Cross-privilege data compromise in Oracle PeopleSoft Enterprise HCM Global Payroll for Switzerland 9.2 lets a low-privileged, network-based attacker read, alter, or delete critical payroll data and, because of a scope change, impact other integrated PeopleSoft products beyond the vulnerable module. The flaw is rated CVSS 3.1 8.2 (high) with confidentiality and integrity impact but no availability impact, and it is difficult to exploit (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV; the fix is delivered through the Oracle July 2026 Critical Patch Update.
Data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-based attacker read, create, delete, or modify all data accessible to the application. Because the flaw carries a scope change, successful exploitation may also significantly impact products beyond WebCenter Content itself. No public exploit identified at time of analysis, and the flaw is rated difficult to exploit (AC:H); Oracle addressed it in the July 2026 Critical Patch Update.
Privileged data compromise in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1), via the Agent Next Gen component, lets a low-privileged, network-authenticated attacker read and modify all EM-accessible data over HTTPS. The scope-changing flaw (S:C) means impact extends beyond EM into other managed products, and the Oracle-supplied 'Authentication Bypass' tag suggests trust/privilege boundaries can be crossed. No public exploit identified at time of analysis; high attack complexity (AC:H) tempers real-world exploitability.
Complete denial of service in the RDBMS component of Oracle Database Server 23.4.0 through 23.26.2 lets an unauthenticated remote attacker reach the database over Oracle Net and trigger a hang or repeatable crash, and additionally gain unauthorized update, insert, or delete access to some database-accessible data. Rated CVSS 3.1 8.2 (High) with network attack vector and low complexity, it requires no privileges or user interaction, making it easily exploitable per Oracle's advisory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure in Atlassian Confluence Data Center allows an unauthenticated remote attacker to read sensitive information from affected instances, carrying a CVSS 4.0 score of 8.2 (High). The flaw was introduced across a wide span of releases (7.17.0, 7.19.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 10.0.2, 10.1.0, 10.2.0) and was found internally by Atlassian. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, unauthenticated nature makes patching a priority for internet-facing deployments.
Unauthenticated data compromise in Oracle Supply Chain Trading Connector (Collaboration History component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows remote attackers to read all data accessible to the product over HTTP and make limited unauthorized modifications. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 8.2, the flaw is tagged as an authentication bypass and requires no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network exposure make it a strong patching priority for EBS operators.
Unauthenticated data compromise in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0) lets a remote attacker reach the BI Platform Security component over HTTP and read all BI-accessible data plus perform limited unauthorized writes. Oracle rates it CVSS 3.1 8.2 and the reporter tags it an authentication bypass, meaning no credentials are needed against affected default deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and no-privilege requirement make it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Unauthorized data access in Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 (OUD Core component) lets a remote unauthenticated attacker abuse the LDAP interface to read critical directory data and make limited unauthorized modifications. Rated CVSS 8.2 and flagged by Oracle as easily exploitable, the flaw is tagged as an authentication bypass, meaning directory contents can be reached without valid credentials. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote unauthenticated denial-of-service and partial information disclosure affects Oracle MySQL Server 8.4.0-8.4.10 and 9.7.0-9.7.1 (and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1) through the Server: X Plugin component. An attacker with only network access, using multiple protocols, can trigger a hang or repeatable crash (complete DoS) and read a subset of accessible data, carrying an Oracle-assigned CVSS 3.1 score of 8.2. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in the Oracle HRMS (UK) module of Oracle E-Business Suite (Internal Operations component) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify critical HR data, with a scope change that lets attacks significantly impact other products beyond HRMS. Rated CVSS 3.1 8.2 (High) with high confidentiality and integrity impact but no availability impact, and flagged by Oracle as difficult to exploit (AC:H). At the time of analysis there is no public exploit identified and no CISA KEV listing, so exploitation appears theoretical rather than active.
Privilege-scoped data compromise in Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a low-privileged, authenticated attacker with LDAP network access read and modify all directory-accessible data, with a scope change that can significantly impact other integrated products. Rated CVSS 3.1 8.2 (C:H/I:H, no availability impact) and tagged as an authentication-bypass class issue, though the attack is rated hard to execute (AC:H). No public exploit identified at time of analysis and it is not on CISA KEV.
Cross-site-scripting-style compromise in Oracle MES for Process Manufacturing (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a remote unauthenticated attacker steal or fully read Oracle MES-accessible data and make limited unauthorized changes by luring a legitimate user into interacting with a crafted HTTP request. The scope-changing nature (S:C) means a successful attack can significantly impact products beyond MES itself, typically the victim's authenticated session context. No public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle rates it CVSS 8.2.
