Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a victim's machine when that victim executes 'ansible-galaxy collection install' against the malicious git source. The flaw lives in _extract_collection_from_git() in concrete_artifact_manager.py, which builds git clone commands without a '--' end-of-options separator, letting crafted URIs be parsed as git arguments. It is an incomplete fix for CVE-2026-11332, which patched the analogous role-install path but left the collection-install path exposed; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds read and write in the Perl module Data::SpatialHash::Shared before 0.02 lets a local peer with write access to the shared backing file corrupt memory in any process that queries or inserts into the spatial hash. The attach-time validator sph_validate_header checks header scalars and region layout against file size but never validates the array contents it subsequently trusts, so poisoned bucket, next-link, and free-list indices flow unchecked into sph_walk_cell and sph_alloc_slot. No public exploit identified at time of analysis; EPSS is low (0.17%, 7th percentile) and the module is not in CISA KEV.
Local privilege escalation to full product takeover in Oracle Data Integrator (Studio component), versions 12.2.1.4.0 and 14.1.2.0.0, lets a low-privileged attacker who can log on to the host where ODI runs fully compromise the product with high confidentiality, integrity, and availability impact. Oracle rates it CVSS 3.1 7.8; there is no public exploit identified at time of analysis and it is not on the CISA KEV list. It was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update.
Full takeover of Oracle PeopleSoft Enterprise FIN Project Costing 9.2 (Projects component) is achievable by an attacker with logon access to the host infrastructure, exploiting a local flaw that requires tricking a legitimate user into performing an action. Per the CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R), exploitation is local and low-complexity but gated on human interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the issue was reported by Oracle and fixed in the July 2026 Critical Patch Update.
Arbitrary code execution in libheif 1.19.0 through 1.21.2 via a crafted HEIF file with uncompressed, tiled, component-interleaved, 4:2:0 encoding allows an attacker to overwrite a C++ vtable pointer and redirect control flow. Exploitation requires user interaction to open the malicious file, and no public exploit code is known, though EPSS indicates a low probability of widespread exploitation.
Local privilege-escalation to full takeover in Oracle Communications Billing and Revenue Management (BRM) 15.0.0.0.0-15.0.1.0.0 and 15.1.0.0.0-15.2.0.0.0 allows a low-privileged attacker with logon access to the underlying infrastructure to fully compromise the BRM Platform component, with high confidentiality, integrity, and availability impact. The flaw is rated CVSS 3.1 7.8 and was disclosed by Oracle in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because BRM is a back-office telecom billing platform, exploitation requires an existing foothold on the host rather than remote unauthenticated access.
Local privilege escalation leading to full product takeover affects the BRM Server component of Oracle Communications Billing and Revenue Management versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. A low-privileged attacker who already has a logon on the host where BRM executes can leverage this easily-exploitable flaw to fully compromise the product, gaining high impact to confidentiality, integrity and availability. No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is not confirmed in the wild; Oracle addressed it in the July 2026 Critical Patch Update.
Local privilege-based takeover of Oracle Project Foundation (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with logon access to the host infrastructure to fully compromise the component. Successful exploitation yields high confidentiality, integrity, and availability impact - effectively a complete takeover of Project Foundation. Addressed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle PeopleSoft Enterprise SCM Order Management 9.2 is possible for any low-privileged user who can log on to the infrastructure where the application runs, via a flaw in its Security component. A successful attack yields complete compromise of confidentiality, integrity, and availability of the Order Management module. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update.
Local privilege escalation to full product takeover in Oracle Communications BRM - Elastic Charging Engine (versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, 15.2.0.0.0) lets a low-privileged attacker with logon access to the host running the ECE infrastructure compromise the Diameter Gateway and SDK component. Per Oracle's CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N), exploitation is authenticated and local but easily performed, yielding high confidentiality, integrity, and availability impact (base 7.8). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Local privilege-driven takeover in Oracle E-Business Tax (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker who can log on to the host infrastructure fully compromise the E-Business Tax module. Oracle rates it CVSS 3.1 7.8 with complete confidentiality, integrity, and availability impact and describes it as easily exploitable. No public exploit was identified at time of analysis, and it is not listed in CISA KEV.
