Unauthenticated network exploitation of Oracle Coherence's Core component via HTTP allows partial unauthorized read and write access to Coherence-managed data, with a confirmed scope change indicating impact can extend to additional products beyond the directly targeted instance. Affecting four supported versions (12.2.1.4.0 through 15.1.1.0.0), the flaw is tagged as an Authentication Bypass, suggesting the HTTP-facing interface can be accessed without valid credentials under high-complexity attack conditions. No public exploit code has been identified at time of analysis, and Oracle disclosed this through its July 2026 Critical Patch Update.
Incorrect Authorization (CWE-863) in Kibana's Entity Analytics Watchlist feature allows low-privileged authenticated users with read-only Security Solution access to perform unauthorized write operations against watchlist configuration endpoints that should require elevated privileges. The CVSS 5.4 vector (AV:N/AC:L/PR:L/UI:N) confirms network-exploitable but credential-gated exploitation with limited confidentiality and integrity impact; under specific deployment conditions, affected users may additionally access data outside their authorized scope. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Cross-user attack in Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 enables a low-privileged network attacker to compromise confidentiality and integrity of data across component boundaries when a victim user interacts with attacker-controlled content. The Security component is the attack surface, consistent with stored or reflected client-side injection (e.g., XSS) that hijacks session or data context of another user. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cross-boundary exploitation in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62 allows a low-privileged, network-authenticated attacker to compromise confidentiality and integrity of data - including in additional downstream PeopleSoft products - by inducing a victim user to perform an action via HTTP. The CVSS scope-change indicator (S:C) and required user interaction (UI:R) are characteristic of a client-side injection class (e.g., stored or reflected XSS within the Security component) that crosses trust boundaries. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Cross-site scripting or client-side injection in the Panel Processor component of Oracle PeopleSoft Enterprise PeopleTools 8.62 permits a low-privileged, authenticated network attacker to compromise confidentiality and integrity of accessible PeopleTools data - and, due to a scope change, potentially additional Oracle products - when a victim user interacts with attacker-controlled content. The attack vector is HTTP, requires no elevated complexity, and is classified as easily exploitable. No public exploit code or active exploitation has been identified at time of analysis; Oracle disclosed this via the Critical Patch Update for July 2026.
Spoofing of the Omnibox (URL bar) in Google Chrome versions prior to 150.0.7871.182 allows a remote attacker to mislead users via a crafted HTML page, exploiting insufficient input validation in the browser's Extensions handling. This Medium-severity vulnerability (CVSS 5.4) has no evidence of active exploitation or publicly available exploit code, and its exploitation requires user interaction to visit a malicious page.
Unauthorized data access and modification in Oracle Performance Management (E-Business Suite Appraisals component, versions 12.2.3-12.2.15) is achievable by any low-privileged authenticated user with HTTP network access. The flaw enables partial reads of restricted appraisal data and unauthorized insert, update, or delete operations within the accessible data scope - an insider threat or compromised low-privilege account scenario. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing real-world urgency at moderate levels for enterprises running Oracle E-Business Suite with the Performance Management module active.
LFS deploy-key privilege escalation in Gitea (< 1.27.0) allows a holder of a write deploy key for any single repository owned by a victim to exfiltrate LFS objects from all private repositories that victim owns. The flaw originates in `routers/private/serv.go:275`, where Gitea embeds `repo.OwnerID` as the JWT `UserID` for deploy-key SSH sessions, causing the LFS batch handler at `services/lfs/server.go:268` to evaluate cross-repository authorization as if the repository owner - not the deploy key - were the requesting principal. If the victim is a Gitea site administrator, an unfiltered query in `models/git/lfs.go:226` exposes every LFS object on the entire instance. A public end-to-end PoC (poc.sh) is attached to the GitHub advisory; no CISA KEV listing exists at time of analysis.
Oracle Work in Process (part of Oracle E-Business Suite) versions 12.2.5 through 12.2.15 exposes an authorization flaw in its Internal Operations component, enabling a low-privileged authenticated attacker to perform unauthorized read, insert, update, and delete operations against accessible Work in Process data over HTTP. The scope change (S:C) in the CVSS vector confirms that successful exploitation can cascade to affect additional EBS modules beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, and the mandatory victim interaction requirement (UI:R) reduces opportunistic exploitation risk.
