User enumeration in djangoSIGE through version 1.10 exposes valid account identities to unauthenticated remote attackers via the POST login/esqueceu/ password reset endpoint. The ForgotPasswordView returned distinct error messages depending on account state - 'not found in database,' 'user has no email registered,' or a success message - allowing systematic harvesting of valid usernames and email addresses. A publicly available proof-of-concept exploit exists; no CISA KEV listing at time of analysis.
Denial of service in Gitea's NPM package registry API allows any authenticated user to crash the entire server process with a single HTTP request by exploiting an unbounded `io.ReadAll()` call in the `AddPackageTag` handler. Gitea versions up to and including v1.26.2 are confirmed vulnerable, with the fix shipped in v1.27.0. Because self-registration is enabled by default, external unauthenticated attackers can register a free account and immediately exploit this to take down all Gitea-hosted services including repositories, CI/CD pipelines, and issue tracking; a detailed proof-of-concept with video evidence is publicly available in the advisory.
Cross-repository information disclosure in Gitea's org-level Actions API exposes workflow run and job metadata from private repositories to any authenticated organization member, regardless of per-repository access rights. The endpoints GET /api/v1/orgs/{org}/actions/runs and GET /api/v1/orgs/{org}/actions/jobs bypass per-repo ACL checks entirely, allowing low-privileged org members with no team or repository assignments to enumerate private repo names, commit SHAs, branch names, workflow file paths, contributor identities, CI timing, and commit messages across the entire organization. No CISA KEV listing or separately published exploit tool has been identified, but the detailed advisory with curl reproduction commands substantially lowers the exploitation barrier.
Unauthenticated workflow replay in the Bit Form WordPress plugin (versions before 3.1.0) allows external attackers to re-trigger any form's configured workflow actions - including notification emails and third-party service integrations - by submitting an expired workflow-trigger token that the plugin fails to properly reject. The root cause is missing authorization enforcement at the token-validation layer after WordPress transient expiry, classified under CWE-862. No public exploitation in CISA KEV is recorded, but a publicly available proof-of-concept exists per WPScan, elevating operational risk for sites with high-value workflow integrations such as CRM hooks or payment notifications.
Remote denial-of-service in Gitea versions prior to 1.27.0 allows any authenticated user to crash the server by exploiting an O(N²) string concatenation flaw in the RFC 4716 SSH key parser. Submitting a single crafted SSH2 public key with hundreds of thousands of short content lines forces quadratic heap allocation that exhausts CPU and RAM within seconds, taking the entire Gitea instance offline. A functional, Docker-packaged proof-of-concept is publicly available per the Gitea security advisory; no active exploitation has been confirmed in CISA KEV, but the trivially low barrier - any valid user account suffices - elevates real-world risk considerably.
Denial of service in Gitea's Debian package registry (all versions before 1.27.0) lets any authenticated user with package write access crash the server with a single .deb upload. The parser's ParseControlFile decompresses control.tar.gz with no size limit and tees the entire stream into a strings.Builder, so an 83 MB payload expands to 16+ GB and exhausts memory; a companion O(N²) string concatenation on Description continuation lines can independently saturate a CPU core. A complete working proof-of-concept is published in the advisory, so publicly available exploit code exists, though there is no public exploit identified as used in active attacks and the issue is not in CISA KEV.
Path traversal in the Bit Form WordPress plugin (versions before 3.1.0) allows unauthenticated remote attackers to read arbitrary files from the server - including wp-config.php, which contains database credentials and authentication keys - by supplying a crafted path in a form file-field that is then read and attached to a notification email. A publicly available proof-of-concept exploit exists, reported by WPScan, though the CVSS AC:H rating and SSVC Automatable:no designation indicate exploitation is not trivial. EPSS stands at 0.16% (6th percentile), and this CVE is not listed in CISA KEV, suggesting exploitation remains opportunistic rather than widespread at time of analysis.
Unrestricted file upload in D-Link DNS-320 firmware 1.0.2 allows remote unauthenticated attackers to upload arbitrary files - including executable PHP webshells - via the `/web/function/save_ajax.php` endpoint by manipulating the handler argument. This effectively enables persistent remote code execution on an end-of-life NAS device for which no vendor patch is expected. A public proof-of-concept exploit has been disclosed, lowering the skill barrier for exploitation; however, no CISA KEV listing was identified at time of analysis.