Local privilege-driven takeover in Oracle HTTP Server 14.1.2.0.0 (Oracle Fusion Middleware) lets a low-privileged attacker with logon access to the host running OHS fully compromise the server via the bundled HTTP/2 module (mod_http2.so). With a CVSS 3.1 base score of 7.8 and full confidentiality, integrity, and availability impact, successful exploitation yields complete takeover of the OHS instance. Fixed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Local privilege-based takeover in Oracle Coherence (component: Core) allows a low-privileged attacker with logon access to the host where Coherence executes to fully compromise the product, yielding high confidentiality, integrity, and availability impact. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Local privilege escalation and full compromise in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged attacker with a local logon on the host where VirtualBox executes to take over the VirtualBox installation, with high confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV; despite a vendor 'Information Disclosure' tag, the CVSS vector reports full C/I/A impact consistent with product takeover. Exploitation requires prior local access and low privileges, which limits mass exploitation but makes it valuable as a post-access escalation step.
Local privilege escalation in snap-confine - the SUID/set-capabilities helper snapd uses to build the confinement sandbox for snap applications - lets an unprivileged local user on Ubuntu 22.04, 24.04, and 26.04 LTS gain full root. The flaw only manifests where snap-confine is deployed with file capabilities (set-capabilities) instead of the traditional set-uid-root binary, where incorrect handling of ambient capabilities lets an attacker escape intended privilege boundaries and run arbitrary code as root. Reported by Canonical; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle HRMS (US) is possible in Oracle E-Business Suite versions 12.2.3 through 12.2.15 via the Internal Operations component, where a low-privileged attacker with local logon access to the hosting infrastructure can escalate to complete takeover of the HRMS module. The flaw yields high confidentiality, integrity, and availability impact (CVSS 3.1 7.8) and is fixed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation to full system takeover in Oracle Solaris 11.4 lets a low-privileged local user compromise the Filesystems component and, due to a scope change, significantly impact additional products beyond Solaris itself. Exploitation is rated difficult (high attack complexity) and requires an existing local logon, but a successful attack yields complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis; this was disclosed in the Oracle Critical Patch Update of July 2026 and is not listed in CISA KEV.
Local privilege-based takeover in Oracle GoldenGate 23.4 through 23.26.1 (Libraries component) allows a low-privileged attacker with logon access to the host running GoldenGate to fully compromise the product, with high confidentiality, integrity, and availability impact. Disclosed in Oracle's July 2026 Critical Patch Update (CVSS 3.1 base 7.8), it requires local authenticated access rather than network exploitation. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege-based takeover of Oracle HTTP Server (12.2.1.4.0 and 14.1.2.0.0) allows a low-privileged attacker with a logon session on the host to fully compromise the web server, yielding high confidentiality, integrity, and availability impact. Disclosed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.8 with a local attack vector (AV:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but complete server takeover makes it a meaningful lateral-movement and privilege-consolidation target once a foothold exists.
Local privilege escalation to full takeover in Oracle VM VirtualBox 7.2.12 on Windows hosts allows a low-privileged attacker who can log on to the host to compromise the VirtualBox Core component with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The single vendor reference is Oracle's July 2026 Critical Patch Update advisory.
Local privilege escalation to full product takeover in Oracle VM VirtualBox 7.2.12 (Core component) allows a low-privileged attacker with a logon session on the host where VirtualBox runs to fully compromise the VirtualBox instance, with high impact to confidentiality, integrity, and availability (CVSS 3.1 7.8). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV. It was disclosed by Oracle in the July 2026 Critical Patch Update.
