Full takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) is possible by remote, unauthenticated attackers over TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with High impact to confidentiality, integrity, and availability, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of network reachability, no authentication, and complete compromise makes it a top-priority patch.
Full compromise of Oracle Coherence (Oracle Fusion Middleware, Core component) allows a remote, unauthenticated attacker to take over the affected server via a crafted HTTP request, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable,' affecting supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. There is no public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV; EPSS data was not provided.
Full takeover of Oracle Coherence is possible when an unauthenticated attacker reaches the product over TCP, per Oracle's July 2026 Critical Patch Update. The flaw affects the Core component across Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, and Oracle rates it CVSS 9.8 with full confidentiality, integrity and availability loss. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the 'easily exploitable / unauthenticated' characterization makes it a high-priority patch item.
Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) allows an unauthenticated attacker with network access via HTTP/2 to fully compromise affected versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw yields complete confidentiality, integrity, and availability loss (CVSS 3.1 base 9.8) and was disclosed by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, but the network-reachable, no-privilege, no-interaction profile makes it a top-priority patching target.
Full takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware allows an unauthenticated attacker to remotely compromise affected instances over HTTP, impacting confidentiality, integrity, and availability. Oracle rates this CVSS 9.8 and describes it as easily exploitable against supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and absence of any authentication requirement make it a top-tier patching priority.
Complete takeover of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware, is possible for a remote unauthenticated attacker who can reach the product over TCP, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) reflects that no authentication or user interaction is required and that a successful attack fully compromises confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but Oracle rates it 'easily exploitable,' making it a high-priority patch in the July 2026 Critical Patch Update.
Full compromise of Oracle Coherence, the in-memory data grid within Oracle Fusion Middleware (Core component), is possible by remote unauthenticated attackers over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 and Oracle describes it as easily exploitable, allowing complete takeover with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Remote takeover of Oracle Coherence (Fusion Middleware Core component) allows an unauthenticated network attacker to fully compromise the affected instance over TCP, per Oracle's July 2026 Critical Patch Update. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, all carrying a CVSS 3.1 base score of 9.8 with full confidentiality, integrity and availability impact. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the 'easily exploitable / unauthenticated / network' profile makes it a high-priority patch item.
Full compromise of Oracle Coherence (Oracle Fusion Middleware Core component) is possible by a remote, unauthenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 9.8 and Oracle rates it 'easily exploitable,' with successful attacks resulting in complete takeover of the Coherence instance (full confidentiality, integrity, and availability loss). No public exploit has been identified at time of analysis, but the low attack complexity and lack of authentication make it a high-priority patch.
Remote takeover of Oracle Coherence (Core component of Oracle Fusion Middleware) allows an unauthenticated attacker with TCP network access to fully compromise the affected data-grid instance across versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates it "easily exploitable" with a CVSS 3.1 base score of 9.8 and full confidentiality, integrity and availability impact. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication profile makes it a high-priority patch target.
Full remote takeover of Oracle Coherence (Core component of Oracle Fusion Middleware) is achievable by an unauthenticated network attacker in supported releases 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates the flaw CVSS 9.8 and describes it as 'easily exploitable' over TCP with no user interaction, yielding complete compromise of confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the low attack complexity and unauthenticated network vector make it a top-priority patch from the July 2026 Critical Patch Update.
Full compromise of Oracle Coherence (Fusion Middleware Core component) is achievable by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 9.8 rating and permits complete takeover with high confidentiality, integrity, and availability impact against versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit identified at time of analysis, and it is not listed in CISA KEV; however, the low attack complexity and unauthenticated network vector make it a high-priority patch target.
Unauthenticated remote takeover of Oracle Coherence (a component of Oracle Fusion Middleware, Core component) lets a network attacker with only TCP connectivity fully compromise the affected instance, per Oracle's July 2026 Critical Patch Update. Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, and the CVSS 3.1 base score of 9.8 reflects complete loss of confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the 'easily exploitable / unauthenticated' framing makes it a high-priority patch.
Full compromise of Oracle Coherence, the in-memory data grid component of Oracle Fusion Middleware (Core), allows an unauthenticated remote attacker with only TCP network access to take over the affected instance. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, it affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and was disclosed by Oracle in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided in the input.
Remote takeover of Oracle Coherence (Oracle Fusion Middleware Core component) affects versions 12.2.1.4.0 and 14.1.1.0.0, allowing an unauthenticated attacker with only HTTP network access to fully compromise the product. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, Oracle describes the flaw as easily exploitable and resulting in complete Coherence takeover. Addressed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not currently listed in CISA KEV.
Full remote takeover in Oracle Coherence 12.2.1.4.0 and 14.1.1.0.0 (Fusion Middleware Core component) allows an unauthenticated network attacker to compromise the in-memory data grid over HTTP with no user interaction. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, it was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'easily exploitable, unauthenticated' profile makes it a prime patching priority.
Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) allows an unauthenticated attacker with TCP network access to fully compromise the product across supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates this 'easily exploitable' with complete confidentiality, integrity and availability loss (CVSS 9.8), disclosed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a high-priority patch.