Unrestricted file upload in D-Link DNS-320 1.0.2 exposes the device to remote exploitation through the `/mydlink/multi_uploadify.php` PHP endpoint, where the `Filedata[]` parameter accepts arbitrary file types without validation. Remote unauthenticated attackers can upload malicious files - including PHP webshells - to the device filesystem, potentially achieving code execution on the NAS. A public proof-of-concept exploit is available per VulDB reporting, which elevates the urgency for owners of internet-facing DNS-320 units to act despite the absence of a CISA KEV listing.
Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes the /photo_center/php/uploadify.php endpoint to unauthenticated remote attackers who can manipulate the 'Malicious Handler' argument to upload arbitrary files to the device. The vulnerability stems from CWE-434 (Unrestricted Upload of File with Dangerous Type), a class of flaw that on PHP-backed NAS web interfaces frequently enables follow-on code execution by uploading a web shell. A public proof-of-concept exploit is available, elevating the realistic risk beyond what the moderate CVSS 4.0 base score of 6.9 alone would suggest, though no CISA KEV listing confirms active in-the-wild campaigns at time of analysis.
SQL injection in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to manipulate backend database queries through the unsanitized ID parameter in /edit_subjecta.php. The flaw (CWE-89) enables both data extraction and potential data modification against the timetabling database. A public proof-of-concept exploit is available on GitHub, and no special configuration is required beyond the application being network-accessible.
Unrestricted file upload in D-Link DNS-320 firmware version 1.0.2 allows unauthenticated remote attackers to upload arbitrary files - including PHP web shells - via the `Filedata[]` parameter of the jQuery Uploadify handler at `/web/jquery/uploader/multi_uploadify.php`. Because the endpoint performs no file-type validation and the underlying server executes PHP, a successful upload can yield full operating system command execution on the device. Publicly available exploit code exists (E:P confirmed in CVSS 4.0 threat component), substantially lowering the barrier to exploitation; KEV status has not been confirmed at time of analysis.
Unrestricted file upload in D-Link DNS-320 NAS firmware 1.0.2 exposes unauthenticated remote attackers to arbitrary PHP file upload via the `/web/jquery/uploader/uploadify.php` endpoint, likely enabling remote code execution on the embedded Linux system. A public proof-of-concept exploit has been released, significantly lowering the skill barrier for exploitation. No vendor patch has been identified, and the device is a legacy product that may be end-of-life, leaving affected deployments without a vendor-supported remediation path.
Academy LMS WordPress plugin versions prior to 3.8.1 exposes an Insecure Direct Object Reference (IDOR) flaw across multiple lesson AJAX handlers, allowing any subscriber-level authenticated user to read and overwrite other users' lesson notes and fraudulently mark course content as completed on their behalf. The vulnerability affects all Academy LMS installations running an unpatched version and is worsened by a publicly available exploit published via WPScan, though no active exploitation has been confirmed through CISA KEV. In environments where course completion carries compliance, certification, or audit significance, the integrity impact exceeds what the Medium CVSS score alone conveys.
Cross-site request forgery in djangoSIGE through 1.10 enables unauthenticated remote attackers to cancel sales quotations, sales orders, purchase quotations, and purchase orders on behalf of authenticated users with order-management permissions, with no public exploit identified at time of analysis per KEV, though a publicly available exploit exists. The vulnerability stems from business-critical state-changing operations (CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, CancelarPedidoCompraView) being implemented inside HTTP GET handlers, which Django's CsrfViewMiddleware explicitly exempts from CSRF token enforcement. An upstream fix is available via GitHub PR #163 (GET-to-POST method migration), but a patched tagged release version has not been independently confirmed.
Gitea's Arch package registry allows authenticated users with package-publishing permissions to trigger severe resource amplification by uploading crafted `.pkg.tar.gz` archives containing large numbers of empty file entries. A 470 KB compressed archive can produce 4.5 MB of database-stored metadata and a repository index with 100,001 lines - approximately 45x amplification - affecting CPU, memory, database storage, and index generation. Publicly available exploit code exists (a complete Python POC is included in the advisory); no active exploitation is confirmed in CISA KEV. The vulnerability is patched in Gitea v1.27.0.