Partial denial of service in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 allows unauthenticated remote attackers to disrupt the Cash Management component via HTTP. The vulnerability is rated Medium (CVSS 5.3) with availability-only impact - confidentiality and integrity are unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Out-of-bounds heap read in libssh exposes small amounts of server memory during GSSAPI key exchange, exploitable by remote unauthenticated attackers. When a client submits a Curve25519 public key shorter than the expected 32 bytes during server-side GSSAPI key exchange, libssh copies the key without validating its length, triggering a read beyond the intended buffer boundary. No public exploit has been identified at time of analysis; exploitation is constrained to servers with GSSAPI key exchange explicitly enabled, which is a non-default configuration.
Unauthenticated read access in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 allows remote attackers to retrieve a subset of protected campus data via HTTP without credentials. The 'Authentication Bypass' tag indicates the Security component fails to enforce access controls on at least one network-accessible endpoint, exposing data - likely student records, enrollment data, or PII - to anonymous network queries. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle explicitly characterizes this as 'easily exploitable.'
Remote unauthenticated information disclosure in Oracle GoldenGate's Admin Server Executable allows network-accessible attackers to read a subset of GoldenGate-accessible data over HTTPS without any credentials. Affected versions span two active branches: 21.3-21.21 and 23.4-23.26.1. No public exploit or CISA KEV listing has been identified at time of analysis; Oracle classifies this as easily exploitable with a CVSS 5.3 Medium score reflecting limited confidentiality impact and no integrity or availability consequence.
Unauthorized data disclosure in Oracle Access Manager's Authentication Engine allows unauthenticated remote attackers to read a subset of OAM-accessible data over HTTP. Affected versions are 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware's OAM component. Tagged as an Authentication Bypass, the flaw carries a CVSS 5.3 (Medium) rating with low confidentiality impact and no integrity or availability consequences; no public exploit or KEV listing has been identified at time of analysis.
Unauthorized read access to Oracle Coherence data is achievable by unauthenticated network attackers targeting the Core component via HTTP across all current supported releases (12.2.1.4.0 through 15.1.1.0.0). The 'Authentication Bypass' tag combined with a PR:N CVSS vector confirms that no credentials are required, but impact is bounded to a partial subset of accessible data (C:L), not full cluster compromise. No public exploit or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the trivially low exploitation complexity.
Unauthenticated remote read access in Oracle Coherence's Core component allows network attackers to retrieve a subset of data via HTTP without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivially exploitable network access with no authentication barrier, consistent with the 'Authentication Bypass' tag applied to this CVE. All four current supported release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are affected; no public exploit or confirmed active exploitation has been identified at time of analysis.
Unauthorized data read in Oracle Coherence Core enables unauthenticated remote attackers to access a subset of data stored within the in-memory data grid via TCP, with no credentials or user interaction required. Affected versions span the three current release trains: 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, all part of Oracle Fusion Middleware. No public exploit identified at time of analysis; the 'Authentication Bypass' tag combined with a PR:N vector confirms the Core component fails to enforce access controls on inbound TCP connections.
Unauthorized data read in Oracle APEX 24.1, 24.2, and 26.1 is achievable by unauthenticated remote attackers via HTTP, exploiting an authentication bypass in the General component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network reachability with no authentication required, allowing exposure of a subset of APEX-accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and zero-auth requirements make this a credible opportunistic threat against internet-facing APEX deployments.
Unauthenticated information disclosure in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows remote attackers to read a subset of accessible platform data via the Agent Next Gen component over HTTPS without credentials. Tagged as an Authentication Bypass, this network-accessible flaw carries a low-complexity attack profile (AV:N/AC:L/PR:N/UI:N), meaning any network-reachable adversary can exploit it with minimal effort. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the absence of authentication requirements and zero attack complexity make this straightforward to operationalize, particularly given that OEM manages critical enterprise infrastructure.
Unauthenticated information disclosure in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) exposes a subset of platform data to remote attackers via HTTPS. The vulnerability resides in the Agent Next Gen component and is classified as an authentication bypass, enabling network-accessible exploitation without credentials or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, its low complexity and zero-authentication requirement make it straightforwardly exploitable by any internet-accessible instance.
Denial of service in Oracle Agile Engineering Data Management 6.2.1 allows a low-privileged network attacker to crash or hang the application via a crafted HTTP request targeting the Install component. The vulnerability carries a CVSS 3.1 score of 5.3 (Medium), with high attack complexity tempering the real-world risk. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthorized read access to critical data in Oracle Work in Process (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged, network-connected attacker exploiting an authentication bypass in the Internal Operations component via HTTP. The flaw is rated difficult to exploit (AC:H) and carries no integrity or availability impact, but successful exploitation grants complete access to all data accessible within the Work in Process module. No public exploit code or CISA KEV listing is associated with this vulnerability at time of analysis.
