Unauthenticated OS command injection in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets a remote attacker execute arbitrary operating-system commands by supplying crafted input in the 'url' parameter of the /test endpoint on TCP port 9002. The flaw scores CVSS 4.0 10.0 (maximum) with no authentication or user interaction required, and publicly available exploit code exists (research published by CyberDanube), though it is not yet listed in CISA KEV - no public exploit identified as actively exploited at time of analysis beyond the released POC.
Remote code execution in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets unauthenticated attackers run arbitrary code as root by sending a crafted request to the /test endpoint of a service listening on TCP port 9002. The flawed handler fetches, extracts, and executes attacker-supplied files, yielding full device takeover with no authentication or user interaction. Publicly available exploit code exists (published by CyberDanube) and the CVSS 4.0 score is 10.0; the vulnerability is not currently listed in CISA KEV.
Authentication bypass in Autel MaxiCharger Single EV charging stations running firmware up to and including V1.03.51 lets remote, unauthenticated attackers invoke privileged management endpoints by supplying a hard-coded token baked into the firmware. Because the token is static and shared across devices, anyone who extracts it once (publicly available exploit code exists via CyberDanube) can control the charger's management functions on any unpatched unit. The CVSS 4.0 base score is 10.0, and the flaw affords full compromise of the device with no user interaction.
Authentication bypass via hard-coded backdoor accounts in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets remote attackers gain administrative control of the web management interface. Two undocumented privileged accounts use a vendor-defined password derivation tied to device-specific values, so anyone who knows the algorithm and inputs can authenticate as admin without legitimate credentials. Publicly available exploit code exists (CyberDanube); no public evidence of active exploitation at time of analysis.
OS command injection in Autel MaxiCharger Single EV charging stations (firmware through V1.03.51) lets a malicious or compromised OCPP backend server inject arbitrary operating-system commands via the diagnostics URL parameter of an OCPP GetDiagnostics request. A rogue or hijacked charge-point management server can fully compromise the charger, and publicly available exploit code exists (CyberDanube), though no active exploitation has been confirmed. Because the impact reaches the underlying OS with full confidentiality, integrity, and availability loss, successful attacks give complete control of the charging hardware.
Remote code execution and denial of service in Autel MaxiCharger Single EV charging stations running firmware through V1.03.51 stems from a heap-based buffer overflow in the set_ap_param command exposed by the /localcfg endpoint. An authenticated attacker who can reach the device's local configuration interface can send oversized input to crash the charger or potentially execute arbitrary code on it. Publicly available exploit code exists (published by CyberDanube), and the CVSS 4.0 base score is 9.4, though there is no evidence of active exploitation in the CISA KEV catalog at time of analysis.
Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affects versions 4.2.0.Final through 4.2.15.Final and all releases prior to 4.1.136.Final, where OcspClient.validateResponse never confirms that the CertificateID in an OCSP response matches the certificate being validated. An attacker holding any valid, non-revoked certificate from the same issuing CA can obtain a legitimately signed GOOD response and replay it to make Netty accept a revoked or compromised certificate as valid. Publicly available exploit code exists (a PoC test case in the GHSA advisory), but there is no public exploit identified as being used in active attacks and EPSS risk is low (0.30%, 22nd percentile).
Complete remote takeover of Oracle Service Delivery Platform (a component of Oracle Fusion Middleware, versions 12.2.1.4.0 and 14.1.2.0.0) is possible via the Messaging Enabler component, reachable over HTTP by an unauthenticated attacker. The flaw carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation not only fully compromises the platform's confidentiality, integrity, and availability but can also significantly impact other connected products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a top-priority patch from the Oracle July 2026 Critical Patch Update.
Complete takeover of Oracle Service Delivery Platform is achievable by an unauthenticated remote attacker via SOAP requests to the Messaging Enabler component, affecting Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0. Rated CVSS 10.0 with a scope change, successful exploitation can pivot to compromise additional connected products beyond SDP itself. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the maximum score and trivial exploitation warrant urgent patching via Oracle's July 2026 Critical Patch Update.