Gitea's REST API path for making repositories private omits the ClearRepoWatches cleanup present in the web UI path, exposing private repository metadata to ex-watchers from v1.25.4 through v1.26.x. When the visibility transition occurs via PATCH /api/v1/repos/{owner}/{repo} - the canonical path used by terraform-gitea, official SDKs, and CI/CD automation - the updateRepository function clears stars but leaves watch records intact, allowing former watchers to retrieve the full Repository JSON payload (description, branch, language, topics, counts, mirror metadata) via GET /api/v1/user/subscriptions despite having no access to the repository. This is a confirmed incomplete fix relative to GHSA-8fwc-qjw5-rvgp; no public exploit identified at time of analysis, though the advisory provides complete reproduction steps directly derivable from static code analysis.
Subscriber-level users on WordPress sites running WPBot before 8.2.0 can modify the plugin's retrieval-augmented-generation (RAG) configuration without authorization, because the relevant settings handler performs neither a WordPress capability check nor a nonce validation. A publicly available proof-of-concept lowers the exploitation bar significantly, making this actionable for any low-skill attacker who holds or can self-register a subscriber account on the target site. No public exploit identified at time of analysis by CISA KEV, but POC availability combined with low access requirements makes remediation a priority for sites with open user registration.
Insecure Direct Object Reference (IDOR) in the Classified Listing WordPress plugin before 5.3.9 exposes payment receipt data across arbitrary user accounts. Any authenticated user holding subscriber-level access - the default role assigned upon registration on most WordPress sites - can query the payment-receipt handler with any order ID and receive full receipt details belonging to another user, because no ownership check is performed. A publicly available exploit exists per WPScan, and a vendor-released patch at version 5.3.9 is available; no KEV listing is present at time of analysis.
Memory leak in Amazon s2n-tls's QUIC transport parameters handler exposes server-side QUIC deployments to gradual heap exhaustion by unauthenticated remote clients. The flaw is rooted in incorrect allocator use during TLS 1.3 HelloRetryRequest (HRR) flows - a standard protocol exchange that can be deliberately forced by clients advertising key share groups the server will reject - causing up to approximately 64 KB of unreachable memory per handshake. No active exploitation or public exploit code has been identified; vendor-confirmed patch v1.7.6 is available.
Incorrect interface method dispatch in Eclipse OpenJ9 up to version 0.60 causes the JVM to silently execute an unintended interface default method instead of raising AbstractMethodError or IllegalAccessError when a previously JIT-compiled concrete superclass method is subsequently recompiled as abstract. Applications running on OpenJ9 with dynamic class-loading or OSGi-style hot deployment are at risk of integrity violations - untended code paths execute where exceptions should be thrown. No confirmed active exploitation exists and this CVE does not appear in CISA KEV; EPSS data was not provided, and the high attack complexity (AC:H) and specific attack prerequisites (AT:P) significantly limit real-world exploitability.
Validation bypass in Ninja Forms WordPress plugin 3.14.8 allows unauthenticated remote attackers to submit arbitrary content to any form by overriding server-side field definitions at the client layer before validation executes. By crafting a malicious AJAX payload targeting the WordPress nopriv (unauthenticated) AJAX endpoint, an attacker can strip required-field flags, override field types, and neutralize CAPTCHA protections - causing form actions such as email notifications and database writes to fire with fully attacker-controlled data. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog, though the trivial attack complexity and zero-authentication requirement make opportunistic abuse straightforward.
Schema identifier disclosure in Parse Server allows unauthenticated callers to reconstruct hidden GraphQL schema elements by exploiting 'Did you mean ...?' suggestions emitted during variable coercion error handling - a pathway left ungated by the graphQLPublicIntrospection: false hardening control, which only covered the validation phase. Affected versions span the 9.x line (9.0.0 through 9.10.0-alpha.4) and the 8.x line (before 8.6.85), and the flaw represents a confirmed bypass of prior fix GHSA-8cph-rgr4-g5vj. An attacker bearing only the public application ID can iteratively enumerate Cloud Code function names, Parse class names, and field names without triggering the introspection guard; no public exploit code is confirmed and no CISA KEV listing is present at time of analysis.
Unauthenticated information disclosure in Taiga 6.10.1 exposes the full member roster and internal workflow configuration of private projects to any network-reachable attacker. The filters_data endpoints on four viewsets - UserStory, Task, Issue, and Epic - fail to enforce the authorization controls correctly applied elsewhere in the project API, allowing unauthenticated GET requests parameterized with sequential integer project IDs to return user IDs, full names, and gravatar hashes of private project members. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the trivially automatable enumeration path elevates practical risk for externally accessible deployments.