Partial denial-of-service in Oracle Java SE's Libraries component allows unauthenticated network attackers to disrupt availability across a broad range of supported versions, including the current releases 25.0.3 and 26.0.1. The attack surface is unusually wide: exploitation is possible through any protocol supported by the JVM, via APIs exposed in the Libraries component, through web services that internally invoke those APIs, and through the sandboxed Java Web Start or applet execution path when loading untrusted code. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the trivial exploitation conditions (AC:L/PR:N/UI:N) and the ubiquity of Java deployments elevate realistic risk beyond the moderate CVSS score alone.
Partial denial-of-service exposure in the 2D graphics component of Oracle Java SE and GraalVM platforms allows unauthenticated remote attackers to disrupt service availability with no authentication and low attack complexity. Affected releases span a broad range including Java SE 8u491 through 26.0.1, GraalVM for JDK 17.0.19 and 21.0.11, and GraalVM Enterprise Edition 21.3.18 - covering virtually every supported Java SE release as of the July 2026 CPU. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though Oracle characterizes the vulnerability as 'easily exploitable', indicating automated exploitation is plausible.
Partial denial-of-service in the JavaFX component of Oracle Java SE 8u491 is remotely exploitable by unauthenticated attackers across multiple network protocols, confirmed by Oracle's Critical Patch Update for July 2026. The vulnerability manifests in two distinct deployment contexts: server-side web services that pass externally supplied data to JavaFX APIs, and client-side sandboxed environments (Java Web Start applications or Java applets) that load and execute untrusted internet code. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV; however, the low-complexity, no-authentication-required attack surface makes exploitation straightforward should a proof-of-concept emerge.
Partial denial-of-service exposure in the JSSE component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated remote attackers to degrade service availability by supplying malformed data via TLS. Affected releases span five Oracle Java SE versions (11.0.31 through 26.0.1) and both GraalVM product lines, as disclosed in Oracle's CPU July 2026 advisory (EUVD-2026-46459). No public exploit identified at time of analysis and no CISA KEV listing; the CVSS 5.3 rating reflects a genuine but bounded availability impact rather than a critical or confidentiality-affecting risk.
Unbounded memory growth in libssh's SFTP client allows a malicious server to exhaust client-side memory by sending responses for unknown request IDs, resulting in a denial-of-service condition against any application using libssh for SFTP operations. Affected deployments include libssh as packaged in Red Hat Enterprise Linux 8, 9, 10, and Red Hat Hardened Images. No public exploit code and no active exploitation have been identified at time of analysis; the CVSS score of 5.3 (Medium) reflects the limited availability impact and the requirement that a victim client connect to an attacker-controlled server.
Unauthorized data disclosure in Oracle Production Scheduling (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged network attacker to gain complete read access to all data within the application via a difficult-to-exploit flaw in the User Interface component. Tagged as an authentication bypass, the vulnerability suggests improper access control enforcement in the UI layer that permits privilege escalation beyond the attacker's normally granted permissions, enabling full confidentiality compromise of Production Scheduling data. No public exploit code or active exploitation has been identified; Oracle addressed this in the Critical Patch Update for July 2026.
Unauthorized access to critical data in Oracle Production Scheduling (versions 12.2.3 through 12.2.15) is achievable by unauthenticated remote attackers via a network-based authentication bypass in the Internal Operations component, though exploitation requires high attack complexity and human interaction from a third party. The confidentiality impact is complete - attackers can access all data accessible to Production Scheduling - while integrity and availability remain unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle disclosed this through the July 2026 Critical Patch Update.
Unauthenticated information disclosure in Oracle Enterprise Manager Base Platform's Agent Next Gen component permits remote attackers to read a subset of platform-accessible data over HTTPS without credentials. Versions 13.5 and 24.1 are confirmed affected per Oracle's Critical Patch Update for July 2026. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though the Authentication Bypass tag suggests a structural access control failure rather than a simple misconfiguration.
Confidential data exposure in Oracle Contracts Integration (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 enables a low-privileged authenticated attacker with HTTP network access to bypass internal authorization controls in the Internal Operations component, gaining unauthorized access to critical or all accessible contract data. The CVSS confidentiality impact is rated High despite the moderate overall score of 5.3, reflecting complete in-scope data exposure when exploitation succeeds. No public exploit code or active exploitation has been identified at time of analysis; the high attack complexity (AC:H) constrains real-world opportunistic risk.