Broken authorization in MediaCMS 8.2.0 lets any authenticated user read private media metadata belonging to other users by injecting arbitrary media tokens into their own playlist. Because the playlist API skips ownership and state validation on PUT, an attacker who knows or guesses a target media token can then fetch their playlist and read otherwise-private fields (title, description, view/like counts, file size, author username, encoding status) via the unfiltered owner branch of the playlist detail view. No public exploit identified at time of analysis and the flaw is not in CISA KEV; a vendor patch is reported as available.
MAC tag forgery in Google Tink (tink-java and tink-android) is enabled by a non-constant-time comparison in the ChunkedMacVerification object, which leaks per-byte matching progress through response-timing differences. An attacker who can submit many verification attempts and measure timing can reconstruct a valid MAC tag byte-by-byte, defeating the integrity/authenticity guarantee the MAC is meant to provide. Reported by Google and tracked in tink-java issue #75; no public exploit identified at time of analysis, and the CVSS 4.0 score is 8.2 driven entirely by integrity impact.
Unauthorized data access in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eSettlements component) lets an unauthenticated attacker on the adjacent network segment read confidential PeopleSoft data and make limited unauthorized modifications. The flaw carries a scope change, so a successful attack can significantly impact products beyond the vulnerable module. No public exploit identified at time of analysis, and no EPSS or KEV signal is provided; the 8.2 CVSS score is driven by high confidentiality impact plus scope change rather than remote internet exploitability.
Missing authorization in FOG Project (fogproject) before 1.5.10.1832 and 1.6.0-beta.2313 lets a remote unauthenticated attacker invoke the clearAES and clearPMTasks methods of FOGPage through the public 'client' node endpoint using a single HTTP GET, wiping host AES imaging-encryption credentials and deleting all power-management scheduled tasks. No login, session, or CSRF token is required, so any attacker who can reach the FOG web server can degrade imaging integrity and disrupt scheduled operations. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the trivial GET-based trigger makes weaponization straightforward.
Sensitive data disclosure and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) let a low-privileged, network-based attacker read all data accessible to the application and hang or repeatedly crash the service over HTTP. Rated CVSS 3.1 8.1 (High) with confidentiality and availability impact but no integrity impact. Disclosed in the Oracle July 2026 Critical Patch Update; no public exploit identified at time of analysis and not listed in CISA KEV.
Unauthorized read and write access to Oracle US Federal Human Resources (the Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-based attacker over HTTP, with no user interaction. Successful exploitation lets the attacker view, create, delete, or modify all data accessible to the module, carrying a CVSS 3.1 base score of 8.1 (high confidentiality and integrity impact, no availability impact). Fixed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and no CISA KEV listing.
Data compromise in Oracle Telecommunications Billing Integrator (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read and modify all data accessible to the application. Rated CVSS 3.1 8.1 for high confidentiality and integrity impact with no availability effect, and disclosed in Oracle's July 2026 Critical Patch Update. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Time and Labor (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the Time and Labor module. Scored CVSS 3.1 8.1 (C:H/I:H, no availability impact), it is easily exploitable per Oracle but requires an existing low-privilege account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; fixes ship in the Oracle Critical Patch Update of July 2026.
Data compromise in Oracle Learning Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read and modify all data accessible to the application. The flaw is rated CVSS 8.1 and tagged as an authentication bypass, meaning a limited account can escalate to full read/write over critical Learning Management data. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Risk Management (part of Oracle E-Business Suite 12.2.3 through 12.2.15, Internal Operations component) allows a low-privileged remote attacker with HTTP access to read, create, modify, or delete all data accessible to the application. The flaw carries a CVSS 3.1 base score of 8.1 (high confidentiality and integrity impact, no availability impact) and is rated by Oracle as easily exploitable, though authentication with at least low privileges is required. There is no public exploit identified at time of analysis and no CISA KEV listing.
Data compromise in Oracle Project Contracts (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the module. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact), it is described by Oracle as easily exploitable and requires only authenticated network access. No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
SQL-layer compromise in Oracle Demand Signal Repository (part of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High), the flaw yields full confidentiality and integrity impact but no availability impact. No public exploit is identified at time of analysis and it is not in CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.
