Full compromise of the Oracle Human Resources module (Data Removal Tool component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a high-privileged attacker with HTTP network access, resulting in complete takeover of the Human Resources application with confidentiality, integrity, and availability impact. Disclosed in Oracle's July 2026 Critical Patch Update (CVSS 3.1 base 7.2), the flaw requires existing elevated privileges (PR:H) but no user interaction and has low attack complexity. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Lease and Finance Management (versions 12.2.14 through 12.2.15), a module of Oracle E-Business Suite's Internal Operations component, is possible for a network-based attacker who already holds high application privileges. Oracle rates this CVSS 3.1 7.2 with high confidentiality, integrity, and availability impact, describing successful attacks as resulting in complete takeover of the module. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the modest EPSS-relevant profile is consistent with the high-privilege precondition limiting mass exploitation.
Full compromise of Oracle EDI Gateway (a module of Oracle E-Business Suite) is possible where a high-privileged, authenticated attacker with HTTP network access can achieve complete takeover of the component, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, affecting EBS versions 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Full compromise of Oracle Order Management (part of Oracle E-Business Suite) is possible via the Product Diagnostic Tools component in supported releases 12.2.3 through 12.2.15, where an authenticated high-privileged user with HTTP network access can achieve a complete takeover of the module with confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix is delivered in the Oracle Critical Patch Update of July 2026.
Full compromise of the Oracle Applications DBA component (Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible for an authenticated, high-privileged attacker with HTTP network access, resulting in complete takeover with high confidentiality, integrity, and availability impact. Rated CVSS 3.1 7.2 (High) by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Takeover of MySQL Server and MySQL Cluster is possible through the Server: Replication component, where a high-privileged attacker with network access can fully compromise affected instances. This authenticated flaw affects MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1, and is fixed in Oracle's July 2026 Critical Patch Update. Oracle rates it CVSS 7.2 with full confidentiality, integrity and availability impact; no public exploit identified at time of analysis.
Full compromise (takeover) of Oracle PeopleSoft Enterprise FIN Billing Argentina 9.1 is possible by a high-privileged attacker with network access over HTTP, per Oracle's July 2026 Critical Patch Update. Successful attacks yield complete confidentiality, integrity, and availability loss of the Billing component. No public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle rates the attack complexity as low (easily exploitable) once the required privileges are held.
Full product takeover in Oracle Advanced Supply Chain Planning (Core component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows an already high-privileged attacker with HTTP network access to fully compromise the module's confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 7.2 and describes it as easily exploitable once the required elevated privileges are held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle has addressed it in the July 2026 Critical Patch Update.
Full compromise of the Oracle Financials for the Americas module within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) is possible via HTTP by an attacker who already holds high application privileges, leading to complete takeover of the module's confidentiality, integrity, and availability. Oracle rates it CVSS 7.2 and describes it as 'easily exploitable' once the privilege prerequisite is met. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the sole reference is the Oracle July 2026 Critical Patch Update advisory.
Full compromise of Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) is possible in versions 12.2.3 through 12.2.15, where a high-privileged attacker with network HTTP access can achieve complete takeover of the module with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and addressed it in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-priority issue driven by the total-takeover impact rather than by confirmed in-the-wild activity.
Full compromise of Oracle Interaction Blending, a telephony/campaign-routing module within Oracle E-Business Suite (Internal Operations component), is possible by a high-privileged attacker sending crafted HTTP requests over the network. Oracle rates successful exploitation as a complete takeover of the component with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the fix ships in Oracle's July 2026 Critical Patch Update.
Full takeover of the Oracle Trading Community module in Oracle E-Business Suite (versions 12.2.3 through 12.2.12) is achievable by a high-privileged, authenticated attacker sending crafted HTTP requests to the Party Search UI component. Because the CVSS vector reports high impact to confidentiality, integrity, and availability (C:H/I:H/A:H), a successful attack yields complete compromise of the Trading Community application rather than mere data leakage. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Full compromise of Oracle WebCenter Content (Fusion Middleware, Web Content Management component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged attacker with HTTP network access can escalate to complete takeover of the product with confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable, though it requires existing high privileges. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a fix ships in the Oracle Critical Patch Update of July 2026.
