Unauthenticated remote exploitation of Oracle Teleservice (E-Business Suite versions 12.2.3 through 12.2.15) via HTTP allows attackers to read a subset of accessible service data and perform unauthorized insert, update, or delete operations against Teleservice records through the Service Diagnostics Scripts component. The vulnerability is tagged as an authentication bypass, indicating the diagnostic scripting interface fails to enforce access controls against unauthenticated callers. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, though Oracle's own advisory classifies this as 'easily exploitable,' elevating operational priority for internet-facing EBS deployments.
Unauthenticated remote exploitation of Oracle Advanced Pricing (E-Business Suite 12.2.3-12.2.15) via HTTP allows attackers to read and tamper with price list data without any credentials. The 'Authentication Bypass' tag and PR:N CVSS vector together confirm that the Price List component exposes sensitive pricing operations to the network without enforcing authentication. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this a straightforward target for opportunistic actors with network access to the EBS HTTP interface.
Oracle Java SE's Security component across versions 8u491 through 26.0.1 - and GraalVM for JDK/Enterprise Edition counterparts - contains an authentication bypass that allows unauthenticated network attackers to perform unauthorized read and write operations against data accessible by the Java runtime. Oracle classifies this as 'easily exploitable' via multiple protocols with no user interaction required, reachable either through server-side web services consuming Security APIs or through sandboxed Java Web Start and applet clients loading untrusted code. No public exploit code or CISA KEV listing has been identified at time of analysis, but the no-complexity network vector across a ubiquitous technology warrants priority patching.
Unauthorized access to critical data is achievable against MySQL Connector/J versions 9.7.0 and 9.7.1 via a network-accessible authentication bypass flaw requiring human interaction. Oracle classifies this as easily exploitable, meaning a network-positioned unauthenticated attacker can intercept or otherwise obtain complete access to all data flowing through the affected connector when a legitimate application initiates a database connection. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated network-based authentication bypass in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 enables remote attackers to corrupt or destroy critical campus data and read a subset of accessible records via HTTP. The Security component flaw is tagged as an authentication bypass, with high integrity impact allowing unauthorized creation, deletion, and modification of critical data - a significant risk for higher education institutions relying on this system for student and community records. No public exploit or CISA KEV listing has been identified at time of analysis, but Oracle's July 2026 CPU confirms the vulnerability and a patch release.
Unauthorized data manipulation in Oracle Contracts Integration (versions 12.2.3-12.2.15) allows a low-privileged authenticated attacker over HTTP to create, delete, or modify critical contract data without proper authorization. The 'Authentication Bypass' tag in source intelligence conflicts with the CVSS PR:L metric - this appears to be an authorization bypass within the Internal Operations component rather than a full authentication bypass, permitting privilege escalation beyond the attacker's intended access scope. Disclosed as part of Oracle's July 2026 Critical Patch Update; no public exploit has been identified at time of analysis.
Unauthorized data manipulation in Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 is achievable by any low-privileged user with network HTTPS access, specifically through the Metadata Plugin component. The flaw - tagged as an authentication bypass - enables arbitrary creation, deletion, or modification of critical OEM metadata, potentially affecting all data accessible within the platform. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction (UI:N) make this a credible insider or compromised-credential threat in any organization with OEM deployed.
Uncontrolled memory allocation in Kibana's machine learning feature allows low-privileged authenticated users to exhaust server memory, causing a complete denial of service for all users. Three major version lines are affected - 8.x through 8.19.18, 9.0.x through 9.3.7, and 9.4.x through 9.4.3 - with vendor-released patches available across all three. No active exploitation confirmed via CISA KEV and no public exploit code identified at time of analysis, but the low authentication barrier (any valid account) makes this a meaningful internal threat in shared Kibana environments.