Local privilege escalation to full takeover in the Install component of Oracle Java SE (8u491, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1), Oracle GraalVM for JDK (17.0.19, 21.0.11), and Oracle GraalVM Enterprise Edition (21.3.18) lets a low-privileged local user compromise the runtime and take it over with full confidentiality, integrity, and availability loss. Oracle rates it 7.8 (High) and describes it as easily exploitable by an attacker holding only a logon to the host. No public exploit has been identified at time of analysis and it is not on CISA KEV.
Sandbox escape in Google Chrome's Chromecast component allows a local attacker with low privileges to potentially execute arbitrary code outside the sandbox by sending malicious network traffic. Affects Chrome versions prior to 150.0.7871.182. EPSS 0.1% and no KEV listing suggest low real-world exploitation risk despite the high-severity CVSS 7.8 score.
Unauthorized data disclosure in Oracle E-Business Suite's Oracle Capacity module (Internal Operations component), versions 12.2.3 through 12.2.15, allows a low-privileged attacker with HTTP network access to read all Oracle Capacity-accessible data and, due to a scope change, impact additional connected products. The flaw is easily exploitable and requires only a low-privilege account, no user interaction. It is addressed in Oracle's July 2026 Critical Patch Update; no public exploit has been identified at time of analysis.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) allows a low-privileged attacker with network HTTP access to read all data accessible to the application. Oracle rates it CVSS 3.1 7.7 with a scope change, and the ENISA EUVD flags an authentication-bypass characteristic, meaning a minimally-authenticated actor can escalate to broad confidentiality compromise that spills into additional connected products. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle Configure to Order (Supply to Order Workbench component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read all data accessible to the application and, because of a scope change, to impact additional Oracle products beyond Configure to Order. Oracle rates it CVSS 3.1 7.7 with confidentiality-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it was reported through Oracle's own security alert channel for the July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Inventory Management (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read all data accessible to the application, with a scope change that can significantly impact other Oracle EBS products. Rated CVSS 3.1 7.7 (confidentiality-only), the flaw is easily exploitable over HTTP and is tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; fixes ship in Oracle's July 2026 Critical Patch Update.
Cross-scope confidentiality compromise in Oracle Payroll (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read all Oracle Payroll-accessible data and, because of a scope change, impact additional connected products. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication-bypass class issue, it carries a CVSS 3.1 base score of 7.7 driven entirely by high confidentiality impact with a changed scope. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and single-privilege requirement make it a credible internal-abuse risk.
Unauthorized data disclosure in Oracle Process Manufacturing (OPM) Regulatory Management, a component of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read critical application data. The flaw carries a scope change (S:C), so successful attacks can significantly impact additional products beyond OPM Regulatory Management itself. It is confidentiality-only (CVSS 3.1 7.7) and tagged as an authentication bypass; no public exploit identified at time of analysis.
Unauthorized data disclosure in Oracle MySQL Connector/J (the official MySQL JDBC driver) versions 9.7.0 through 9.7.1 allows a low-privileged attacker with network access to compromise confidentiality, with a scope change that lets the attack significantly impact additional products beyond the connector itself. Fixed in the Oracle Critical Patch Update of July 2026 and tagged as an authentication bypass, the flaw carries a CVSS 3.1 score of 7.7 with high confidentiality impact and no integrity or availability effect. No public exploit identified at time of analysis, and there is no CISA KEV or EPSS signal in the provided data.
Information disclosure in Oracle SOA Suite (Integration Business Insight component), versions 12.2.1.4.0 and 14.1.2.0.0, allows a low-privileged attacker with HTTP network access to gain unauthorized access to all SOA Suite-accessible critical data, with a scope change that may significantly impact additional connected products. Oracle rates this CVSS 3.1 7.7 (High) with confidentiality-only impact and no integrity or availability effect. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the 'Authentication Bypass' tag hints at auth-weakening behavior but the CVSS vector confirms some privilege (PR:L) is still required.