Privilege-based takeover in Oracle Enterprise Command Center Framework V16, a component of Oracle E-Business Suite (Core), allows a high-privileged attacker with HTTP network access to fully compromise the framework. Successful exploitation results in complete takeover with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the flaw is addressed in the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle SOA Suite (Oracle Fusion Middleware) is possible via the Integration Business Insight component in versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged, authenticated attacker with HTTP network access can achieve complete takeover of the product with high confidentiality, integrity, and availability impact. Addressed in the Oracle Critical Patch Update of July 2026, this issue carries a CVSS 3.1 base score of 7.2. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the 'easily exploitable' language from Oracle (reflected as AC:L) makes prompt patching prudent for exposed instances.
Full server takeover of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 is possible via the administration Console component, where a high-privileged attacker with HTTP network access can fully compromise confidentiality, integrity, and availability. Rated CVSS 3.1 7.2, this is part of Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Takeover of Oracle Unified Directory is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 (OUD Core component), where a high-privileged attacker with network access via LDAP can fully compromise the directory service. Oracle rates this CVSS 7.2 with high confidentiality, integrity, and availability impact, and describes it as 'easily exploitable' once the required privileges are held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is gated primarily by the authentication requirement.
Full compromise of Oracle WebCenter Content: Imaging (Core component) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged attacker with network access over the T3 or IIOP protocols can take over the Imaging application entirely (CVSS 3.1 7.2, high confidentiality, integrity and availability impact). Fixes are delivered in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Full compromise of Oracle WebCenter Content: Imaging (Core component) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged attacker with network access over HTTP can take over the Imaging service, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N) yields a 7.2 base score with high confidentiality, integrity, and availability impact, meaning the attacker gains complete control of the product. No public exploit is identified at time of analysis and the flaw is not listed in CISA KEV, though the vendor tags it under Information Disclosure.
Full compromise of Oracle JDeveloper (Oracle Fusion Middleware) is possible via the ADF Shared Components subcomponent, allowing an authenticated high-privileged attacker with HTTP network access to take over the product with high confidentiality, integrity, and availability impact. It affects supported versions 12.2.1.4.0 and 14.1.2.0.0, is disclosed in Oracle's July 2026 Critical Patch Update, and carries a CVSS 3.1 base score of 7.2. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full server takeover of Oracle WebLogic Server (Fusion Middleware, Console component) is achievable by an already-authenticated high-privileged attacker reaching the management Console over HTTPS. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, and successful exploitation yields complete compromise of confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it is addressed in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle Human Resources (part of Oracle E-Business Suite) is possible via the Data Removal Tool component, where a high-privileged attacker with HTTP network access can take over the module across supported releases 12.2.3 through 12.2.15. The flaw carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, and Oracle classifies it as easily exploitable. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege-to-RCE escalation in HPE Aruba Networking AOS-CX switch operating system allows an authenticated, high-privileged administrator to abuse a path traversal flaw in the CLI to copy arbitrary files from the underlying OS into a user-readable location, which can be leveraged to achieve remote code execution. The weakness affects the switch management CLI and requires existing administrative access; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is high across confidentiality, integrity, and availability because it breaks the boundary between the constrained CLI and the underlying operating system.
Full takeover of Oracle MySQL Server and MySQL Cluster is possible through the Server: X Plugin component, allowing a high-privileged attacker with network access via multiple protocols to compromise confidentiality, integrity, and availability. Affected builds include MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, plus MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list, though Oracle rates it as easily exploitable once the required high privileges are held.
Full compromise of Oracle Property Manager (a module of Oracle E-Business Suite) is possible for a high-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. Affecting EBS releases 12.2.3 through 12.2.15, successful exploitation yields complete takeover of the Property Manager component with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though Oracle rates it easily exploitable once the required privileges are held.
Authenticated remote code execution affects the command-line interface of HPE Aruba Networking AOS-CX, the network operating system running on Aruba CX-series switches. Multiple buffer overflow flaws in the CLI let a high-privileged operator break out of the managed shell and run arbitrary code as a privileged user on the underlying operating system, converting administrative CLI access into full control of the switch OS. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS data was not provided.