Denial of service in Elastic Kibana allows any authenticated low-privilege user to crash the Kibana process by sending a specially crafted oversized HTTP request payload, exhausting Node.js heap memory and making the analytics platform unavailable to all users. Affected branches span Kibana 8.x (through 8.19.18), 9.0.x-9.3.x (through 9.3.7), and 9.4.x (through 9.4.3), with patched releases available per ESA-2026-71. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Uncontrolled recursion in Elasticsearch's query evaluation component allows a low-privileged authenticated user with read-level index access to crash an affected node by submitting a specially crafted search request. All three active release lines are affected: 8.19.x through 8.19.18, 9.3.x through 9.3.7, and 9.4.x through 9.4.3. The impact ranges from complete service outage in single-node deployments to sustained availability degradation and repeated node restarts in multi-node clusters. No public exploit code or active exploitation has been identified at time of analysis; Elastic has released patched versions 8.19.19, 9.3.8, and 9.4.4.
Denial-of-service in MySQL Server and MySQL Cluster 9.7.0-9.7.1 allows any low-privileged, network-accessible attacker to crash or hang the database server by exploiting a flaw in the Optimizer component. The attack requires only valid database credentials and can be executed via multiple supported protocols (e.g., classic MySQL protocol, X Protocol), with no additional user interaction or elevated permissions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but Oracle's own language - 'easily exploitable' - and the CVSS AC:L rating indicate low barrier to triggering the condition once credentials are obtained.
Node process termination in Elasticsearch allows a low-privileged authenticated user to crash any reachable cluster node with a single malformed search request. The vulnerability stems from a reachable assertion in the query parsing layer triggered by a null value in a specific query clause; because Elasticsearch treats assertion failures as fatal, the node process exits immediately. Single-node deployments lose service entirely; in clustered environments, each targeted node reduces available search capacity. No public exploit has been identified at time of analysis, and Elastic has released patched versions 8.19.19, 9.3.8, and 9.4.4 per advisory ESA-2026-64.
Kibana's Canvas functionality allows any authenticated low-privileged user to crash the Kibana server process via a specially crafted request, causing a complete denial of service for all users of the affected instance. The root cause is uncontrolled resource consumption (CWE-400 / CAPEC-130), where Canvas fails to bound server-side resource allocation when processing attacker-controlled input. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the low attack complexity once authenticated makes independent rediscovery plausible.
Heap exhaustion in Elasticsearch allows authenticated users holding search privileges to crash individual data nodes by submitting specially crafted search requests, degrading or taking down the cluster and requiring manual administrator intervention to restore service. Affected versions span the 8.x and 9.x release lines per vendor advisory ESA-2026-60, with fixes available in 8.19.15, 9.2.9, and 9.3.4 as inferred from the advisory URL. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low authentication barrier makes it a meaningful risk for multi-tenant or shared Elasticsearch deployments.
Zephyr RTOS Bluetooth Mesh PB-ADV provisioning can be permanently denied on any affected device within BLE advertising range by an unauthenticated remote attacker exploiting a timer-reset logic flaw in subsys/bluetooth/mesh/pb_adv.c. The watchdog timer governing protocol timeouts was rescheduled unconditionally before validity checks, allowing an attacker to hold a dead provisioning link open indefinitely by sending FCS-valid PDUs faster than the 60-120 second timeout interval. The device's unprovisioned beacon is suppressed and all new Link Open requests are rejected for as long as the attacker transmits, rendering the device permanently un-provisionable without a reboot. No public exploit is identified and the vulnerability is not listed in CISA KEV, though the attack requires no authentication and low complexity to execute from within BLE range.
Integrity compromise in Oracle Database Server's JDBC component allows unauthenticated network attackers to create, delete, or modify critical data or all JDBC-accessible data via Oracle Net. Affected releases span three supported branches: 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. Exploitation requires human interaction from a party other than the attacker, limiting opportunistic mass exploitation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in rpcbind's rpcinfo client utility crashes the rpcinfo process when a user or administrator runs `rpcinfo -s` against a malicious or compromised rpcbind endpoint. The flaw is in the `rpcbdump()` short-mode function, which writes version number data from a remote RPCBPROC_DUMP reply into a fixed-size stack buffer without bounds validation. Affected deployments span Red Hat Enterprise Linux 8, 9, and 10 as well as OpenShift Container Platform 4; no public exploit has been identified and this vulnerability does not appear in the CISA KEV catalog, placing real-world urgency in the medium tier despite the network-accessible attack vector.
