Broad data compromise in Oracle Customers Online (part of Oracle E-Business Suite, component: Internal Operations) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High), it carries full confidentiality and integrity impact with no availability impact, and Oracle tags it as an authentication-bypass-class weakness. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and modest privilege requirement make it a high-priority fix.
Data compromise in Oracle Process Manufacturing Systems (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with network HTTP access read, create, modify, or delete all data accessible to the Process Manufacturing module. Oracle rates it 8.1 (High) with confidentiality and integrity impact but no availability impact, and describes it as 'easily exploitable.' No public exploit identified at time of analysis; the fix ships in the Oracle Critical Patch Update of July 2026.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll (Oracle E-Business Suite 12.2.9 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, delete, or modify all HRMS (UK)-accessible data over HTTP. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impacts and no availability impact, Oracle describes it as easily exploitable and tags it as an authentication-bypass class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Banking Trade Finance 14.6.0 through 14.8.0 (Infrastructure component) allows a low-privileged, network-authenticated attacker to read, create, modify, or delete all data accessible to the application over HTTP. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact), this is an easily exploitable flaw requiring no user interaction, disclosed in the Oracle July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Banking Trade Finance versions 14.6.0 through 14.8.0 (Infrastructure component) allows a low-privileged, network-based attacker to read, create, modify, or delete all data accessible to the application over HTTP. Oracle rates this 8.1 (CVSS 3.1) with high confidentiality and integrity impact but no availability impact, and no user interaction required. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; the vendor's own 'Authentication Bypass' tag suggests weak access-control enforcement despite a nominal low-privilege requirement.
Data compromise in Oracle Loans (Internal Operations component of Oracle E-Business Suite 12.2.3-12.2.15) allows a low-privileged attacker with network HTTP access to read, create, delete, or modify all Loans-accessible data. The flaw yields high confidentiality and integrity impact without affecting availability, and carries a CVSS 3.1 base score of 8.1. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Financials Common Country (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1, the flaw affects EBS versions 12.2.3 through 12.2.15 and impacts confidentiality and integrity but not availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it appears in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle E-Business Suite's Oracle Process Manufacturing Product Development component (versions 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the module. Rated CVSS 8.1 with high confidentiality and integrity impact but no availability impact, it is addressed in Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, though the 'easily exploitable' characterization by Oracle and low attack complexity raise concern for internet-exposed EBS instances.
Unauthorized data access and manipulation in Oracle iRecruitment (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-adjacent attacker read, create, delete, or modify all iRecruitment-accessible data over HTTP. The high CVSS 3.1 score of 8.1 reflects complete confidentiality and integrity compromise of the module with only a low-privilege account required and no user interaction. No public exploit identified at time of analysis, and it is not on CISA KEV; the vendor-supplied fix ships in the Oracle Critical Patch Update of July 2026.
Broad data compromise in Oracle Customers Online (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, allows a low-privileged attacker with network HTTP access to read, create, modify, and delete all data accessible to the application. The CVSS 3.1 base score is 8.1 (C:H/I:H) reflecting high confidentiality and integrity impact with no availability effect. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Process Manufacturing (OPM) Logistics, a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows a low-privileged authenticated attacker with network access over HTTP to read, create, delete, or modify all data accessible to the OPM Logistics component. The flaw is rated CVSS 3.1 8.1 (high) with confidentiality and integrity impact but no availability impact, and was disclosed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Landed Cost Management (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the module across supported releases 12.2.3 through 12.2.15. The flaw carries CVSS 8.1 with high confidentiality and integrity impact but no availability impact, and is remediated in the Oracle Critical Patch Update of July 2026. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Process Manufacturing Systems (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read, create, delete, or modify all data accessible to the module over HTTP. Rated CVSS 3.1 8.1 with High confidentiality and integrity impact but no availability impact, it is disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the low attack complexity and network vector make it a high patch priority for EBS operators.
Data compromise in Oracle Universal Work Queue (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-based attacker read and modify all data the application can access via crafted HTTP requests. The flaw carries a CVSS 3.1 score of 8.1 with high confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though its inclusion in Oracle's July 2026 Critical Patch Update signals vendor-confirmed severity.
Data compromise in Oracle Project Portfolio Analysis (a module of Oracle E-Business Suite, Internal Operations component) allows a low-privileged remote attacker over HTTP to read, create, delete, or modify all data accessible to the application. Affected releases span EBS 12.2.3 through 12.2.15, and the CVSS 3.1 base score is 8.1 (C:H/I:H). This is a July 2026 Oracle Critical Patch Update issue with no public exploit identified at time of analysis and no CISA KEV listing, though the 'Authentication Bypass' tag and low attack complexity make it an attractive target once patch details are reversed.