Full compromise of the Oracle HRMS (US) module within Oracle E-Business Suite is achievable by a high-privileged attacker over HTTP against the Internal Operations component, affecting supported releases 12.2.3 through 12.2.15. A successful attack yields complete takeover of the HRMS (US) subsystem with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Oracle's internal security alert channel and fixed in the July 2026 Critical Patch Update.
Full compromise of the Oracle Process Manufacturing Systems module in Oracle E-Business Suite 12.2.11 through 12.2.15 is achievable by a high-privileged, authenticated attacker sending crafted HTTP requests to the Internal Operations component. Successful exploitation yields complete takeover of the Process Manufacturing Systems application with high confidentiality, integrity, and availability impact (CVSS 7.2). No public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Cost Management (Inventory Costing component) in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by an authenticated high-privileged attacker sending crafted HTTP requests over the network. Successful exploitation compromises confidentiality, integrity, and availability of the module, carrying a CVSS 3.1 base score of 7.2. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, though it was reported and fixed by Oracle in the July 2026 Critical Patch Update.
Full compromise of the Oracle HCM Common Architecture module (Internal Operations component) within Oracle E-Business Suite is possible, allowing an attacker who already holds high-level application privileges to take over the module over the network via HTTP. The flaw affects EBS releases 12.2.3 through 12.2.15 and carries a CVSS 3.1 score of 7.2 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' for an authenticated actor.
Full takeover of Oracle iStore (the Oracle E-Business Suite customer-facing web storefront) is possible via its Shopping Cart component in releases 12.2.3 through 12.2.15, where a high-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability. Oracle rates this CVSS 3.1 7.2 and shipped a fix in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Receivables (the accounts-receivable module of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible via the Internal Operations component, where an authenticated attacker holding high privileges can send crafted HTTP requests to take over the module. Oracle rates this CVSS 7.2 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' but exploitation is gated behind existing high-privilege access. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Assets (part of Oracle E-Business Suite, Internal Operations component) is achievable by a high-privileged, network-adjacent attacker over HTTP, per the Oracle July 2026 Critical Patch Update. With a CVSS 3.1 base score of 7.2 (C:H/I:H/A:H) and no user interaction required, successful exploitation results in complete takeover of Oracle Assets across supported releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-based takeover of Oracle Unified Directory (OUD Core) affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a high-privileged attacker with LDAP network access can fully compromise the directory service. Successful exploitation yields complete takeover with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). No public exploit identified at time of analysis; addressed in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle GoldenGate is possible in versions 21.3-21.21 and 23.4-23.26.1 through the Distribution Server executable, where a high-privileged attacker reaching the server over HTTPS can fully compromise confidentiality, integrity, and availability. The flaw carries a CVSS 3.1 base score of 7.2 and requires existing elevated privileges rather than anonymous access, so it is best characterized as a privileged-user-to-full-compromise escalation within the GoldenGate management plane. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Project Costing (part of Oracle E-Business Suite) is possible via the Enterprise Command Center component, where a high-privileged, network-authenticated attacker sending HTTP requests can compromise confidentiality, integrity, and availability of the module. Affected releases span EBS 12.2.3 through 12.2.15, and Oracle rates the flaw CVSS 3.1 7.2 while noting it is 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but a fix is delivered in the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content is possible via the Content Server component in Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0, where an attacker holding high privileges can send crafted HTTP requests to take over the product with confidentiality, integrity, and availability impact. Oracle rates the flaw CVSS 3.1 7.2 and describes it as easily exploitable once the required privilege level is held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the addressing of it in Oracle's July 2026 Critical Patch Update signals vendor-confirmed severity.
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through the Self Update Framework component, where an authenticated high-privileged attacker reaching the console over HTTPS can compromise the confidentiality, integrity and availability of the entire management platform. Oracle rates it CVSS 3.1 7.2 and describes it as easily exploitable once the required privileges are held. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of the Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible through its Self Update Framework component, allowing an already high-privileged, authenticated attacker with network/HTTPS access to escalate to complete takeover of the platform with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because Enterprise Manager centrally administers large Oracle estates, a takeover here is a high-value pivot despite the elevated privilege prerequisite.