Unauthorized data manipulation in Oracle Advanced Benefits 12.2.15 (Oracle E-Business Suite, Internal Operations component) lets a low-privileged attacker with HTTP network access create, delete, or modify critical data. Because the CVSS vector carries a scope change (S:C), successful attacks can significantly impact additional products beyond Advanced Benefits itself. The flaw is rated CVSS 3.1 7.7 with integrity-only impact (I:H, C:N, A:N); no public exploit is identified at time of analysis, and it was disclosed via Oracle's July 2026 Critical Patch Update.
Privileged tampering and data disclosure in the Oracle Identity Manager Connector (PeopleSoft Applications component) of Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 lets a high-privileged, network-based attacker read, create, delete, or modify all connector-accessible data, with a scope change that can significantly impact additional products beyond the connector itself. The CVSS 3.1 base score is 7.7 (C:H/I:H/A:N), but exploitation is rated high-complexity and requires existing high privileges, so this is not a drive-by flaw. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Server-side request forgery in InternLM lmdeploy's OpenAI-compatible vision API server lets unauthenticated remote attackers coerce the server into fetching internal-only resources by abusing the image_url media-fetch path. Because the URL safety check validates only the initial URL and does not re-validate targets after an HTTP 302 redirect, an attacker-hosted endpoint can redirect the fetch to loopback services or cloud instance-metadata endpoints, exposing internal services and potentially cloud credentials. No public exploit is identified at time of analysis, EPSS is low (0.28%), and a vendor fix adding a media-domain allowlist is available.
Unauthorized disclosure of critical data in Oracle Payroll (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read all Payroll-accessible data. Because the flaw carries a scope change, successful attacks can significantly impact additional Oracle products beyond Payroll itself, raising the effective blast radius. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle rates it CVSS 3.1 7.7 with confidentiality-only impact.
Sensitive data exposure in Oracle iSupport (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-adjacent attacker to obtain unauthorized access to all iSupport-accessible data over HTTP. Because the flaw carries a scope change, successful exploitation may also significantly impact other products beyond iSupport itself, though only confidentiality is affected (no integrity or availability impact). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tags it as an authentication-bypass class issue.
Information disclosure with scope change in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged remote attacker read all data accessible to the platform and impact additional connected products. The flaw is network-exploitable over HTTP with low attack complexity and only minimal existing privileges, and Oracle tags it as an authentication bypass affecting confidentiality only (no integrity or availability impact). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low exploitation barrier and cross-boundary scope change make it a meaningful risk in exposed telecom/messaging deployments.
Information disclosure with scope change in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1, Application Service Level Management component) lets a low-privileged, network-authenticated attacker read all data accessible to the platform over HTTPS. Oracle rates it CVSS 3.1 7.7 with a scope change, so a successful attack can significantly impact products beyond Enterprise Manager itself. No public exploit is identified at time of analysis and it is not in CISA KEV, but low attack complexity plus total confidentiality loss make it a meaningful priority in Oracle-managed estates.
Cross-context data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-reachable attacker read and alter critical data after tricking a legitimate user into interacting with malicious content. Because the flaw crosses a security scope boundary (S:C), successful attacks can significantly impact products beyond WebCenter Content itself. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.7; no public exploit identified at time of analysis.
Unauthorized data disclosure in Oracle HRMS (UK) UK Payroll component of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, authenticated remote attacker over HTTP to read all HRMS (UK)-accessible data, with a scope change that can significantly impact additional products beyond the vulnerable module. Rated CVSS 3.1 7.7 (High) for confidentiality-only impact, it was reported by Oracle and patched in the July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle E-Business Suite HRMS (Norway) allows a low-privileged remote attacker to read all HRMS-accessible data over HTTP, with a scope change that may significantly impact other integrated products. The flaw affects EBS releases 12.2.3 through 12.2.15 and is addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the confidentiality-only, network-exploitable nature nonetheless makes it a meaningful data-exposure risk in HR environments.