Unauthenticated remote data exposure and manipulation affects Oracle Applications Manager versions 12.2.3 through 12.2.15 within Oracle E-Business Suite, via the Oracle Diagnostics Interfaces component. An attacker with HTTP network access can bypass authentication to read a subset of OAM-accessible data and perform unauthorized insert, update, or delete operations against OAM data - no credentials or user interaction required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the low attack complexity and unauthenticated vector raise real-world concern for internet-facing or poorly segmented EBS deployments.
Unauthorized data access in Oracle HRMS (US) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read critical or complete HR data via HTTP without requiring user interaction or elevated permissions. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and carries a CVSS 3.1 score of 6.5 with high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range spanning over a decade of releases make this a meaningful risk for any organization running unpatched Oracle EBS.
Incorrect Authorization (CWE-863) in Elasticsearch's ingest simulation feature allows authenticated users with limited index privileges to bypass per-index access controls and trigger ingest pipeline execution on indices they are not authorized to access directly. Pipeline output - potentially containing enriched or processed sensitive data - is returned to the requestor, and index mapping metadata for restricted indices can also be retrieved through the same mechanism. No public exploit code has been identified at time of analysis; vendor-released fixes are available in versions 8.19.18, 9.3.7, and 9.4.4.
Missing authorization in Universal Software Inc. FlexCity (versions 5.536.0 through 11052026) exposes sensitive data to low-privileged authenticated users who can bypass access control security levels. The vulnerability (CWE-862) allows network-accessible exploitation with low attack complexity, resulting in high confidentiality impact with no integrity or availability loss. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low-privilege network vector makes this a realistic internal threat in any environment running affected versions.
Clickjacking (UI redressing) in the WebExtensions component of Firefox for Android allows a network-based attacker to hijack user interactions, resulting in high-integrity impact against the victim's browser session. All Firefox for Android versions prior to 153 are affected; Mozilla has released a fix in Firefox 153. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Denial-of-service in Oracle TimesTen In-Memory Database 26.1.1.1.0 allows unauthenticated attackers on the same network segment to crash or indefinitely hang the database service via the ttcserver component. The adjacent-network vector (AV:A) constrains reachability to the local physical or logical segment, but once positioned, exploitation requires no credentials and no user interaction, making the crash frequently repeatable. No public exploit code or active exploitation has been identified at time of analysis.
Release attachment extension allowlist bypass in Gitea before v1.27.0 lets any authenticated repository write-permission holder rename an existing release attachment to a forbidden extension (e.g., .exe, .html, .svg) via the web release edit form, silently defeating the operator-configured `Repository.Release.AllowedTypes` enforcement. This is a variant of CVE-2025-68939: the parent fix (PR #32151) patched the API edit endpoint but left the web `EditReleasePost` handler unguarded, constituting CWE-424 (Improper Protection of Alternate Path). A self-contained Python PoC (GITEA-R007) is publicly available demonstrating end-to-end exploitation; no CISA KEV listing at time of analysis.
Weak password policy enforcement in HCL MyCloud exposes authenticated accounts to brute-force and credential-stuffing attacks, potentially enabling unauthorized account takeover. The flaw is classified under CWE-521 (Weak Password Requirements), meaning the platform fails to enforce sufficient password strength constraints on users. Despite tags indicating Information Disclosure risk, no public exploit code or active exploitation has been identified at time of analysis, and the vendor-assigned CVSS score of 3.1 reflects a Low severity rating.
Server-side request forgery in Gitea's repository migration feature allows authenticated low-privilege users to bypass the SSRF allow/block-list filter by supplying an attacker-controlled DNS hostname that returns both a permitted public IP and a blocked private or loopback IP. Because the pre-flight validation accepts the hostname if any single resolved IP is permitted (OR logic), and because the subsequent `git clone --mirror` subprocess performs an independent DNS resolution with no binding to the validated IP set, an attacker can cause Gitea to connect to internal-only Git services and exfiltrate their contents into an attacker-controlled repository. No public exploit identified at time of analysis, but a functional proof-of-concept reproducer is included in the advisory and has been confirmed by the reporter against a specific Gitea commit.