Full takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is possible via the Connector Framework component, allowing an attacker who already holds high privileges to fully compromise confidentiality, integrity, and availability over the network via HTTPS. Oracle rates this CVSS 7.2 and, despite the 'Information Disclosure' tag, the described impact is complete product takeover (C:H/I:H/A:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Filesystem access in the web-based management interface of HPE EdgeConnect SD-WAN Gateway (ECOS) allows an authenticated, highly privileged remote administrator to reach the underlying device filesystem beyond the intended management scope. Once exploited, an attacker can read sensitive files and tamper with or delete system data, undermining the confidentiality, integrity, and availability of the gateway. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it is a vendor-reported (HPE) information-disclosure and data-tampering flaw with a CVSS base score of 7.2.
Unauthenticated network compromise of Oracle Utilities Network Management System (Mobile component) allows remote attackers to gain partial read access and partial write (insert/update/delete) access to NMS-accessible data over HTTP, with a scope change that can significantly impact adjacent products. Oracle tags this as an Authentication Bypass and rates it CVSS 7.2; no public exploit was identified at time of analysis, and it is not listed in CISA KEV. Affected releases span the 2.5.x, 2.6.x, and 25.12.x branches, fixed in the Oracle Critical Patch Update of July 2026.
Privilege escalation with scope change in Oracle Coherence (Oracle Fusion Middleware Core component) lets a low-privileged attacker with local logon access compromise the confidentiality and integrity of all Coherence-accessible data and impact additional products beyond Coherence itself. Oracle rates it CVSS 3.1 7.2, but the attack is hard to execute: it requires an existing account, high attack complexity, and human interaction from a separate victim. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the fix ships in Oracle's July 2026 Critical Patch Update.
Cross-job-group log disclosure in XXL-Job 2.4.2 lets an authenticated low-privilege user read execution log content belonging to job groups they have no rights to, by calling the logDetailCat endpoint with incremented sequential logId values. The flaw is an insecure direct object reference (IDOR): logDetailCat omits the authorization check that its sibling logDetailPage endpoint enforces, so any logged-in account can enumerate and harvest sensitive log output across the entire scheduler. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sensitive data disclosure in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component) lets a low-privileged, network-based attacker read or fully access all data the application can reach and cause a partial denial of service over HTTP. Oracle rates it CVSS 3.1 7.1 and describes it as easily exploitable, though it requires an existing low-level account (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.
Sensitive-data disclosure and partial denial of service in Oracle Payments (Oracle E-Business Suite File Transmission component, versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read all Oracle Payments-accessible data and partially disrupt the service. Oracle rates it CVSS 3.1 7.1 (C:H/A:L), and intelligence tags flag an authentication-bypass characteristic, though the CVSS vector confirms some privilege is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial-of-service and information disclosure in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) lets a low-privileged, network-adjacent attacker send crafted HTTP requests to hang or repeatedly crash the service (complete DoS) and read a subset of accessible data. The flaw is rated CVSS 3.1 7.1 and was disclosed by Oracle in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle characterizes it as easily exploitable.
Denial-of-service and information disclosure in Oracle JD Edwards EnterpriseOne HCM Foundation 9.2 (OW HR PR Foundation component) allows a low-privileged, authenticated attacker with network/HTTP access to hang or repeatedly crash the application (complete DoS) and read a subset of accessible data. Oracle rates it CVSS 3.1 7.1 and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.
Data tampering and partial denial of service in Oracle HRMS (UK) - the UK Payroll component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 - lets a low-privileged, authenticated attacker with HTTP network access create, modify or delete critical HRMS data and partially degrade the service. Oracle rates it CVSS 3.1 7.1 and describes it as 'easily exploitable' (AC:L), meaning any account holder on the EBS instance can abuse it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical rather than observed.
Data tampering and partial denial of service in Oracle Time and Labor (Oracle E-Business Suite 12.2.3-12.2.15, Internal Operations component) allows a low-privileged, network-authenticated attacker to create, delete, or modify all Time and Labor accessible data and partially disrupt the service over HTTP. The CVSS 3.1 base score is 7.1 (I:H/A:L, no confidentiality impact), reflecting an integrity-focused flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.