Server-side request forgery in Gitea before 1.27.0 lets attackers coerce the server into HTTP requests against internal hosts because its outbound IP allow-list classifier (IsGlobalUnicast && !IsPrivate) fails to block CGNAT (100.64.0.0/10) and nine IPv6 transition prefixes. An authenticated user can point a webhook or repo migration at an internal CGNAT service and read the full response (status, headers, and up to 1 MB body) rendered back on the hook detail page; separately, when OpenID sign-in is enabled the unauthenticated /user/login/openid discovery fetch uses http.DefaultClient with no IP filtering, giving anonymous internet callers a blind SSRF primitive. Publicly available exploit code exists (bundled run_poc.sh reproduces all three primitives), but no active exploitation is confirmed.
Root command injection in dracut's NetworkManager-based initrd network module allows an adjacent-network attacker to execute arbitrary code inside the initramfs during early boot. By answering a booting system's DHCP request with malicious root-path, next-server, or bootfile-name options, the attacker's payload is written unescaped into a temporary shell script and executed as root before the real OS starts. No public exploit is identified at time of analysis, and the flaw is not on CISA KEV, but a Red Hat advisory (RHSA-2026:26534) and upstream fix commit confirm the issue is real and patched.
Unauthorized data access and partial denial of service in Oracle Transportation Management 6.5.3 (CSV Management component) allow a low-privileged, network-authenticated attacker over HTTP to read all OTM-accessible data, perform limited unauthorized inserts/updates/deletes, and partially degrade availability. Rated CVSS 3.1 7.6 (High). No public exploit identified at time of analysis; the fix ships in Oracle's July 2026 Critical Patch Update.
Data tampering and partial denial-of-service in Oracle Production Scheduling (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker over HTTP create, delete, or modify critical data - with additional limited read access and a partial DoS. Oracle rates it CVSS 3.1 7.6, driven primarily by high integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-during-normal-cycle priority rather than an emergency.
Privileged data compromise in Oracle Advanced Planning Command Center (Oracle E-Business Suite Internal Operations component, versions 12.2.3 through 12.2.15) lets an already high-privileged attacker with network HTTP access read all APCC-accessible data and perform limited unauthorized modifications. Because the flaw carries a scope change, successful attacks may significantly impact additional products beyond APCC itself. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.6; no public exploit identified at time of analysis.
Privilege-abusing data compromise in Oracle Advanced Benefits 12.2.15 (a module of Oracle E-Business Suite, Internal Operations component) lets a high-privileged, network-authenticated attacker read all data accessible to the application and make limited unauthorized modifications. Because the flaw carries a scope change (CVSS S:C), successful attacks may extend impact to other Oracle products beyond Advanced Benefits itself. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; the fix is delivered in the Oracle July 2026 Critical Patch Update.
Privilege-abuse compromise in the Oracle Enterprise Command Center Framework (Core component) of Oracle E-Business Suite V16 allows an authenticated high-privileged attacker with HTTP network access to read all framework-accessible data and make limited unauthorized modifications, with a scope change that can significantly impact adjacent Oracle products. Addressed in the July 2026 Oracle Critical Patch Update (CVSS 3.1 base 7.6). No public exploit identified at time of analysis and it is not listed in CISA KEV, so this reflects an unauthenticated-attacker-excluded, insider/compromised-account risk rather than mass exploitation.
Privilege abuse in the Console component of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 lets a high-privileged, network-based attacker corrupt or delete critical data and read a subset of data, with a scope change that can impact other products beyond WebLogic itself. Oracle rates it CVSS 3.1 7.6 and, despite the 'Authentication Bypass' tag applied by the reporter, the CVSS vector requires PR:H (high existing privileges). No public exploit identified at time of analysis and it is not listed in CISA KEV; disclosed in the Oracle Critical Patch Update of July 2026.
Unauthorized data access and partial denial of service in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker compromise the platform after tricking a legitimate user into interacting with attacker-controlled content. Per Oracle's July 2026 Critical Patch Update, successful exploitation yields high confidentiality impact (complete read access to WebCenter Content data) plus limited integrity and availability damage. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, though Oracle rates it easily exploitable.