Unauthorized read access to critical data is possible in Oracle iStore (E-Business Suite Shopping Cart component, versions 12.2.3-12.2.15) via an authentication bypass condition exploitable by low-privileged network attackers over HTTP. The attack is rated difficult to exploit (AC:H), limiting opportunistic risk, but a successful attempt yields high confidentiality impact - complete access to all iStore-accessible data. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Oracle via their July 2026 Critical Patch Update.
Column-value inference via observable discrepancy in Electric Postgres Sync below 1.6.10 allows authenticated remote attackers to deduce the values of columns intentionally excluded from shape responses. By crafting subset WHERE clause conditions against shape endpoints and observing whether rows are matched or returned, an attacker can systematically enumerate sensitive field data that the application's column-based access restrictions are designed to conceal. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available at version 1.6.10.
Integrity compromise in Oracle Time and Labor (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to create, delete, or modify critical application data via HTTP under high-complexity conditions. The vulnerability resides in the Internal Operations component and is tagged as an Authentication Bypass, suggesting insufficient internal authorization enforcement rather than a perimeter access failure. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the I:H integrity impact makes successful exploitation consequential for workforce and payroll data integrity.
Improper permission enforcement in Checkmk's Business Intelligence (BI) module allows any authenticated low-privileged user to view and modify BI packs and rules regardless of their assigned permission set. Affected versions span four release branches - 2.5.0 through 2.5.0p8, 2.4.0 through 2.4.0p33, 2.3.0 through 2.3.0p48, and the end-of-life 2.2.0 branch - creating an access control bypass in a core monitoring configuration surface. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Apple's Find My backend service allows an attacker who holds a valid PET (Private Endpoint Token) to enumerate devices on an Apple ID account and silently remove offline devices without triggering two-factor authentication or ownership verification - a CWE-287 Improper Authentication flaw. The vulnerability affects the service through at least December 17, 2025, with researcher-published proof-of-concept code on GitHub demonstrating the technique. EPSS sits at 0.19% (9th percentile) and the vulnerability is not listed in CISA KEV, pointing toward targeted rather than opportunistic exploitation; however, the account-manipulation impact makes it meaningful for high-value Apple ID targets.
Cross-tenant information disclosure in OpenRemote versions before 1.26.2 allows any authenticated user holding the read:rules role to retrieve operational syslog events from arbitrary tenants by querying the GET /api/{realm}/syslog/event endpoint. The SyslogResource REST endpoint fails to scope log retrieval to the caller's own realm, exposing asset IDs, agent connection details, rule names, and protocol errors belonging to other organizations in the same multi-tenant deployment. No public exploit code or active exploitation has been identified at time of analysis; the vendor has addressed the issue in version 1.26.2.
Nginx server version disclosure in HCL IntelliOps Event Management (IEM) exposes the underlying web server version to unauthenticated remote attackers. This reconnaissance-class vulnerability allows adversaries to fingerprint the software stack, identify whether the nginx instance is outdated, and pivot to targeting known CVEs or publicly available exploits against that specific version. No public exploit code and no CISA KEV listing are associated with this CVE; the primary risk is as an enabler for follow-on attacks rather than direct exploitation.
kirby-modules through version 5.5.7 exposes the complete plaintext commercial license key to any authenticated Kirby Panel user - including non-admin roles such as editors and authors - via a single GET request to the modules/activate dialog endpoint. The root cause is a missing authorization check (CWE-862) in lib/areas.php: the handler calls ModulesLicense::readKey() without verifying administrator status, relying instead on the access.system permission that defaults to true for all non-admin Panel roles. No active exploitation is confirmed by CISA KEV and no public exploit code has been identified, but the CVSS 4.0 vector (PR:L, AC:L, AV:N) indicates this is trivially reproducible by any Panel account holder, with the primary downstream consequence being unauthorized activation of the plugin on third-party Kirby installations.
Private repository existence disclosure in Gitea allows fully unauthenticated remote attackers to confirm the existence, enumerate names, harvest clone URLs, and identify default branch names of private repositories by appending the `?go-get=1` query parameter to any repository-scoped URL. All Gitea instances running versions prior to 1.27.0 are affected regardless of repository visibility configuration. No public exploit identified at time of analysis as a dedicated exploit tool, though a detailed proof-of-concept with working `curl` and shell enumeration scripts is published in the GHSA advisory, making exploitation trivially repeatable.
Open redirect in Trino 481's OAuth2/OIDC authentication component allows remote, unauthenticated attackers to manipulate the redirect_uri parameter in ExternalUriInfo.java, redirecting authenticated users to attacker-controlled external sites. Exploitation requires user interaction - a victim must follow a crafted authentication URL - making this primarily a phishing and token-harvesting enabler rather than a direct system compromise vector. No active exploitation has been confirmed (not in CISA KEV), no public exploit code exists, and the trinodb project had not responded to the responsible disclosure report at time of analysis.