Full takeover of Oracle Coherence (an in-memory data grid within Oracle Fusion Middleware) is achievable by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch item.
Remote takeover of Oracle Coherence (a component of Oracle Fusion Middleware) allows an unauthenticated attacker with TCP network access to fully compromise the affected in-memory data grid, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) reflects complete loss of confidentiality, integrity, and availability with no authentication or user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'easily exploitable' framing and full-impact vector make this a high-priority patch across affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Remote unauthenticated compromise of Oracle Coherence (a component of Oracle Fusion Middleware) allows attackers with only network TCP access to fully take over the affected instance, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 9.8 and affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit identified at time of analysis, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) and full confidentiality, integrity, and availability impact make this a high-priority patch item.
Remote takeover of Oracle Coherence (Core component) in Oracle Fusion Middleware allows an unauthenticated attacker with only TCP network access to fully compromise the in-memory data grid, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score is 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the combination of no authentication and full-system takeover makes it a top-priority patch.
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with network access over TCP reaches the Core component, yielding full confidentiality, integrity, and availability compromise (CVSS 9.8). The flaw affects Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 shipped as part of Oracle Fusion Middleware, and is addressed in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Full remote takeover of Oracle Coherence (Fusion Middleware Core component) allows an unauthenticated attacker with only TCP network access to fully compromise the in-memory data grid, per Oracle's July 2026 Critical Patch Update. Oracle rates it 'Easily exploitable' with a CVSS 3.1 base score of 9.8 (C:H/I:H/A:H), meaning a successful attack yields complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV, but the low-complexity, no-authentication profile makes it a high-priority patch.
Full takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) is achievable by unauthenticated attackers with only TCP network reachability to the affected service. Per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) and Oracle's own 'easily exploitable' rating, an attacker needs no credentials or user interaction to gain complete control over confidentiality, integrity, and availability (9.8). At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, so exploitation is not confirmed; the fix ships in the Oracle Critical Patch Update of July 2026.
Full takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) is achievable by unauthenticated remote attackers over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle explicitly rates it 'easily exploitable' against supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of no authentication, low complexity, and complete-takeover impact makes it a top-priority patch.
Remote takeover of Oracle Coherence (Core component of Oracle Fusion Middleware) allows an unauthenticated attacker with TCP network access to fully compromise the affected instance, per Oracle's July 2026 Critical Patch Update. The flaw carries a 9.8 CVSS and impacts confidentiality, integrity and availability of Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. No public exploit has been identified at time of analysis, but the network-reachable, no-authentication profile makes it a high-priority patch.
Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) allows an unauthenticated network attacker to fully compromise affected versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 over TCP. Oracle rates the flaw CVSS 9.8 with full confidentiality, integrity, and availability impact and describes it as "easily exploitable," meaning no authentication, user interaction, or special access is required. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV; remediation is delivered through the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle Coherence (Core component) allows an unauthenticated attacker with TCP network access to take over affected installations, per Oracle's July 2026 Critical Patch Update. Oracle rates this CVSS 9.8 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' affecting Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector combined with 'takeover' impact makes this a top-priority patch.
Complete takeover of Oracle Coherence is possible by unauthenticated remote attackers over TCP, per Oracle's July 2026 Critical Patch Update (CVE-2026-60215). The flaw in the Core component carries a CVSS 3.1 score of 9.8 and affects Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, delivering full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and it is not on CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
Remote takeover of Oracle Coherence (Core component of Oracle Fusion Middleware) allows an unauthenticated attacker with network TCP access to fully compromise the affected instance across confidentiality, integrity, and availability. Oracle rates this 9.8 and describes it as easily exploitable against supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-authentication profile makes it a high-priority patch item from the July 2026 Critical Patch Update.
Complete takeover of Oracle Coherence is possible when an unauthenticated attacker with TCP network access to the Core component exploits an easily-exploitable flaw in versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Disclosed by Oracle in the July 2026 Critical Patch Update, the issue carries a CVSS 9.8 score with full confidentiality, integrity, and availability impact and requires no user interaction. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; however, the low attack complexity and unauthenticated network reachability make it a high-priority patch.
Full takeover of Oracle Coherence (Fusion Middleware Core) is achievable by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score is 9.8 with complete confidentiality, integrity, and availability impact against supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication profile makes it a high-priority patch item.
Full takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) allows an unauthenticated remote attacker with TCP network access to compromise the affected instance, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' Affected releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle BI Publisher (part of Oracle Analytics, BI Platform Security component) is achievable by a remote, unauthenticated attacker sending crafted HTTP requests, per the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N scoring 9.8. Affected releases are the 8.2.0.0.0 and 12.2.1.4.0 versions, and Oracle rates successful attacks as resulting in complete takeover of the BI Publisher instance with high confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis and no CISA KEV listing, so risk is currently driven by the ease and severity of the flaw rather than confirmed active exploitation.
Full takeover of Oracle Retail Integration Bus 16.0.3 (RIB Kernel component) is achievable by an unauthenticated remote attacker over HTTP, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact reflects complete compromise of the RIB instance with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivially low attack complexity makes it a high-priority patch target.