Path traversal in the BuildKit daemon allows a client with valid control API access to craft a malicious upload request that writes files outside the BuildKit-controlled state directory, breaking container build sandbox boundaries. Affected products span all tracked versions of moby/buildkit per CPE data, and the vulnerability carries a CVSS 4.0 score of 6.9 with high integrity and availability impact on the vulnerable system. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized critical data disclosure in Oracle Order Management (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 stems from a flaw in the Product Diagnostic Tools component, exploitable by a high-privileged attacker over HTTP with no user interaction. Successful exploitation triggers a scope change, meaning the compromise can extend to additional Oracle products accessible through the Order Management context, resulting in complete access to all confidential data within that reach. No public exploit has been identified at time of analysis, and a fix is available via Oracle's Critical Patch Update for July 2026.
Authentication bypass in Oracle Commerce Platform 11.4.0 exposes full data confidentiality and integrity through the Dynamo Application Framework component, allowing a low-privileged network attacker to read or modify all platform data via HTTP. The CVSS 3.1 score of 6.8 reflects meaningful exploitation complexity (AC:H) and the requirement for at least some authenticated access (PR:L), limiting opportunistic mass exploitation. No public exploit code or active exploitation has been identified at time of analysis, and remediation is available via Oracle's July 2026 Critical Patch Update.
Oracle iSetup (versions 12.2.3 through 12.2.15), the General Ledger Update Transform and Reports component within Oracle E-Business Suite, allows a low-privileged authenticated attacker with network access via HTTP to bypass authorization controls and achieve complete confidentiality and integrity compromise of all iSetup-accessible data. Successful exploitation enables unauthorized read access to critical financial data and the ability to create, modify, or delete ledger records - a significant business risk in financial and compliance contexts despite the CVSS 3.1 medium score of 6.8. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Oracle addressed this in the July 2026 Critical Patch Update.
Oracle Cost Management in E-Business Suite versions 12.2.3 through 12.2.15 exposes an authentication bypass in the Internal Operations component, allowing a low-privileged remote attacker to gain unauthorized read and write access to sensitive cost management data over HTTP. The CVSS 3.1 score of 6.8 (C:H/I:H) reflects the potential for complete data exfiltration and manipulation - including creation, deletion, and modification of critical financial records - moderated by a High attack complexity that limits opportunistic targeting. No public exploit code or active exploitation has been identified at time of analysis.
Critical data exposure and unauthorized modification in Oracle PeopleSoft Enterprise CS Financial Aid 9.2.38 allows a low-privileged, network-authenticated attacker to bypass access controls within the Commonline Loans component via HTTP. Successful exploitation yields complete read and write access to all financial aid data accessible to the application, including sensitive student loan records. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed.
Full takeover of the JDBC component in Oracle Database Server is achievable by a high-privileged network attacker operating via Oracle Net, contingent on inducing human interaction from a separate party. All three actively maintained Oracle Database release tracks - 19c, 21c, and 23ai - are confirmed affected across their respective patch set ranges. No public exploit code or CISA KEV listing has been identified at time of analysis; however, successful exploitation yields complete confidentiality, integrity, and availability compromise of the JDBC layer.
Unauthorized access to sensitive federal financial data is possible in Oracle U.S. Federal Financials (versions 12.2.3-12.2.15, part of Oracle E-Business Suite) via a network-accessible authentication bypass in the Internal Operations component. An unauthenticated remote attacker with network access over HTTPS can, under high-complexity conditions, bypass authentication controls to read critical or complete confidential data - with scope change impact extending to additional E-Business Suite products beyond the directly targeted component. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag and scope-change designation elevate concern for federal agency deployments.
Oracle PeopleSoft Enterprise HCM Human Resources 9.2 exposes a Security component flaw that enables a low-privileged, network-accessible attacker to bypass access controls via Oracle Net, resulting in complete confidentiality and integrity compromise of all HCM HR data. The vulnerability permits unauthorized creation, deletion, and modification of critical HR records alongside full read access to all accessible data within the system. No public exploit has been identified at time of analysis, and the CVSS AC:H designation indicates specific, undisclosed preconditions must be met for successful exploitation.
