CSV injection (CWE-1236) in Brainstorm Force SureForms versions ≤ 2.1.1 enables remote unauthenticated attackers to embed spreadsheet formula directives inside user-controlled form field names, which are written unsanitized into CSV exports generated by administrators. When a site admin exports form submissions and opens the resulting file in a vulnerable spreadsheet application such as Microsoft Excel or LibreOffice Calc, the embedded formulas execute in the context of that administrator's workstation. A public proof-of-concept is available on GitHub; however, EPSS sits at 0.34% (27th percentile) and this CVE is not in the CISA KEV catalog, suggesting limited real-world exploitation to date.
Remote code execution in LibreNMS allows an authenticated administrator to execute arbitrary OS commands on the host server by chaining two unsafe PHP `exec()` calls in the Signal alert transport module. Versions 21.6.0 through 26.5.0 (exclusive) are affected, with the root cause being unescaped user-controlled inputs - the `signal-cli` path and `Recipient` field - interpolated directly into shell commands in `LibreNMS/Alert/Transport/Signal.php` and `scripts/composer_wrapper.php`. A publicly available proof-of-concept with step-by-step exploit instructions is included in the GitHub Security Advisory GHSA-c9fv-cgmm-2wg7; no CISA KEV listing was identified at time of analysis.
Environment variable inheritance in CodeWhale's js_execution tool prior to version 0.8.64 allows crafted JavaScript payloads to read the full parent process environment via process.env, exposing API keys, cloud credentials, and authentication tokens to the model context. The affected codebase is a Rust TUI AI coding assistant whose Node.js child process spawning failed to sanitize the environment before execution. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via GitHub advisory GHSA-h539-c7r8-3xq4.
Unauthenticated file disclosure in CodeWhale before 0.8.64 allows arbitrary local file reads via the image_analyze tool's failure to resolve symbolic links before enforcing workspace boundaries. An attacker who can place a crafted symlink (named with an image extension) inside a victim's workspace - for example via a malicious git repository - can cause CodeWhale's vision endpoint to read and transmit the symlink target's bytes without user approval. No CISA KEV listing or public exploit has been identified, but the CVSS 4.0 score of 8.7 and high confidentiality impact make this a meaningful risk for developers who open untrusted projects in CodeWhale.
Arbitrary file read in CodeWhale before version 0.8.64 allows an attacker to exfiltrate files from a developer's workstation by embedding a malicious `.codewhale/config.toml` in a repository. The `instructions` array in project config accepted arbitrary filesystem paths without workspace boundary enforcement, causing the tool to silently read and inject targeted files into the AI system prompt. No public exploit or CISA KEV listing has been identified at time of analysis, but the attack primitive is a well-understood path traversal and requires no technical sophistication beyond crafting a config file.
Stored XSS in Froxlor's DNS TXT record editor enables any low-privilege hosting customer with DNS editor access to inject arbitrary JavaScript that executes automatically in an administrator's browser session upon routine page load. The attack exploits a three-point failure: missing HTML sanitization at input, an unescaped `wordwrap()` callback that introduces raw HTML, and a Twig template using `|raw` that bypasses auto-escaping - compounded by a CSP header that includes `'unsafe-inline'`, rendering it useless. A detailed public proof-of-concept is confirmed in the vendor advisory; no CISA KEV listing at time of analysis. Successful exploitation yields complete admin account takeover and full server compromise.
Stack-based buffer overflow in the alphapd web server daemon of TRENDnet TV-IP751WIC firmware 11.03.03 allows low-privileged remote attackers to execute arbitrary code by sending malformed input to any of seven vulnerable configuration-handling functions. Seven distinct code paths - SystemNetworkChanged, SystemDDNSChanged, SystemEmailChanged, SystemFTPChanged, websCheckRealm, FUN_00432574, and FUN_0043372C - copy user-supplied configuration values onto the stack without enforcing length limits. A public proof-of-concept exploit has been published on GitHub, and the CVSS 4.0 score of 8.6 with E:P reflects meaningfully elevated exploitation risk even absent CISA KEV listing.