Complete compromise of Oracle Application Testing Suite version 13.3.0.1 is possible by remote, unauthenticated attackers over the Oracle Net protocol, per Oracle's July 2026 Critical Patch Update. Oracle rates this 'easily exploitable' with a CVSS 3.1 base score of 9.8, and a successful attack results in full takeover of the product with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patching target.
Complete takeover of Oracle Application Testing Suite 13.3.0.1 is possible by unauthenticated attackers over the network via TCP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle characterizes it as 'easily exploitable.' No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was supplied.
Full takeover of Oracle Coherence is possible by remote unauthenticated attackers who reach the product over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw resides in the Core component of versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 and carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity and availability impact. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.
Full takeover of Oracle Coherence (part of Oracle Fusion Middleware, Core component) is achievable by an unauthenticated remote attacker over TCP against affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates it CVSS 9.8 with high impact to confidentiality, integrity, and availability, and describes it as 'easily exploitable,' meaning no authentication, no user interaction, and low attack complexity are required. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the network-facing, unauthenticated nature makes it a high-priority patch item.
Remote takeover of Oracle WebLogic Server (Fusion Middleware Core component) allows an unauthenticated network attacker to fully compromise the server via HTTP, per Oracle's July 2026 Critical Patch Update. Affected releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, all carrying a maximum-severity CVSS 3.1 score of 9.8 with full confidentiality, integrity and availability impact. No public exploit identified at time of analysis, but WebLogic's history as a repeated exploitation target makes this a high-priority patch.
Remote takeover of the Oracle Work in Process (WIP) module of Oracle E-Business Suite (component: Internal Operations) allows an unauthenticated attacker with only HTTP network access to fully compromise the application. Oracle rates this 9.8 with full confidentiality, integrity and availability impact and describes it as 'easily exploitable,' meaning no authentication, no user interaction and low attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network attack profile makes it a top-priority patch in the July 2026 Critical Patch Update.
Memory corruption in Apache Fory's C++ serialization library (versions 0.14.0 up to but not including 1.4.0) lets remote attackers trigger heap type confusion and out-of-bounds read/write by supplying data with an inconsistent schema when deserialization runs in compatible mode. Because the field-skip code paths never validate declared field types against the actual bytes, a crafted payload can corrupt heap memory, creating a path toward remote code execution or denial of service. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the CWE-502 root cause and 9.8 CVSS score make it a high-priority patch for any service that deserializes untrusted input with the C++ implementation.
Full takeover of Oracle PeopleSoft Enterprise FIN Manufacturing Brazil 9.1 is possible when an unauthenticated remote attacker reaches the vulnerable Integration component over HTTPS. Oracle rates this 9.8 (CVSS 3.1) with high confidentiality, integrity, and availability impact and describes it as easily exploitable, meaning no authentication, privileges, or user interaction are required. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low-complexity unauthenticated profile makes it a priority patch in the Oracle July 2026 Critical Patch Update.
Complete takeover of Oracle Commerce Guided Search Platform Services 11.4.0 (formerly Endeca) is possible by an unauthenticated remote attacker sending crafted HTTP requests to the Forge component. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact, and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low complexity and lack of authentication make it a high-priority patch target.
Remote takeover of Oracle Data Integrator 14.1.2.0.0 (Oracle Fusion Middleware) is possible via the REST Service component, allowing an unauthenticated attacker with network access over HTTPS to fully compromise the product. Oracle rates this CVSS 9.8 with full confidentiality, integrity and availability impact and characterizes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full product takeover of Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0) is possible by a remote, unauthenticated attacker over HTTP against the Runtime Tools component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, base 9.8) reflects that no credentials, user interaction, or special conditions are needed, and a successful attack fully compromises confidentiality, integrity, and availability. This is a July 2026 Oracle Critical Patch Update item with no public exploit identified at time of analysis and no CISA KEV listing.
Remote takeover of Oracle WebCenter Content: Imaging (Fusion Middleware Core component) allows an unauthenticated attacker with network access via the T3 or IIOP protocols to fully compromise the product, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not yet confirmed in the wild despite the maximal severity.
Complete takeover of Oracle WebCenter Enterprise Capture is possible when an unauthenticated remote attacker reaches the Client Bundle component over Oracle's T3 or IIOP protocols. Affecting Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, the flaw carries a CVSS 9.8 with full confidentiality, integrity, and availability impact, and is described by Oracle as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Complete remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated network attacker abusing the T3 or IIOP protocols can fully compromise the product with high impact to confidentiality, integrity, and availability. Oracle rates it CVSS 3.1 9.8 and describes it as easily exploitable, but there is no public exploit identified at time of analysis and it is not on CISA KEV. The T3/IIOP attack surface is the same WebLogic RMI channel historically abused via Java deserialization, making it a high-priority patch despite the absence of confirmed in-the-wild activity.
Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) in Oracle Fusion Middleware is achievable by a remote unauthenticated attacker over the T3 and IIOP protocols. Affecting versions 12.2.1.4.0 and 14.1.2.0.0, successful exploitation results in complete takeover of the platform with high confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch.