Full takeover of Oracle iSupport (E-Business Suite versions 12.2.3-12.2.15) is achievable by a highly privileged remote attacker exploiting a flaw in the Internal Operations component via HTTP, resulting in complete compromise of confidentiality, integrity, and availability. The CVSS 3.1 base score of 6.6 reflects the severity of the impact offset by high attack complexity and high privilege requirements, which meaningfully constrain the exploitable attacker population. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, making this a significant but operationally constrained risk for Oracle EBS deployments.
Full system takeover is possible in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 via the Research Tracking component, exploitable over HTTP by a high-privileged network attacker under high-complexity conditions. Successful exploitation yields complete compromise of confidentiality, integrity, and availability - effectively granting an attacker control over the affected instance. No public exploit code exists and the vulnerability is not listed in CISA KEV; Oracle disclosed this through its Critical Patch Update for July 2026.
Full takeover of Oracle MySQL Server and MySQL Cluster is achievable through the Server: Replication component by a highly privileged network attacker who can satisfy difficult exploitation conditions. Affected deployments include MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, with complete confidentiality, integrity, and availability impact upon successful exploitation. Oracle disclosed this through the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Full takeover of MySQL Server and MySQL Cluster is possible through a difficult-to-exploit vulnerability in the Clone Plugin component, requiring a high-privileged attacker with network access via multiple protocols. Affected are MySQL Server versions 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster versions 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code or CISA KEV listing has been identified at time of analysis; risk is tempered by the AC:H/PR:H exploitation prerequisites, though the full CIA:H/H/H impact warrants priority patching in environments using the Clone Plugin.
Full takeover of Oracle Universal Work Queue (versions 12.2.3 through 12.2.15) is achievable by a network-authenticated attacker with high administrative privileges exploiting a flaw in the Work Provider Site Level Administration component via HTTP. Despite requiring elevated credentials and high attack complexity, successful exploitation yields complete confidentiality, integrity, and availability compromise - effectively full system takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, and Oracle disclosed this through their July 2026 Critical Patch Update.
Oracle Time and Labor (Internal Operations component) in E-Business Suite versions 12.2.3 through 12.2.15 exposes a difficult-to-exploit flaw that allows a high-privileged, network-authenticated attacker operating over HTTP to gain complete read access to all Time and Labor data and limited write access (insert, update, delete), with scope change implications affecting additional Oracle EBS components. Tagged as an authentication bypass by ENISA EUVD intelligence, this conflict with the CVSS PR:H requirement warrants investigative scrutiny - it may indicate a secondary authorization bypass rather than a full authentication bypass. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
Oracle Production Scheduling (versions 12.2.3 through 12.2.15) contains a high-privilege network-exploitable flaw in its Internal Operations component that allows authorized but potentially abusive HTTP requests to bypass internal controls and achieve unauthorized creation, deletion, or modification of critical data, with a documented scope change that can cascade impact into adjacent Oracle E-Business Suite products. The vulnerability is tagged as an Authentication Bypass by both the Oracle reporter (secalert_us@oracle.com) and ENISA EUVD-2026-47260, introducing meaningful ambiguity against the CVSS PR:H designation. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the standard CPU patching priority tier despite the scope change.
Oracle HRMS (US), the Internal Operations component within Oracle E-Business Suite versions 12.2.9 through 12.2.15, is exploitable by low-privileged users with local logon access to the host infrastructure. Successful exploitation enables a repeatable denial of service via process hang or crash, along with unauthorized read access to a subset of HR data and limited unauthorized data modification. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis; Oracle issued a fix in the July 2026 Critical Patch Update.
Cross-origin resource sharing controls in Netty's CorsHandler can be entirely bypassed by sending an `Origin: null` header, due to a logical operator error in the origin evaluation path. Affected are Netty 4.1.0.Final through 4.1.135.Final and 4.2.0.Final through 4.2.15.Final - a range spanning years of releases across both major active branches. An unauthenticated remote attacker who can induce a victim to initiate a cross-origin request can bypass the `shortCircuit()` enforcement entirely, causing unauthorized requests to be forwarded to the backend application as if they were permitted. No public exploit or KEV listing is identified at time of analysis, but the bypass mechanism is straightforward and vendor-confirmed.
Memory exhaustion in libssh's SFTP server subsystem allows authenticated remote clients to degrade or crash the service by sending SSH_FXP_READ requests specifying an arbitrarily large read length, causing the server to allocate unbounded memory for each request. The CVSS vector (PR:L) confirms exploitation requires valid credentials, limiting the attack surface to authenticated SFTP users. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low complexity and network-accessible attack path make this a realistic insider or credential-abuse scenario.
CPU exhaustion via malformed SSH channel negotiation in libssh allows an authenticated remote peer to cause indefinite server-side looping and denial of service. By advertising a zero maximum packet size in SSH_MSG_CHANNEL_OPEN, the attacker forces subsequent channel writes into an infinite loop, fully consuming CPU on the affected host. This affects libssh as shipped in Red Hat Enterprise Linux 8, 9, and 10 and Red Hat Hardened Images; no public exploit or CISA KEV listing has been identified at time of analysis.
Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged, network-connected attacker to repeatedly hang or crash the database server by exploiting a flaw in the JSON component. The vulnerability requires only a valid MySQL login and network access over any supported protocol, making it trivially reachable in multi-tenant or cloud-hosted environments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and low privilege threshold elevate practical risk above what the moderate CVSS score of 6.5 might suggest.
Denial-of-service in Oracle Agile Engineering Data Management 6.2.1 allows a low-privileged network attacker to cause a complete hang or repeatedly crash the Core component via TCP, fully disrupting availability. The vulnerability is rated CVSS 6.5 (Medium) with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis; this appears to be a vendor-disclosed issue addressed in the Oracle Critical Patch Update for July 2026.
Denial-of-service in Oracle Agile Engineering Data Management 6.2.1 allows any low-privileged network user to crash or hang the application via crafted TCP traffic to the Core component. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms this is easily exploitable with minimal prerequisites, resulting in complete availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity raises automated exploitation concerns.
Denial of service in Oracle MySQL Server and MySQL Cluster's JSON component allows a low-privileged, network-authenticated attacker to cause a complete hang or frequently repeatable crash of the database server. Affected releases span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, as well as MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, though the low attack complexity and low privilege requirement make it straightforward to trigger once database credentials are obtained.
Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged network attacker to repeatedly crash or hang the database server via a flaw in the Optimizer component. Oracle classifies this as 'easily exploitable' with network access required over multiple protocols, meaning any valid database account holder can trigger the condition without elevated permissions. No public exploit code or active exploitation has been identified at time of analysis.
Denial-of-service in Oracle TimesTen In-Memory Database 26.1.1.1.0 allows low-privileged remote attackers to crash or hang the database via crafted HTTPS requests to the Kubernetes Operator component. The vulnerability is network-accessible with low complexity, requiring only low-level credentials, and results in complete availability loss with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle has disclosed this through the July 2026 Critical Patch Update.
Denial of service in Oracle Coherence's Core component allows a low-privileged network attacker to crash or indefinitely hang affected instances across four active release branches via crafted TCP communication. The attack requires no user interaction and only low privileges, making it a realistic and automatable threat for any enterprise environment where Coherence cluster ports are reachable by authenticated or low-privileged users. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Oracle's own assessment rates this as network-accessible with low complexity.
Denial-of-service via the Optimizer component in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows a low-privileged, network-authenticated attacker to cause a complete, repeatable hang or crash of the database service. The flaw is network-reachable over multiple protocols and requires no user interaction, making it straightforward to trigger by any user holding even minimal database credentials. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this in the Critical Patch Update for July 2026.
Oracle Scripting within E-Business Suite (versions 12.2.3 through 12.2.15) allows a high-privileged attacker with HTTP network access to fully compromise data confidentiality and integrity in the Internal Operations component. Despite the PR:H CVSS rating, the 'Authentication Bypass' tag raises concern that effective access controls may be circumventable, potentially lowering the real exploitation barrier below what the score implies. No public exploit or CISA KEV listing has been identified at time of analysis, but the July 2026 Oracle CPU advisory confirms the issue and remediation is available.
Critical data exposure and tampering in Oracle Citizen Interaction Center (E-Business Suite component) versions 12.2.3 through 12.2.15 allows a high-privileged, network-authenticated attacker to achieve full read and write access to all application data via HTTP. Despite the 'Authentication Bypass' tag, the CVSS PR:H metric indicates exploitation requires an already-authenticated high-privilege account, suggesting an internal authorization control bypass rather than an unauthenticated entry point. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was disclosed through Oracle's Critical Patch Update for July 2026.