Complete takeover of Oracle Unified Directory (OUD) is possible when an unauthenticated remote attacker sends crafted traffic to the LDAP service in supported versions 12.2.1.4.0 and 14.1.2.1.0 of this Oracle Fusion Middleware component. The maximum CVSS 3.1 base score of 10.0 reflects full confidentiality, integrity, and availability loss plus a scope change that can significantly impact adjacent products. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Remote unauthenticated compromise of Oracle Access Manager (Fusion Middleware Authentication Engine) in supported versions 12.2.1.4.0 and 14.1.2.1.0 allows a network attacker to fully take over the product via HTTP with no credentials or user interaction. Oracle rates this a maximum CVSS 3.1 10.0 because the scope-changing flaw can pivot beyond OAM to impact additional products. No public exploit identified at time of analysis, but as an SSO/identity gatekeeper the impact of takeover is severe.
Complete takeover of Oracle Coherence is achievable by an unauthenticated remote attacker over TCP, with the Core component of this Oracle Fusion Middleware in-memory data grid affected in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The maximum-severity CVSS 10.0 rating reflects a scope-changing flaw whose exploitation can pivot beyond Coherence to impact other co-deployed products. There is no public exploit identified at time of analysis, but the trivial exploitability and unauthenticated network reach make this a top-priority patch.
Unauthenticated remote compromise of the Oracle WebLogic Server Proxy Plug-in (version 15.1.1.0.0), a module that fronts WebLogic behind third-party web servers such as Apache HTTP Server and Oracle HTTP Server, allowing a network attacker to read and modify critical data with no credentials or user interaction. Oracle rates this a maximum CVSS 3.1 10.0 because the flaw crosses a trust boundary (scope change), meaning exploitation of the plug-in significantly impacts additional connected products. Vendor tagging identifies it as an authentication bypass; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability warrants urgent patching.
Full takeover of Oracle WebCenter Content (Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0) is achievable by an unauthenticated remote attacker over HTTP, requiring no user interaction. The scope-changing flaw (CVSS 3.1 base 10.0) lets attackers compromise the Web Content Management component and pivot to impact adjacent Oracle products. No public exploit identified at time of analysis, but the maximum severity and trivial exploitability make this a top-priority patch from the July 2026 Oracle Critical Patch Update.
Complete takeover of Oracle Data Integrator (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by a remote, unauthenticated attacker sending crafted HTTP requests to the REST Service component. Because the CVSS scope is changed (S:C), successful exploitation can pivot beyond ODI to significantly impact other integrated Fusion Middleware products, and the maximum 10.0 base score reflects full loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, but the trivial exploitability and network reach make this a top-priority patch from Oracle's July 2026 Critical Patch Update.
Sandbox escape in Mozilla Firefox before version 153 stems from an invalid pointer (CWE-119 memory-safety error) in the Disability Access (accessibility) APIs component, letting an attacker who can execute code in a constrained content process break out of the browser sandbox and reach the more privileged parent process with full confidentiality, integrity, and availability impact (CVSS 10.0, scope-changed). No public exploit identified at time of analysis, and the EPSS probability is low (0.14%, 4th percentile), indicating no evidence of widespread exploitation despite the maximum CVSS score.
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) is achievable by a low-privileged, network-adjacent attacker abusing the SAML authentication path, with a scope change that can propagate impact into additional connected products. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; the CVSS 9.9 rating reflects complete loss of confidentiality, integrity and availability. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the low complexity and low privilege requirement make it a top-priority patching item.
Full takeover of the Oracle Database RDBMS component is possible for a low-privileged attacker who holds the Execute DBMS_CLOUD privilege and can reach the server over Oracle Net, affecting Database 19.3-19.31 and 23.4.0-23.26.2. Because the CVSS vector carries a scope change (S:C), a successful attack can pivot beyond the database to significantly impact additional products, yielding full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; the 9.9 base score is driven by low attack complexity and the scope change rather than by unauthenticated access.