Stored cross-site scripting in FOG Project's inventory pipeline allows an unauthenticated network-adjacent attacker who knows any registered host's MAC address to inject persistent JavaScript payloads into the FOG database via POST requests to `/service/inventory.php`. When an administrator opens the Group Inventory tab, the unescaped payload executes in their browser, enabling session hijacking or unauthorized admin-level actions. No public exploit has been identified at time of analysis; patches are available in versions 1.5.10.1832 (stable) and 1.6.0-beta.2313 (beta).
Oracle Service Delivery Platform's Messaging Enabler component in versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged local users to perform unauthorized read and write operations on platform data, with a documented scope change that extends impact to additional co-deployed Oracle Fusion Middleware products. The vulnerability requires only a low-privileged local account on the hosting infrastructure, making insider threats and compromised service accounts the primary risk vector. No public exploit has been identified at time of analysis; this was disclosed as part of Oracle's July 2026 Critical Patch Update.
Oracle Workflow Notification Mailer in E-Business Suite versions 12.2.3 through 12.2.15 exposes a denial-of-service and limited data manipulation condition exploitable only by a high-privileged, local attacker under complex circumstances. Successful exploitation can cause a complete hang or repeatable crash of the Workflow service, alongside minor unauthorized read and write access to a subset of its data. No public exploit or active exploitation has been identified at time of analysis, and Oracle classifies this as difficult to exploit.
Stored XSS in Grav CMS shortcode-core attribute handlers allows authenticated users with admin.pages permission to inject persistent JavaScript payloads that bypass the CMS's XSS detection filter and execute in any visitor's browser. The filter flaw is root-cause critical: it only flags payloads containing literal angle brackets, leaving event-handler and attribute-based injection vectors entirely unblocked. When an administrator views an affected page, the injected script can steal admin session nonces, enabling full account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the impact chain - from low-privilege content editor to admin session hijack - is straightforward.
MySQL Cluster's NDB Operator component allows a local, unauthenticated attacker with logon access to the infrastructure host to bypass authentication controls and gain complete read access to all MySQL Cluster data. Three active release lines are affected - 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1 - as confirmed by Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, and the high attack complexity (AC:H) together with the local-only access vector (AV:L) substantially constrain realistic exploitation, though the data-exposure consequence remains significant for environments handling sensitive workloads.
Partial compromise of Oracle Installed Base (Create Item Instance component) within Oracle E-Business Suite versions 12.2.4 through 12.2.15 is achievable by a low-privileged authenticated attacker over HTTP, subject to high attack complexity conditions. Successful exploitation results in unauthorized read access to a subset of Installed Base data, unauthorized data manipulation (insert/update/delete), and the ability to cause a partial denial of service. No public exploit or active exploitation has been identified at time of analysis; the Oracle CPU July 2026 advisory addresses this issue.
Missing RBAC authorization on the ZenML 0.94.2 `get_deployed_stack` endpoint allows any authenticated user to enumerate all deployed stacks across all users and tenants. The root failure is twofold: the HTTP handler lacks endpoint-level authorization, and the internal server-side `Client()` object bypasses the RBAC enforcement layer by querying `SqlZenStore` directly, making tenant isolation ineffective. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified, but the low attack complexity and cross-tenant data exposure make this a meaningful risk in ZenML Pro/Cloud multi-tenant deployments.
Outbound request restriction bypass in Kibana's Reporting feature enables authenticated low-privileged attackers to cause the reporting service to issue HTTP requests to network destinations explicitly denied by administrator-configured security policy. Affected versions span Kibana 8.x through 8.19.18, 9.0.x through 9.3.7, and 9.4.x through 9.4.3. The scope-changed CVSS vector (S:C) confirms the impact extends beyond Kibana itself to internal network resources, making this a server-side request forgery (SSRF)-class issue. No public exploit code or CISA KEV listing identified at time of analysis.
Oracle Contracts Integration within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) exposes a network-accessible HTTP endpoint susceptible to exploitation by unauthenticated remote attackers, contingent on high attack complexity and required victim interaction. Successful exploitation yields limited unauthorized read access to a subset of Contracts Integration data, unauthorized data manipulation (insert, update, delete), and partial denial of service against the component. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; the AC:H and UI:R constraints substantially lower real-world exploitation likelihood relative to the raw CVSS vector.