Sensitive data compromise in Oracle E-Business Tax (component: Internal Operations), part of Oracle E-Business Suite releases 12.2.3 through 12.2.15, allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the E-Business Tax module. Oracle rates it CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and it is remediated in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Remote data compromise in Oracle E-Business Tax (Oracle E-Business Suite, Internal Operations component) allows a low-privileged authenticated attacker with HTTP network access to read, create, delete, or modify all E-Business Tax accessible data. Affecting supported versions 12.2.3 through 12.2.15, the flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; it was reported by Oracle's own security team and addressed in the July 2026 Critical Patch Update.
Data compromise in the Oracle Public Sector Human Resources module of Oracle E-Business Suite (Regression Testing component) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify any data accessible to the application. The flaw affects EBS releases 12.2.3 through 12.2.15 and carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but as an internet-facing Oracle EBS component it is a plausible target once the July 2026 CPU details are studied.
Data compromise in Oracle HRMS (France), the French HR component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the module. The flaw is tagged as an authentication bypass and carries CVSS 8.1 with high confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Treasury (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read, create, delete, or modify all Treasury-accessible data over HTTP. Oracle rates it CVSS 3.1 8.1 (high confidentiality and integrity impact, no availability impact), and it is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized read and write access to Oracle SDP Number Portability (Oracle E-Business Suite, Internal Operations component) is achievable by a low-privileged, network-based attacker over HTTP in versions 12.2.3 through 12.2.15. Oracle rates this 8.1 (High) with high confidentiality and integrity impact, allowing an authenticated user to create, delete, or modify all data accessible to the module. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network reach make it a notable patching priority in the July 2026 Critical Patch Update.
Data compromise in Oracle Service Fulfillment Manager (Fulfillment Engine component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, modify, or delete all data accessible to the module over HTTP. Rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle labels it easily exploitable. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and Oracle's 'easily exploitable' wording make it a strong patch priority for EBS operators.
Data compromise in Oracle E-Business Suite Inventory Management (Core Receiving component, versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read, create, delete or modify all data accessible to the Inventory Management module over HTTP. The flaw is rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, and is trivially exploitable (AC:L) once the attacker holds any valid low-privilege EBS session. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the 'Authentication Bypass' tag suggests the flaw may let a low-privilege account reach functionality or data it should not.
Data compromise in Oracle E-Business Suite's Installed Base module (Create Item Instance component) lets a low-privileged, network-authenticated attacker read, create, delete, or modify all Installed Base data across releases 12.2.3 through 12.2.15. The CVSS 3.1 base score is 8.1 (C:H/I:H, no availability impact), reflecting full read/write compromise of the module's data without affecting uptime. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector make it a high-priority patch item for EBS operators.
Unauthorized data compromise in Oracle Trade Management (Oracle E-Business Suite, Claim LOV component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with network HTTP access read, create, delete, or modify all data accessible to the application. The CVSS 3.1 base score is 8.1 (C:H/I:H, no availability impact), reflecting high confidentiality and integrity loss without affecting uptime. No public exploit identified at time of analysis, and the flaw is fixed in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Trade Management (Claim LOV component) of Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged, network-adjacent attacker read, create, delete, or modify all data accessible to the module over HTTP. The flaw carries a CVSS 3.1 base score of 8.1 (high confidentiality and integrity impact, no availability impact) and was disclosed in Oracle's July 2026 Critical Patch Update. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Advanced Pricing (Pricing Installation component of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker to read, create, modify, or delete all data accessible to the application over HTTP. Oracle rates it CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Elevated data compromise in Oracle E-Business Suite's Customer Support module (Update Service Request component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read and modify all Customer Support-accessible data. The flaw carries high confidentiality and integrity impact (CVSS 8.1) but no availability impact, and Oracle rates it easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; remediation is delivered via Oracle's July 2026 Critical Patch Update.
Broken access control in the Shopping Cart component of Oracle iStore (part of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, modify, or delete all data accessible to the iStore application over HTTP. Tagged as an authentication-bypass class issue, it carries a CVSS 3.1 base score of 8.1 driven by high confidentiality and integrity impact with no availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle TeleSales (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all TeleSales-accessible data. The flaw is rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and is tagged as an authentication-bypass-class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Trading Community (Oracle E-Business Suite, Party Search UI component) allows a low-privileged attacker with network HTTP access to read and modify all data accessible to the Trading Community module. Fixed in the Oracle Critical Patch Update of July 2026 (CPUJUL2026), the flaw affects EBS releases 12.2.3 through 12.2.15 and carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; the vendor tag 'Authentication Bypass' suggests the Party Search UI may permit access beyond the attacker's intended authorization scope.
Unauthorized data compromise in Oracle Payments (Oracle E-Business Suite, File Transmission component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the Payments module over HTTP. Oracle rates it CVSS 8.1 with high confidentiality and integrity impact but no availability impact, and it is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor 'Authentication Bypass' tag and low attack complexity make it an attractive target in EBS-exposed environments.