Local authentication bypass in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component) versions 22.3 through 26.5 allows a low-privileged attacker with infrastructure logon access to gain complete unauthorized read access to all CRM data, including critical records. The scope change in the CVSS vector confirms that exploitation can cascade to impact additional products integrated with the Siebel environment, amplifying data exposure beyond the initial target. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-tenant authorization bypass in Plane's asset-management API allows any authenticated workspace member to read, delete, or duplicate file assets belonging to an entirely different workspace on the same instance, affecting all releases through 1.3.0. The API endpoints accept a workspace slug and asset ID as path parameters but perform no membership verification against the requesting user's session, returning presigned file URLs and permitting destructive operations across tenant boundaries. No public exploit has been identified at time of analysis, and EPSS exploitation probability stands at 0.15% (5th percentile), though the attack is mechanically straightforward for any authenticated user who can enumerate workspace slugs and asset IDs.
Unauthorized critical data disclosure in Oracle Agile Engineering Data Management 6.2.1 is achievable by a low-privileged attacker with local infrastructure access, exploiting a weakness in the Install component to bypass authentication controls and reach protected data. The scope change (S:C) means successful exploitation can cascade into unauthorized access across additional Oracle Supply Chain products beyond EDM itself. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and absence of user interaction make this straightforward to exploit given local footing.
Local privilege escalation via authentication bypass in Oracle Agile PLM 9.3.6 allows a low-privileged attacker with existing local infrastructure access to gain unauthorized read access to all PLM-accessible data, with confirmed scope change effects that may extend compromise to additional Oracle supply chain products. The CVSS vector (AV:L/PR:L/S:C/C:H) confirms exploitation is constrained to local infrastructure foothold but produces high-impact confidentiality loss across trust boundaries. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Local privilege escalation via authentication bypass in Oracle Application Object Library (AOL) Core component exposes critical data across Oracle E-Business Suite 12.2.3 through 12.2.15. A low-privileged attacker with local system access can bypass authentication controls within AOL Core, gaining unauthorized read access to critical or complete AOL-accessible data - and, due to a confirmed scope change, potentially compromising additional integrated EBS products beyond AOL itself. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Local privilege escalation via authentication bypass in Oracle Payroll (E-Business Suite) versions 12.2.3 through 12.2.15 enables a low-privileged user with infrastructure logon to gain complete unauthorized read access to all Oracle Payroll data, with scope change indicating potential lateral impact to additional EBS components. The CVSS vector confirms local attack vector with low complexity and no user interaction required, making this straightforwardly exploitable by any authenticated OS-level user on the Payroll host. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle's 'easily exploitable' language in the advisory warrants prompt patching for any internet-adjacent or multi-tenant EBS deployment.
Local authentication bypass in the Kubernetes Operator component of Oracle TimesTen In-Memory Database 26.1.1.1.0 allows a low-privileged attacker with infrastructure access to read all data managed by the database, including critical application data. The CVSS scope change (S:C) confirms that exploitation can cascade beyond the target instance, impacting additional workloads or containers sharing the Kubernetes environment - a meaningful amplifier in multi-tenant deployments. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the Authentication Bypass tag suggests the Operator fails to enforce access controls on a locally accessible interface or API, making exploitation straightforward once infrastructure access is established.
Local authentication bypass in Oracle JDeveloper's ADF Faces component exposes critical data to low-privileged local users on versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope change (S:C) indicates successful exploitation can extend beyond JDeveloper itself to impact additional Oracle Fusion Middleware products sharing the same infrastructure. No public exploit has been identified at time of analysis, and neither EPSS data nor a CISA KEV listing is available - however, the low attack complexity and no user interaction requirement make exploitation straightforward once local access is established.