Full server takeover in Oracle Communications Converged Application Server 8.2 and 8.3 (Core component) is possible for an unauthenticated remote attacker over TCP/IP, per Oracle's July 2026 Critical Patch Update. Successful attacks yield high confidentiality, integrity, and availability impact (CVSS 3.1 8.1), but the attack is rated high-complexity (AC:H), meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, indicating no confirmed active exploitation.
Full product takeover of Oracle Agile PLM 9.3.6 (Product Lifecycle Management) is possible by an unauthenticated remote attacker over HTTP against the Security component, per Oracle Critical Patch Update July 2026. The CVSS 3.1 base score is 8.1 with high attack complexity, meaning exploitation is difficult and likely requires specific conditions or timing to succeed, but a successful attack yields complete compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was supplied.
Full product takeover in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Forge component) lets an unauthenticated remote attacker compromise confidentiality, integrity and availability over HTTP, per Oracle's CVSS 3.1 8.1 rating. Exploitation is rated high-complexity (AC:H), so it requires specific conditions or timing rather than a trivial single request. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Full compromise of Oracle GoldenGate 23.4 through 23.26.2 is possible via the Config Service Executable, where an unauthenticated remote attacker sending crafted HTTP traffic can achieve complete takeover with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 8.1 but explicitly flags it as difficult to exploit (AC:H), and there is no public exploit identified at time of analysis and no CISA KEV listing. Despite Oracle's own tag of 'Information Disclosure,' the described outcome is a broader system takeover, not merely data leakage.
Full takeover of Oracle WebCenter Enterprise Capture is possible via HTTP against the Client Bundle component in supported versions 12.2.1.4.0 and 14.1.2.0.0, addressed in Oracle's July 2026 Critical Patch Update. An unauthenticated remote attacker who can reach the service over the network can compromise confidentiality, integrity, and availability, though the CVSS vector rates the attack as high-complexity (AC:H), meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, so risk is currently theoretical but high-impact.
Full compromise of the Oracle PeopleSoft Enterprise FIN Common Objects Brazil module (version 9.1, eProcurement component) is possible by a remote unauthenticated attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Successful exploitation results in complete takeover of the affected component, though Oracle rates the attack as difficult to execute (high attack complexity). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle iReceivables (a self-service receivables module of Oracle E-Business Suite, AR Web Utilities component) is possible by a remote unauthenticated attacker over HTTP, affecting EBS releases 12.2.3 through 12.2.15. Successful exploitation yields complete takeover with high confidentiality, integrity, and availability impact, though the CVSS vector rates exploitation as high-complexity. Addressed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Workflow (a component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is possible by a remote unauthenticated attacker who reaches the product over SMTP, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 8.1 with high confidentiality, integrity, and availability impact, but carries high attack complexity, meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle EDI Gateway (a component of Oracle E-Business Suite) is possible by an unauthenticated remote attacker over HTTP, affecting supported versions 12.2.3 through 12.2.15 per Oracle's July 2026 Critical Patch Update. Despite full confidentiality, integrity, and availability impact (CVSS 8.1), the CVSS vector rates attack complexity as high (AC:H), indicating exploitation is not trivial. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Full system takeover in Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 is possible when an unauthenticated remote attacker reaches the Web Runtime Security component over HTTP, per Oracle's July 2026 Critical Patch Update. Despite requiring no credentials, the attack is rated hard to execute (CVSS 3.1 8.1, AC:H), and success yields complete confidentiality, integrity, and availability compromise of the Tools layer. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Full compromise of Oracle WebCenter Sites (Fusion Middleware) is possible over the network by an unauthenticated attacker via HTTP, resulting in complete product takeover with high confidentiality, integrity, and availability impact. Supported versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and Oracle addresses it in the July 2026 Critical Patch Update. The high attack complexity (AC:H) tempers real-world risk, and there is no public exploit identified at time of analysis and no CISA KEV listing.
Full compromise of Oracle SOA Suite is possible through its B2B Engine component, where an unauthenticated remote attacker sending crafted HTTP traffic can achieve complete takeover of the affected instance. Oracle Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0 are affected, with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.1). Oracle rates the flaw as difficult to exploit (AC:H), and there is no public exploit identified at time of analysis and no CISA KEV listing.
Complete takeover of Oracle Unified Directory (OUD Core) is possible when a remote, unauthenticated attacker exploits a flaw reachable over the LDAP protocol in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, per Oracle's July 2026 Critical Patch Update. Oracle rates the attack complexity as high, and a successful attack yields full confidentiality, integrity, and availability compromise (CVSS 8.1). There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so exploitation would currently be theoretical or targeted rather than commodity.