Data compromise in Oracle Complex Maintenance, Repair and Overhaul (cMRO), a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows a low-privileged authenticated attacker with HTTP network access to read and modify critical application data. The flaw affects the Internal Operations component and yields high confidentiality and integrity impact (CVSS 8.1) with no availability effect. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a fix ships in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Assets (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all Oracle Assets-accessible data. The CVSS 3.1 base score is 8.1 with high confidentiality and integrity impact but no availability impact, reflecting a data-integrity and disclosure risk rather than a service outage. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Compromise of Oracle Cost Management (Internal Operations component) in Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the module, resulting in high confidentiality and integrity impact but no availability impact. The flaw is rated easily exploitable (CVSS 3.1 8.1, PR:L) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle E-Business Intelligence (Definition component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the product. The CVSS 3.1 vector (8.1) reflects High confidentiality and integrity impact with no availability effect, meaning an authenticated user can escalate their reach to critical business intelligence data without needing elevated roles. No public exploit identified at time of analysis, and the flaw is addressed in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Price Protection (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with network HTTP access to read, create, delete, or modify all Price Protection-accessible data. The flaw carries a CVSS 3.1 base score of 8.1 (C:H/I:H) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in the Oracle Process Manufacturing (OPM) Inventory module of Oracle E-Business Suite 12.2.3-12.2.15 lets a low-privileged, authenticated network attacker read and modify all OPM Inventory-accessible data over HTTP. Rated CVSS 3.1 8.1 (High) for combined Confidentiality and Integrity impact with no availability effect, it was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis, and it is not on CISA KEV.
Data compromise in Oracle U.S. Federal Financials (a module of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets an authenticated low-privileged attacker reach the Internal Operations component over HTTP and read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impact but no availability impact; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Disclosed via Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 (Research Tracking component) lets a low-privileged, network-authenticated attacker over HTTPS read, create, delete, or modify all data accessible to the module. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact), it was disclosed in Oracle's July 2026 Critical Patch Update and is tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broad data compromise in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (Fusion Middleware REST WebServices component) lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the identity platform. Tagged as an authentication-bypass class issue with CVSS 3.1 8.1, it grants high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis, and it is addressed in the Oracle Critical Patch Update of July 2026.
Data compromise in Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 (OUD Core component of Oracle Fusion Middleware) allows a low-privileged, network-adjacent attacker to read, create, delete, or modify all directory-accessible data over LDAP. Rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, the flaw is described by Oracle as 'easily exploitable' and is tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle E-Business Suite's Document Management and Collaboration module (Attachments component) lets a low-privileged, network-adjacent attacker read, create, modify, or delete all data accessible to the module across supported releases 12.2.3 through 12.2.15. Oracle rates it CVSS 8.1 with high confidentiality and integrity impact but no availability effect, and flags it as 'easily exploitable' - meaning any authenticated EBS user can weaponize it over HTTP. There is no public exploit identified at time of analysis and it is not on CISA KEV, but Oracle EBS Attachments flaws have historically been high-value targets.
Data compromise in Oracle Product Hub (Oracle E-Business Suite Item Catalog component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, delete, or modify all Product Hub-accessible data. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impact with no availability effect. No public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle E-Business Suite flaws are attractive targets and this issue is fixed in the July 2026 Critical Patch Update.
Data compromise in Oracle Universal Work Queue (Oracle E-Business Suite component UWQ Server Issues), versions 12.2.3 through 12.2.15, lets a remote unauthenticated attacker read and modify all UWQ-accessible data (C:H/I:H) by luring an authenticated user into interacting with attacker-supplied content over HTTP. The CVSS 3.1 base score is 8.1, driven by high confidentiality and integrity impact with no availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.
Memory corruption in Zephyr RTOS v4.3.0 and v4.4.0 lets any device acting as the I2C bus master corrupt an adjacent target device through the unauthenticated MCTP-over-I2C+GPIO target binding. By selecting the data pseudo-register and writing a byte before sending the length register, an attacker triggers a write through an unallocated (NULL) mctp_pktbuf pointer, and a separate write-then-check bug permits a one-byte heap overflow past data[255]; both yield memory corruption or a hard fault. No public exploit identified at time of analysis, and it is not on CISA KEV, but a vendor patch and security advisory are available.
Unauthorized data compromise in Oracle Contracts Integration (Internal Operations component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. The flaw carries a CVSS 3.1 base score of 8.1 (high confidentiality and integrity impact, no availability impact) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Lease and Finance Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-adjacent attacker to read, create, delete, or modify all application-accessible data over HTTP. The CVSS 3.1 base score is 8.1 (C:H/I:H), reflecting full confidentiality and integrity impact with no availability effect. This CVE was disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Process Manufacturing Regulatory Management (a component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the component. Oracle rates it CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not in CISA KEV; an 'Authentication Bypass' tag is noted in intelligence sources but is not corroborated by the CVSS vector, which requires low privileges (PR:L).
Data compromise in Oracle Identity Manager (OIM Legacy UI component) versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the identity platform. The flaw is tracked in Oracle's July 2026 Critical Patch Update and carries a CVSS 3.1 score of 8.1 with high confidentiality and integrity impact. No public exploit has been identified at time of analysis, but the low attack complexity and network vector make it a strong patching priority for enterprise IAM deployments.