Critical data exposure and unauthorized modification in Oracle Transportation Management 6.5.3 allows a high-privileged network attacker to fully compromise the confidentiality and integrity of all data accessible within the platform. The vulnerability resides in the Integration component, accessible over HTTP, and enables complete read and write access to sensitive supply chain data including shipment records, carrier contracts, and operational logistics data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 'Authentication Bypass' tag alongside PR:H CVSS metrics suggests an authorization bypass rather than a full authentication bypass - warranting close review of privileged account hygiene.
Oracle Cost Management V16 (Enterprise Command Center component) exposes critical data to compromise by network-accessible, high-privileged attackers over HTTP. Successful exploitation grants unauthorized read access to all accessible data and the ability to create, delete, or modify critical records within the application - a dual confidentiality and integrity impact. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, though it was disclosed as part of Oracle's CPU July 2026 advisory cycle.
Unauthorized read access to all data within Oracle Public Sector Financials (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged attacker over HTTP, requiring no user interaction and no elevated privileges beyond a basic network account. The Internal Operations component fails to enforce appropriate access controls, enabling complete confidentiality compromise of government financial records. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, though the 'Authentication Bypass' tag in available intelligence suggests the flaw may involve bypassing intra-application authorization rather than authentication itself.
Unauthorized data access in Oracle Advanced Benefits 12.2.15 can be achieved by any low-privileged authenticated attacker over HTTP, targeting the Internal Operations component of Oracle E-Business Suite. The flaw - tagged as an Authentication Bypass - permits complete read access to all data accessible within the module, including data classified as critical. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and absence of required user interaction make it straightforward to exploit once credentials are obtained.
Unauthorized payroll data exposure in Oracle E-Business Suite's HRMS (Australia) Payroll component allows a low-privileged, network-authenticated attacker to access all HR and payroll data accessible to the application. Affecting versions 12.2.3 through 12.2.15, Oracle classifies this as 'easily exploitable' in the July 2026 Critical Patch Update, requiring only low user privileges over HTTP with no user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, though the confidentiality impact against sensitive payroll records elevates practical priority for affected Australian EBS deployments.
Unauthorized data disclosure in Oracle Learning Management (E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to access critical or complete LMS data via the Import and Export component over HTTP. Tagged as an Authentication Bypass, the flaw enables privilege escalation beyond the attacker's granted access level, resulting in full confidentiality compromise of all Learning Management accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network vector make this straightforward to exploit once credentials are obtained.
Unauthorized data disclosure in Oracle Order Management's Product Diagnostic Tools component (E-Business Suite 12.2.3-12.2.15) allows a low-privileged network attacker to read all data accessible to the application over HTTP with no user interaction required. The 'Authentication Bypass' tag suggests the diagnostic interface fails to enforce proper authorization boundaries, enabling a minimally privileged account to exceed its intended data access scope. No public exploit has been identified at time of analysis, but the low attack complexity and ERP-grade data sensitivity - order records, customer PII, financial data - elevate business impact well beyond the moderate CVSS 6.5 score.
Unauthorized data disclosure in Oracle Price Protection (E-Business Suite versions 12.2.3 through 12.2.15) allows a network-adjacent, low-privileged attacker to gain complete read access to all pricing data accessible by the application. The vulnerability resides in the Internal Operations component and is tagged as an Authentication Bypass, suggesting that a legitimately authenticated but low-privileged session can circumvent authorization controls to reach confidential pricing records. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network reachability make it straightforward to exploit once credentials are obtained.
Unauthorized data disclosure in Oracle BI Publisher's XML Services component allows any low-privileged, network-authenticated attacker to access all data within the application via HTTP. Affected across three major release lines - 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 - the flaw carries a CVSS 3.1 score of 6.5 with high confidentiality impact and no integrity or availability dimension. The 'Authentication Bypass' tag suggests the vulnerability enables privilege escalation within the product's authorization model rather than a full pre-auth bypass; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthorized data access in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows a low-privileged authenticated attacker to read all data accessible within the system via HTTPS against the Communication component. Tagged as an Authentication Bypass by EUVD intelligence, the flaw appears to operate at the authorization layer - an attacker with a valid low-privilege session can exceed their permitted data scope rather than bypass authentication entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network accessibility make this a credible insider or credential-theft-follow-on threat for higher education environments.