Full takeover of Oracle PeopleSoft In-Memory Project Discovery 9.2 is possible when a low-privileged attacker with network access over HTTP exploits the Project Discovery component, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.9 with a scope change (S:C), meaning successful attacks can significantly impact additional products beyond the vulnerable component itself, with complete loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low exploitation barrier make it a high remediation priority.
Full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is possible when a low-privileged attacker reaches the Content Acquisition System component over HTTP. Oracle rates this 9.9 with a scope change (S:C), meaning a successful compromise of the Guided Search product can significantly impact additional downstream products beyond the vulnerable component itself. There is no public exploit identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a high-priority patch item.
Full takeover of Oracle PeopleSoft Enterprise HCM Talent Acquisition Manager 9.2 is achievable by a low-privileged, network-based attacker abusing the Job Opening component over HTTP. Because the flaw carries a scope change (S:C), successful attacks reach beyond the Talent Acquisition module and can significantly impact additional connected PeopleSoft products. No public exploit identified at time of analysis, but the 9.9 CVSS and trivial exploitability make this a top-priority patch from Oracle's July 2026 Critical Patch Update.
Privilege-to-takeover in Oracle PeopleSoft Enterprise FIN Staffing Front Office Brazil 9.1 (Staffing component) lets a low-privileged attacker with HTTP access fully compromise the module, and because of a scope change (CVSS S:C) the attack can significantly impact additional PeopleSoft products beyond the vulnerable component. Oracle rates this 9.9 (Critical) with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis; disclosed via the Oracle Critical Patch Update of July 2026.
Privilege escalation to full application takeover in Oracle Demantra Demand Management (versions 12.2.3 through 12.2.15) lets a low-privileged, authenticated attacker with HTTP network access compromise the Product Security component and, because of a scope change, significantly impact additional connected products. Rated CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a top-tier patch priority.
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) allows a low-privileged, network-based attacker to compromise the product via HTTP through the Siebel Cloud Manager component. Because the flaw carries a scope change, successful exploitation can pivot beyond Siebel to significantly impact additional connected products, driving the rare CVSS 9.9 rating. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a high-priority patch item.
Full takeover of Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 is possible when a low-privileged attacker with HTTP network access exploits a flaw in the Installation Security component. Because the CVSS scope is changed (S:C), a successful attack does not stay contained to EnterpriseOne Tools but can significantly impact additional connected products, yielding full confidentiality, integrity, and availability loss (CVSS 9.9). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle WebCenter Portal (Fusion Middleware, Runtime Tools component) is achievable by a low-privileged attacker with network access over HTTP, per Oracle's July 2026 Critical Patch Update. Because the flaw carries a scope change (S:C), successful exploitation can significantly impact additional products beyond WebCenter Portal itself, driving the CVSS 3.1 base score to 9.9. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Account/instance takeover in Oracle WebCenter Portal (Fusion Middleware component: Runtime Tools) lets a low-privileged remote attacker fully compromise affected 12.2.1.4.0 and 14.1.2.0.0 deployments over HTTP. Because the flaw carries a scope change (S:C), successful exploitation can spill beyond the portal into other Fusion Middleware components, and Oracle rates full confidentiality, integrity, and availability impact (CVSS 3.1 base 9.9). No public exploit has been identified at time of analysis, but the low attack complexity and 'easily exploitable' vendor wording make this a high-priority patch item.
Full compromise of Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) is possible by a low-privileged attacker sending HTTP requests over the network, with successful attacks resulting in complete takeover of the product. Oracle rates this CVSS 3.1 9.9 with a scope change, meaning the impact extends beyond WebCenter Sites into adjacent products. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and minimal privilege requirement make it a high patch priority; a fix was delivered in the Oracle July 2026 Critical Patch Update.