Complete takeover of Oracle Coherence (Oracle Fusion Middleware Core component) is possible when an unauthenticated attacker reaches an exposed T3 or IIOP listener over the network, affecting supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates this CVSS 3.1 8.1 with full confidentiality, integrity and availability impact but flags it as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently theoretical but severe if a working exploit emerges.
Remote takeover of Oracle WebLogic Server (Fusion Middleware, Core component) is possible by an unauthenticated attacker sending crafted traffic over the T3 or IIOP protocols against versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates it CVSS 3.1 8.1 with full confidentiality, integrity, and availability compromise, but flags high attack complexity (AC:H), meaning the flaw is difficult to exploit despite requiring no authentication. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is currently a patch-priority based on impact rather than confirmed exploitation.
Full compromise ("takeover") of Oracle's MySQL Connector/NET client library affects the ADO.NET data provider in MySQL Connectors versions 9.7.0 and 9.7.1, where an unauthenticated network attacker can seize control of the connector, impacting confidentiality, integrity, and availability of any .NET application relying on it. Rated CVSS 3.1 8.1 (High) with high attack complexity, this is a client-side flaw disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise (takeover) of Oracle Hospitality Simphony is possible when an unauthenticated attacker with network access reaches the POS component over HTTP, affecting supported versions 19.8-19.8.5, 19.9-19.9.3, and 19.10. Oracle rates this CVSS 3.1 8.1 with high confidentiality, integrity, and availability impact, but flags the attack as difficult to exploit (AC:H), meaning success depends on conditions outside the attacker's control such as timing, specific state, or reconnaissance. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Data compromise in the Oracle Human Resources module of Oracle E-Business Suite 12.2.14 through 12.2.15 (Enterprise Command Center component) lets a low-privileged attacker with HTTP network access read, create, delete, or modify all HR-accessible data. Oracle rates this 8.1 and describes it as easily exploitable, requiring only network access and a low-privilege account; there is no public exploit identified at time of analysis and it is not in CISA KEV. The high confidentiality and integrity impact with no availability impact makes this a strong patch priority for organizations running affected EBS releases.
Data compromise in Oracle Order Management (Product Diagnostic Tools component) of Oracle E-Business Suite versions 12.2.4 through 12.2.15 allows a low-privileged, network-adjacent attacker over HTTP to read, create, delete, or modify all Order Management-accessible data. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impact but no availability effect, this flaw is described by Oracle as easily exploitable and is fixed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Contracts Integration (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read and tamper with all data the module can access over HTTP. Because it is rated easily exploitable with high confidentiality and integrity impact (CVSS 8.1), any authenticated EBS user could pivot to unauthorized creation, deletion, or modification of critical contract data. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is a real but not yet demonstrated concern.
Unauthorized read and write access to critical data in Oracle Product Workbench (Internal Operations component of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to create, delete, or modify all data accessible to the application. The flaw is rated CVSS 8.1 with high confidentiality and integrity impact but no availability impact, was reported by Oracle's own security team in the July 2026 Critical Patch Update, and is tagged as an authentication-bypass-class issue. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Product Workbench (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged remote attacker with HTTP access read, create, modify, or delete all data accessible to the application. The CVSS 3.1 base score of 8.1 reflects full confidentiality and integrity loss with no availability impact. The flaw is tagged as an authentication-bypass-class issue and was disclosed by Oracle in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Data compromise in Oracle Price Protection (Internal Operations component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read, create, modify, or delete all data accessible to the Price Protection module. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, the flaw was disclosed in Oracle's July 2026 Critical Patch Update and is tagged as an authentication bypass; no public exploit identified at time of analysis.
Data compromise in Oracle Bills of Material (Internal Operations component) of Oracle E-Business Suite versions 12.2.13 through 12.2.15 allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the Bills of Material module via HTTP. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, the flaw is easily exploitable and requires only low privileges. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tag references an 'Authentication Bypass' class though the CVSS vector requires PR:L.
Unauthorized data compromise in Oracle Product Hub (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the Product Hub application. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle tags it as an Authentication Bypass. There is no public exploit identified at time of analysis and no CISA KEV listing, but it is addressed in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Process Manufacturing Financials (Internal Operations component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged, network-adjacent attacker to read, create, modify, or delete all data accessible to the module over HTTP. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impact but no availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle EBS is a recurring target for post-authentication attacks.