Local privilege escalation in Oracle Data Integrator's Patchset Assistant component allows low-privileged users with host logon access to bypass internal authorization controls and gain complete read access to all data accessible by the ODI process across versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS scope change designation (S:C) confirms that successful exploitation can cascade beyond ODI itself to impact additional Oracle Fusion Middleware products and any data systems connected through ODI integration pipelines. No public exploit code has been identified at time of analysis, and exploitation is constrained to attackers with existing local host access.
Address bar spoofing in Mozilla Firefox (all versions prior to 153) enables a remote, unauthenticated attacker to misrepresent the displayed origin in the browser's address bar, the primary trust signal users rely on to validate site authenticity. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms exploitation is low-complexity and requires only a single user interaction - navigating to a crafted page - with no authentication or special privileges needed from the attacker. No public exploit has been identified and EPSS sits at 0.13% (3rd percentile), indicating limited exploitation activity; however, the integrity of user trust decisions is fully undermined when the flaw is triggered, making it an effective phishing enabler.
Local privilege abuse in Oracle Applications DBA (E-Business Suite component: Internal Operations) allows a low-privileged authenticated user with local system access to achieve full confidentiality compromise of DBA-accessible data, with scope change enabling impact on additional Oracle products beyond the directly targeted component. Affected versions span 12.2.3 through 12.2.15, covering a broad range of the E-Business Suite 12.2 release train. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle's own advisory classifies the vulnerability as 'easily exploitable,' lowering the bar for threat actors with local infrastructure access.
Kernel heap exhaustion in Zephyr RTOS affects all builds with CONFIG_USERSPACE enabled from v1.12.0 through v4.4.1, allowing any low-privilege user thread to permanently leak kernel memory by supplying a forged object handle to k_poll(). The z_vrfy_k_poll() syscall verifier allocates a kernel-side event copy but, prior to the fix, killed the calling thread via K_OOPS without freeing that buffer - a path any user thread can trigger repeatedly. By spawning additional threads that inherit the parent's resource_pool, an attacker can multiply the leak rate until the shared kernel heap is depleted, causing system-wide denial of service affecting queues, message buffers, and all future k_poll calls. No public exploit code or CISA KEV listing has been identified at time of analysis.
Confidentiality and integrity compromise in Oracle Security Service 12.2.1.4.0 (Oracle SSL API component within Oracle Fusion Middleware) allows a low-privileged, network-connected attacker to gain unauthorized read and write access to critical data managed by the service over TLS. Tagged as an Authentication Bypass by ENISA EUVD (EUVD-2026-47416) and reported by Oracle's security team via the July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 score of 6.4 due to high attack complexity and mandatory human interaction, significantly constraining real-world exploitability. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Agile Engineering Data Management 6.2.1 contains an authentication bypass in its Install component, reachable over HTTP by low-privileged network attackers, that enables complete unauthorized read and write access to all application data. Exploitation requires both high attack complexity and active human interaction from a victim - limiting opportunistic exploitation - but successful attacks yield critical confidentiality and integrity compromise with no availability impact. No public exploit has been identified at time of analysis; Oracle addressed this in the Critical Patch Update for July 2026.
Oracle JD Edwards EnterpriseOne Configurator 9.2 exposes its Configuration Management component to a medium-severity network attack over HTTP that can cause repeated crashes or hangs alongside limited unauthorized data read and write. A low-privileged attacker who can reach the application over the network may - under high-complexity conditions - deny service to all Configurator users and access or modify a subset of configuration data. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the high attack complexity materially reduces the likelihood of opportunistic mass exploitation.
Stored Cross-Site Scripting in the Essential Addons for Elementor WordPress plugin (versions ≤ 6.6.11) allows authenticated contributors to inject persistent JavaScript payloads via the Fancy Text Widget, executing in any visitor's browser upon page load. Source code analysis confirms two distinct sink defects: the bundled Morphext library used unsafe `innerHTML` assignment for both phrase text and animation class names, and the widget's transition-type parameter was passed unsanitized to Morphext as a CSS class token without allowlist validation. No active exploitation is confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; however, the scope-change (S:C) CVSS vector and contributor-accessible attack surface make this a credible risk on multi-author WordPress deployments.