Privilege escalation to full product takeover in Oracle Managed File Transfer (versions 12.2.1.4.0 and 14.1.2.0.0), part of Oracle Fusion Middleware's MFT Runtime Server component, allows a low-privileged attacker with HTTP network access to compromise the product and, because of a scope change, significantly impact additional connected products. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the CVSS 3.1 base score of 9.9 and the easily-exploitable, low-privilege nature make this a top-priority Critical Patch Update item. The flaw is addressed in the Oracle July 2026 Critical Patch Update.
Full takeover of Oracle Business Process Management Suite is possible when a low-privileged attacker reaches the T3 or IIOP protocol endpoints of the Human Workflow component in Fusion Middleware 12.2.1.4.0 or 14.1.2.0.0. Because the flaw carries a scope change, successful exploitation impacts additional products beyond BPM itself, yielding compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, but the 9.9 CVSS and low attack complexity make this a top-priority patch from Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle Managed File Transfer (MFT Runtime Server) is achievable by a low-privileged remote attacker over HTTP in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this CVSS 9.9 because the flaw carries a scope change, so a successful attack can also significantly impact products beyond MFT itself. No public exploit has been identified at time of analysis; the fix ships in the Oracle July 2026 Critical Patch Update.
Privilege escalation to full takeover in Oracle Identity Manager Connector (Fusion Middleware Core component) versions 12.2.1.4.0 and 14.1.2.1.0 lets a low-privileged attacker with HTTP network access fully compromise the connector, with a scope change that lets the attack significantly impact other products. Oracle rates it CVSS 3.1 9.9 (Critical) with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is currently theoretical based on the vendor's July 2026 Critical Patch Update disclosure.
Full takeover of Oracle WebCenter Enterprise Capture is possible when a low-privileged attacker reaches the WebLogic T3 or IIOP protocol interface of the Client Bundle component, per the Oracle Critical Patch Update of July 2026. Affecting supported versions 12.2.1.4.0 and 14.1.2.0.0, the flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation not only compromises Capture but can significantly impact additional connected products. No public exploit has been identified at time of analysis, but the low attack complexity and network reachability make it a high-priority patch.
Privilege escalation to full takeover in Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 (Client Bundle component) allows a low-privileged attacker with network access over the WebLogic T3/IIOP protocols to fully compromise the product, with scope change meaning impact extends to other products in the environment. Rated CVSS 9.9 with high confidentiality, integrity, and availability impact. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and not listed in CISA KEV.
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware Client Bundle component) is possible for a low-privileged attacker with HTTP network access, per Oracle's CPU July 2026 advisory. The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation impacts confidentiality, integrity, and availability and can extend beyond Capture into additional connected products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a high-priority patch.
Full compromise of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) is possible when a low-privileged attacker reaches the server over the T3 or IIOP protocols, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation can take over the Capture product and significantly impact additional connected Oracle Fusion Middleware components. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a high-priority patch.
Full takeover of Oracle WebCenter Enterprise Capture is possible when a low-privileged attacker reaches the WebLogic-based Client Bundle component over the T3 or IIOP protocols, yielding complete confidentiality, integrity, and availability compromise. Oracle rates it CVSS 9.9 with a scope change, meaning exploitation can pivot beyond Capture into adjacent Fusion Middleware components. No public exploit identified at time of analysis, but the near-maximum score, low attack complexity, and network reachability make it a top-priority Critical Patch Update item.
Privilege-escalating account takeover in Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged attacker with HTTP network access fully compromise the product and, because of a scope change, significantly impact adjacent products. Rated CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact, it is described by Oracle as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation status is unproven despite the near-maximal score.
Privilege escalation to full takeover in Oracle Unified Directory (OUD Core) 12.2.1.4.0 and 14.1.2.1.0 lets a low-privileged attacker with LDAP network access completely compromise the directory service, with a scope change that can significantly impact other connected products. Oracle rates it CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' characterization make this a high-priority patch from the July 2026 Oracle Critical Patch Update.