Unauthorized critical data disclosure in Oracle HRMS (US) versions 12.2.3 through 12.2.15 exposes complete read access to all HRMS-accessible data via network HTTP, with a confirmed scope change that can impact additional Oracle E-Business Suite modules beyond HRMS itself. The CVSS vector (PR:H, S:C, C:H) indicates a high-privileged authenticated attacker operating over the network with low complexity can breach data boundaries across co-deployed EBS components. An 'Authentication Bypass' tag in the intelligence feed creates analytical tension with the PR:H prerequisite and warrants vendor clarification; no public exploit code has been identified at time of analysis, and Oracle disclosed this issue via the July 2026 Critical Patch Update.
Server-Side Request Forgery in Red Hat Quay 3 and Mirror Registry for Red Hat OpenShift 2 allows an authenticated repository administrator to pivot the Quay mirror worker through Skopeo to reach internal network services, cloud metadata endpoints (such as AWS IMDSv1), or other off-limits resources. The flaw arises because the repository-level mirror API handlers in endpoints/api/mirror.py accept an external_reference parameter without invoking the validate_external_registry_url() check that protects the organization-level equivalents. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the CVSS scope change (S:C) reflects real lateral reach into infrastructure beyond the Quay application boundary.
Webhook persistence after collaborator revocation in Gitea (versions prior to 1.27.0) enables a former admin collaborator to receive ongoing real-time exfiltration of private repository content indefinitely after their access is removed. The `DeleteCollaboration()` function cleans watches and assignees but never removes or disables webhooks created by the departing user, and the webhook delivery subsystem fires payloads on every subsequent repository event without re-validating the creator's current access. The attack is invisible to the repository owner, requires no further action by the attacker post-revocation, and was runtime-confirmed on gitea/gitea:1.25.4; no public exploit has been identified at time of analysis.
Heap use-after-free in the SyncTeX parser shipped with TeX Live and embedded by GNOME Evince allows crash or potential arbitrary code execution when a user opens a malformed .synctex or .synctex.gz file. The flaw stems from a NULL parent pointer condition in _synctex_post_process_ref() that bypasses node detachment, causing recursive freeing of live tree nodes and leaving dangling pointers later accessed during document parsing. Exploitation requires local file access and active user interaction (UI:A per CVSS 4.0), no public exploit has been confirmed, but a detailed researcher blog post by the discoverer (Fatih Çelik) is publicly available and the RCE tag suggests demonstrated impact potential.
Oracle Product Lifecycle Analytics 3.6.1 exposes a network-exploitable flaw in its Installation Issues component, allowing a high-privileged attacker to achieve full confidentiality and integrity compromise of all accessible application data alongside partial service disruption via HTTP. The 'Installation Issues' component designation and the 'Authentication Bypass' intelligence tag together suggest the flaw may reside in insecure post-installation artifacts, exposed setup endpoints, or improperly secured administrative interfaces left accessible after deployment. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data access and denial of service in Oracle Mobile Application Server's MWA Terminal Server component (E-Business Suite versions 12.2.3-12.2.15) can be achieved by a high-privileged attacker over HTTP. Successful exploitation grants complete read access to all data accessible by the Mobile Application Server, limited write capability (insert/update/delete on some data), and the ability to cause a complete, repeatable denial-of-service crash. The 'Authentication Bypass' tag in the intelligence data conflicts with the PR:H CVSS metric, suggesting the flaw may allow an authenticated administrator to bypass authorization controls beyond their intended access scope. No public exploit or CISA KEV listing has been identified at time of analysis.
Oracle Time and Labor (part of Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a high-privileged, network-accessible attacker to achieve full confidentiality and integrity compromise of all accessible labor data, plus limited availability disruption via HTTP. The 'Authentication Bypass' tag in associated intelligence sources introduces a notable discrepancy with the CVSS PR:H rating - if the flaw enables privilege escalation or access-control bypass within the product, the effective impact of an already-privileged session would be materially higher than the base CVSS score of 6.7 suggests. No public exploit code exists and exploitation is not confirmed by CISA KEV at time of analysis.