Unauthorized read access to all WebCenter Sites data is achievable by unauthenticated remote attackers via HTTP against Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 - two currently supported versions of Oracle Fusion Middleware's web content management component. The vulnerability is tagged as an Authentication Bypass requiring one-time victim interaction (UI:R), suggesting an attacker-controlled HTTP trigger that a legitimate user must initiate (e.g., by visiting a crafted URL or link), after which the attacker gains complete confidentiality access to all CMS data. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Unauthorized data exposure in Oracle Agile PLM 9.3.6 allows a remote unauthenticated attacker to compromise the confidentiality of all PLM-accessible data via HTTP, provided human interaction from a victim user is achieved. The vulnerability resides in the Folders, Files & Attachments component and is tagged as an Authentication Bypass, meaning access controls protecting sensitive product lifecycle and supply chain data can be circumvented without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero privilege requirement make this a meaningful risk for Oracle Agile PLM deployments exposed to untrusted networks.
Denial-of-service in MySQL Connector/J 9.7.0-9.7.1 allows an unauthenticated remote attacker to crash or indefinitely hang the connector process via multiple protocols, contingent on human interaction from a victim. Oracle disclosed this in the July 2026 Critical Patch Update (CPU), rating it CVSS 6.5. No public exploit code and no CISA KEV listing have been identified at time of analysis, suggesting risk is currently theoretical rather than actively weaponized.
MySQL Server and MySQL Cluster versions 9.0.0 through 9.7.1 are vulnerable to a network-reachable denial-of-service condition in the query Optimizer component, exploitable by any low-privileged authenticated user. A successful attack causes a complete, repeatable hang or crash of the database server process, disrupting all connected clients. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Denial of service in Oracle Coherence's Core component allows a low-privileged network attacker to cause a hang or repeatable crash of the service via TCP, affecting all four currently supported release lines (12.2.1.4.0 through 15.1.1.0.0). Oracle classifies this as easily exploitable - low attack complexity and no user interaction required - making it accessible to any authenticated user with TCP connectivity to the cluster. No public exploit has been identified at time of analysis, and Oracle disclosed this through its July 2026 Critical Patch Update; the CVE is not listed in CISA KEV.
Integrity compromise in Oracle Database Server's embedded Java VM component allows network-connected attackers holding only the Create Session privilege to arbitrarily create, delete, or modify critical data or all Java VM-accessible data within the database. All three actively supported release lines are affected - 19.3 through 19.31, 21.3 through 21.22, and 23.4.0 through 23.26.2 - as confirmed in Oracle's July 2026 Critical Patch Update. Oracle explicitly characterizes this as 'easily exploitable,' and no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial-of-service and partial data integrity compromise in Oracle Coherence's Core component allows unauthenticated network attackers to hang or crash the service or manipulate a subset of accessible data via HTTP. Affected are three actively supported versions - 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - spanning the current Oracle Fusion Middleware release train. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the zero-confidentiality-impact, high-availability-impact profile is consistent with a resource exhaustion or malformed-request crash class of flaw that may attract opportunistic targeting of exposed Coherence cluster endpoints.
Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows any low-privileged, network-authenticated attacker to cause a complete, repeatable crash or hang of the database server via the GIS (Geographic Information System) component. Oracle confirmed this in the July 2026 Critical Patch Update with a CVSS 3.1 score of 6.5. No public exploit code or active exploitation has been identified at time of analysis.
Denial-of-service in Oracle TimesTen In-Memory Database 26.1.1.1.0 via the Kubernetes Operator component allows a low-privileged, network-authenticated attacker to repeatedly crash or hang the database over HTTPS. The attack is classified as easily exploitable with low complexity and no user interaction required, making it a straightforward availability threat in Kubernetes-managed deployments. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity elevates practical risk for environments where low-privileged accounts are broadly provisioned.