Privilege escalation to full takeover in Oracle Access Manager (Fusion Middleware) 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged, network-based attacker to compromise the Authentication Engine over HTTP and pivot beyond the product itself (scope change). Because Access Manager brokers single sign-on and authentication for downstream Fusion Middleware applications, its compromise cascades into the identity trust chain. Rated CVSS 3.1 9.9 with full CIA impact; no public exploit identified at time of analysis, and it is addressed in Oracle's July 2026 Critical Patch Update.
Privilege escalation and full data compromise in Oracle BI Publisher (versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0) allows a low-privileged, network-authenticated attacker to abuse the Web Service API and read, create, delete, or modify all BI Publisher-accessible data, with a scope change that lets attacks significantly impact additional products. Rated CVSS 3.1 9.9 (Critical), it is easily exploitable over HTTP with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-abusing remote compromise in Oracle Communications Service Delivery Platform (Messaging Enabler component), versions 12.2.1.4.0 and 14.1.2.0.0, lets a low-privileged attacker reachable over the WebLogic T3/IIOP protocols read and modify all SDP-accessible data and cause partial denial of service. The CVSS 3.1 base score reaches 9.9 because of a scope change: the flaw sits in SDP but successful attacks significantly impact other products co-hosted in the WebLogic domain. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity over a network-facing T3/IIOP surface makes it a high-priority patch.
Unauthenticated remote compromise of Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Integration component) allows a network attacker to reach critical data and, because of a scope change, to impact additional PeopleSoft products beyond the vulnerable module. The flaw is rated CVSS 3.1 9.9 and is trivially exploitable over HTTP with no authentication or user interaction, yielding full read of accessible data plus partial write and partial denial-of-service. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the near-maximal score and unauthenticated network vector make it a high-priority patching candidate.
Account takeover in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Staffing component) lets a low-privileged, authenticated attacker send crafted HTTP requests to fully compromise the module and, due to a scope change, impact adjacent PeopleSoft products and data. Rated CVSS 9.9 with full confidentiality, integrity, and availability loss, this is disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege escalation to full takeover in Oracle WebCenter Content (Fusion Middleware, Web Content Management component) lets a low-privileged, network-based attacker fully compromise the server over HTTP. Because the CVSS vector marks a scope change (S:C), a successful attack can significantly impact additional products beyond WebCenter Content itself, driving the near-maximal 9.9 base score. No public exploit identified at time of analysis, but the ease of exploitation (AC:L, PR:L) and complete confidentiality, integrity, and availability impact make this a top-priority patch in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Portal (Fusion Middleware, Runtime Tools component) affects versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged attacker with HTTP network access can take over the portal and, because of a scope change, significantly impact other products. Oracle rates this CVSS 3.1 9.9 (Critical) with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a high-priority patch item.
Privilege-escalating account takeover in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 (Runtime Tools component) lets a low-privileged, network-authenticated attacker fully compromise the portal over HTTP and, because of a scope change (S:C), pivot into other components of the Oracle Fusion Middleware stack. Oracle rates it CVSS 9.9 with full confidentiality, integrity, and availability loss, and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and minimal privilege requirement make it a high-priority patch.
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible by a low-privileged attacker sending crafted HTTP requests over the network, per Oracle's July 2026 Critical Patch Update (CVE-2026-60447). The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning a successful attack extends beyond Capture itself to significantly impact additional connected products. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege requirement make it a high-priority patch item.
Full takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible when a low-privileged attacker with network access via the WebLogic T3 or IIOP protocols exploits versions 12.2.1.4.0 and 14.1.2.0.0. Rated CVSS 3.1 9.9 with a scope change, successful attacks compromise confidentiality, integrity and availability and can significantly impact additional connected products beyond Capture itself. No public exploit identified at time of analysis, and the fix ships in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle Unified Directory is possible in the OUD Core component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a low-privileged attacker with LDAP network access can compromise the directory service and, because of a scope change, significantly impact additional connected products. Oracle rates this CVSS 9.9 and lists it in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not on CISA KEV. The combination of low attack complexity, only low privileges required, and cross-product blast radius makes this one of the highest-severity fixes in the CPU.