Full takeover of Oracle Application Object Library in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a high-privileged local attacker exploiting a flaw in the AOL Generic Loader component. The CVSS vector (AV:L/AC:L/PR:H) confirms this is a local, infrastructure-level attack requiring existing privileged access to the host, yet yields complete confidentiality, integrity, and availability compromise once triggered. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Full takeover of Oracle E-Business Suite's Pasta component (Internal Operations) is achievable by a high-privileged attacker with local logon access to the host infrastructure running versions 12.2.3 through 12.2.15. Successful exploitation yields complete confidentiality, integrity, and availability compromise of the Pasta service, consistent with the tags noting Information Disclosure as a primary impact vector alongside full control. Patched in Oracle Critical Patch Update July 2026; no public exploit identified at time of analysis and the component is not listed in CISA KEV.
Oracle Production Scheduling versions 12.2.3 through 12.2.15 in Oracle E-Business Suite exposes a local exploitation path through its Internal Operations component, enabling a low-privileged attacker - given co-presence of a second interacting user - to achieve unauthorized creation, deletion, or modification of critical data with a scope change that can cascade impact to additional Oracle EBS products. Tagged as an authentication bypass by ENISA EUVD-2026-47258, the flaw is addressed in Oracle's Critical Patch Update for July 2026. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full system takeover is achievable in Oracle Agile Product Lifecycle Management for Process 6.2.4 via the Data Import component, exploitable by a high-privileged attacker with local infrastructure access. Oracle classifies this as 'easily exploitable,' resulting in complete compromise of confidentiality, integrity, and availability despite the constrained attack surface. No public exploit code or CISA KEV listing exists at time of analysis, limiting immediate real-world risk to insider threat and post-compromise escalation scenarios.
Full takeover of Oracle TimesTen In-Memory Database 26.1.1.1.0 is achievable by a high-privileged attacker with local logon access to the infrastructure through a flaw in the Kubernetes Operator component. The attack requires no user interaction and is characterized by Oracle as 'easily exploitable,' resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Full takeover of Oracle Java SE 8u491 and 8u491-perf is achievable by a low-privileged local attacker exploiting a flaw in the Installation component, disclosed as part of Oracle's July 2026 Critical Patch Update. The attack chain requires high complexity - indicating race conditions or precise timing - combined with human interaction from a third party, likely a privileged user performing installation or update activity. No public exploit code has been identified and CISA KEV listing is absent at time of analysis, but the C:H/I:H/A:H impact triad makes successful exploitation fully destructive to the affected Java SE instance.
Full takeover of MySQL Server and MySQL Cluster 9.7.0-9.7.1 is achievable via a local, low-privileged attacker exploiting a flaw in the Server: Configurator component, provided a second user interacts during the attack window. The CVSS 3.1 score of 6.7 reflects the high attack complexity and local-only vector, which meaningfully constrain real-world exploitability despite the high-impact outcome (C:H/I:H/A:H). No public exploit code has been identified at time of analysis, and CISA KEV confirmation is absent.
Full takeover of Oracle HRMS (Norway) - the Norway Payroll component within Oracle E-Business Suite - is possible for a high-privileged attacker who can satisfy difficult exploitation conditions over HTTP across versions 12.2.8 through 12.2.15. Despite the complete C/I/A impact, the CVSS 3.1 score of 6.6 reflects real-world constraints: both high attack complexity (AC:H) and high privilege requirements (PR:H) must be met, making opportunistic mass exploitation unlikely. No public exploit code or CISA KEV listing has been identified at time of analysis, consistent with this being a targeted, insider-threat-class risk.
Full takeover of Oracle Cost Management within E-Business Suite versions 12.2.3 through 12.2.15 is achievable by a highly privileged, network-based attacker who can satisfy high attack complexity conditions over HTTP. Successful exploitation yields complete confidentiality, integrity, and availability impact - effectively handing an attacker full control of the Cost Planning component - despite the suppressed base score of 6.6 caused by the PR:H and AC:H barriers. Disclosed by Oracle's secalert team via the July 2026 Critical Patch Update, no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Oracle iSupport versions 12.2.3 through 12.2.15 within Oracle E-Business Suite contain a vulnerability in the Internal Operations component that allows a highly privileged network attacker to fully compromise the affected application via HTTP. Successful exploitation results in complete confidentiality, integrity, and availability impact - described by Oracle as a full takeover of Oracle iSupport. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; disclosure occurred through Oracle's July 2026 Critical Patch Update.