Denial-of-service conditions in Oracle GoldenGate's Receiver Service Executable allow a low-privileged attacker with HTTP network access to crash or indefinitely hang the replication service. Three major version lines are affected - 19.x, 21.x, and 23.x - covering a broad enterprise installed base. No public exploit code or active exploitation has been identified at time of analysis; risk is moderated by the low-privilege authentication requirement but elevated by low attack complexity and the business-critical role GoldenGate plays in continuous database replication pipelines.
Denial of service in Oracle MySQL Server and MySQL Cluster allows any low-privileged authenticated attacker with network access to hang or repeatably crash the database service by exploiting a flaw in the Optimizer component. Affected deployments span MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1, per Oracle's July 2026 Critical Patch Update. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the low attack complexity and minimal privilege requirement make this a credible availability risk for any deployment with externally or internally accessible database accounts.
Denial of service in Elasticsearch allows a low-privileged authenticated user to crash an Elasticsearch node by submitting a specially crafted EQL sequence query against an index they control, triggering uncontrolled memory consumption (CWE-400, CAPEC-130). Affected across all tracked versions per CPE wildcard, with Elastic releasing fixes in versions 8.19.18, 9.3.7, and 9.4.4 per advisory ESA-2026-57. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad Elasticsearch deployment footprint make this a credible internal threat in multi-tenant or shared cluster environments.
Denial of service in Kibana's Entity Analytics feature allows authenticated users to render the application unavailable by submitting oversized input values to affected API endpoints. The root cause is CWE-770 - absent resource allocation limits on specific Entity Analytics endpoints - enabling a single crafted request to trigger excessive memory or CPU consumption disproportionate to normal operation. No public exploit code has been identified at time of analysis, and the PR:L authentication requirement constrains opportunistic exploitation to credentialed actors.
Authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 exposes sensitive student and institutional data to unauthenticated remote attackers over HTTP. The Security component vulnerability allows a network-adjacent attacker to skip authentication controls and gain full read access to all Campus Community data, plus limited write access for inserts and deletes. No public exploit code exists and no CISA KEV listing has been observed, but the PR:N/C:H combination makes this a material confidentiality risk for higher education institutions running the affected version.
Oracle HRMS (US) Internal Operations component exposes complete HR dataset read access to any low-privileged authenticated attacker over HTTP. Versions 12.2.6 through 12.2.15 of Oracle E-Business Suite are confirmed affected, enabling an attacker holding even a basic EBS user account to bypass authorization controls and access all data visible to the HRMS application. No public exploit or CISA KEV listing exists at time of analysis, but the low attack complexity (AC:L) means exploitation is straightforward once initial credentials are obtained, making insider threat and credential-compromise scenarios the primary risk vector.
Unauthorized data disclosure in Oracle Self-Service Human Resources (E-Business Suite), Manager Self-Service component, affects versions 12.2.3 through 12.2.15. A low-privileged authenticated attacker with HTTP network access can exploit an authorization bypass to gain complete read access to all data within the Self-Service HR module - including sensitive employee and managerial records. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog, but the low attack complexity and broad data exposure make patching via the July 2026 CPU a priority for organizations running Oracle EBS.
Unauthorized data access in Oracle Payroll (E-Business Suite component) versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to read all Payroll-accessible data over HTTP. Tagged by intelligence sources as an Authentication Bypass, this flaw enables a user with basic EBS credentials to exceed their authorization and access sensitive payroll records - including salary, tax, and banking information - belonging to the entire organization. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity makes this a practical insider and credential-theft risk for any enterprise running affected EBS versions.
Unauthorized data disclosure in Oracle HCM Configuration Workbench (Rapid Implementation component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker to gain complete access to all data accessible within the application via HTTP. Tagged as an Authentication Bypass, the flaw indicates that a legitimately authenticated user with minimal privileges can circumvent authorization controls to access sensitive HCM data well beyond their entitlement - covering employee PII, compensation structures, and organizational data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range spanning twelve supported minor releases elevate operational risk in large enterprise environments running externally accessible EBS instances.
Unauthorized data disclosure in Oracle Supply Chain Trading Connector (E-Business Suite versions 12.2.3 through 12.2.15) exposes all connector-accessible data to low-privileged authenticated network attackers via HTTP. The Collaboration History component fails to enforce proper authorization controls, enabling a valid but low-privileged account to read critical trading data beyond its intended scope. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and straightforward network vector make this a realistic insider or credential-compromise escalation path.