Oracle Order Management's Product Diagnostic Tools component in E-Business Suite versions 12.2.3 through 12.2.15 can be compromised by a low-privileged authenticated attacker over HTTP, resulting in unauthorized read and write access to Order Management data. The scope change (S:C in CVSS) indicates successful exploitation can cascade to impact additional Oracle EBS modules beyond Order Management itself. Tagged as an Authentication Bypass, no public exploit has been identified at time of analysis, though the patch is included in Oracle's CPU July 2026 release.
Full system takeover of Oracle Communications Convergent Charging Controller (Prov IF component) is achievable by a high-privileged network attacker exploiting a difficult-to-trigger flaw over HTTP in versions 15.0.0.0.0 and 15.2.0.0.0. The attack requires human interaction from a third party in addition to prior high-privilege access, making opportunistic exploitation unlikely. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog at time of analysis, though the complete confidentiality, integrity, and availability impact warrants patching within standard enterprise patch cycles.
Stored Cross-Site Scripting in the Essential Addons for Elementor WordPress plugin (all versions through 6.6.11) allows authenticated contributors to persist malicious JavaScript via the Reading Progress Global Color Settings feature, executing against any user who subsequently visits an affected page. The vulnerability stems from insufficient sanitization in the plugin's Elements and Core traits, with a scope change (S:C) meaning impact extends beyond the plugin itself to victim browser sessions. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept is referenced in available intelligence.
Full takeover of Oracle Inventory Management (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a high-privileged attacker with local infrastructure access exploiting a flaw in the Internal Operations component. The CVSS vector (AV:L/AC:H/PR:H) places this firmly in the category of post-compromise or insider-threat scenarios rather than remote opportunistic attacks, yet the confirmed C:H/I:H/A:H impact means a successful exploitation yields complete control of the affected instance. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Full takeover of Oracle MySQL Server and MySQL Cluster is achievable by a high-privileged local attacker exploiting a flaw in the Group Replication Group Communication System (GCS) component across multiple supported release trains. Affected deployments span MySQL Server 8.4.x and 9.7.x, and MySQL Cluster 8.0.x, 8.4.x, and 9.7.x. Despite the CVSS score of 6.4 being mid-range, the CIA impact triple (C:H/I:H/A:H) indicates complete compromise of the database instance; however, the local attack vector (AV:L), high complexity (AC:H), and high privilege requirement (PR:H) substantially constrain real-world exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of MySQL Server and MySQL Cluster is possible through a difficult-to-exploit flaw in the Server: Replication component, affecting MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Despite a moderate CVSS base score of 6.4, the impact triad is complete (C:H/I:H/A:H), meaning successful exploitation grants an attacker full control over data confidentiality, integrity, and service availability. No public exploit code exists and no confirmed active exploitation has been identified at time of analysis, with exploitation gated by local infrastructure access and high privilege requirements.
Full takeover of Oracle MySQL Server and MySQL Cluster is possible through a local, high-complexity vulnerability in the Clone Plugin component, affecting MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1, and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. Exploitation requires an attacker with high privileges and local logon access to the host infrastructure where MySQL executes, under difficult-to-achieve conditions, limiting realistic risk despite the full confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, and Oracle disclosed this via the July 2026 Critical Patch Update.
Oracle VM VirtualBox 7.2.12 Core component allows a low-privileged local attacker, under high-complexity conditions, to break VM isolation boundaries and compromise data integrity of the hypervisor and potentially adjacent systems. Successful exploitation can result in unauthorized creation, deletion, or modification of critical VirtualBox-accessible data, along with partial denial of service. No public exploit has been identified and this CVE is not listed in CISA KEV at time of analysis, but the scope change (S:C) elevates priority in multi-tenant or shared-host VirtualBox deployments where VM boundary integrity is a security guarantee.