (CISA KEV); Used in ransomware campaigns; Remotely exploitable, no login, no user action

Related CVEs

CVE-2026-35232 MEDIUM 5.4 DOWNGRADE Vulnerability in Oracle Fusion Middleware (component: Dynamic Monitoring Service)
CVE-2026-35252 MEDIUM 6.4 DOWNGRADE Vulnerability in the Oracle Security Service product of Oracle Fusion Middleware (component: C Oracle SSL API)
CVE-2018-1305 MEDIUM 6.5 UPGRADE MITIGATE Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8
CVE-2018-1304 MEDIUM 5.9 UPGRADE DOWNGRADE The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in A
CVE-2024-21215 HIGH 7.5 DOWNGRADE Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core)

References

← Back to latest CVEs