Stack-based buffer overflow in the DHCP blobmsg handler within /sbin/netifd on TRENDnet TEW-WLC100P firmware 12.07b01 allows unauthenticated adjacent-network attackers to execute arbitrary code with no user interaction required. A working proof-of-concept Python exploit script has been publicly released on GitHub, materially lowering the skill threshold for exploitation. No CISA KEV listing exists at time of analysis and no vendor patch has been identified, leaving affected devices exposed with only network-level compensating controls available.
Argument injection in CodeWhale's git_show tool (versions 0.8.41-0.8.63) allows an attacker to cause arbitrary file writes at the invoking user's privilege level via a malicious repository combined with prompt injection. The model-supplied rev parameter is passed directly to git show argv without an --end-of-options sentinel, meaning a value beginning with --output= is interpreted by git as a file-write flag rather than a revision. Because the git_show tool is registered as auto-approved and advertised as read-only, exploitation bypasses the user confirmation prompt entirely, enabling silent overwrite of sensitive files such as ~/.ssh/authorized_keys or ~/.bashrc. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 0.8.64.
Remote code execution in CodeWhale (packages codewhale and codewhale-tui) versions 0.8.41 through 0.8.63 allows an attacker to execute arbitrary Python code on the victim's machine by exploiting a hardcoded approval bypass in the rlm_eval built-in tool. The tool's approval_requirement() method returned ApprovalRequirement::Auto, causing the engine to silently skip user approval prompts regardless of the operator's configured --approval-policy, enabling prompt injection attacks through any external content the agent reads. No public exploit has been identified at time of analysis, but the attack surface encompasses any CodeWhale agent workflow that fetches untrusted content such as web pages, repository files, or MCP tool results.
Shell command injection in CodeWhale before version 0.8.64 enables arbitrary code execution on a victim developer's machine through a malicious repository config file. By committing a crafted `.codewhale/config.toml` containing `allow_shell = true` to any repository, an attacker can override the tool's shell access controls; when the target developer clones and opens the repository in CodeWhale, the AI agent gains unrestricted access to `exec_shell` and `task_shell` built-in tools and executes arbitrary shell commands without the user's explicit consent. No public exploit has been identified at time of analysis and no CISA KEV listing is confirmed, though the attack mechanics are straightforward and a vendor patch is available.
Argument injection in CodeWhale versions before 0.8.64 exposes arbitrary files on the host system by accepting unsanitized option-shaped values in the git_blame and git_show tools' rev parameter. An unauthenticated remote attacker who can influence the rev value - for example via a prompt injection payload in a malicious repository - can supply flags such as --contents=/home/user/.ssh/id_rsa, causing git to read and return the targeted file as tool output visible to the AI model. Vendor-released patch: 0.8.64 is available; no public exploit identified at time of analysis.
Broken object-level authorization in Netflix Lemur versions 0.5.0 through 1.9.3 permits any authenticated non-read-only user to silently hijack TLS certificate lifecycle management for certificates they do not own. By supplying arbitrary certificate identifiers in the replaces[] or replacements field of create, upload, or edit requests, an attacker triggers an append listener that suppresses the victim certificate's expiry notifications, marks it as replaced, and excludes it from get_all_pending_reissue - after which certificate_rotate may deploy the attacker's certificate to production endpoints previously serving the victim. No public exploit code has been identified at time of analysis, and no KEV entry exists, but the integrity and availability impact on managed TLS fleets is high; the fix shipped in version 1.9.3.
Command injection in Microsoft Copilot Web (copilot_web) enables unauthenticated remote attackers to exfiltrate sensitive data over the network by embedding malicious command elements in user-controlled input. The impact is strictly bounded to confidentiality - no integrity or availability loss - and a proof-of-concept is publicly available on GitHub. Despite a CVSS 7.5 score and public PoC, SSVC classifies exploitation as none with Automatable=no, and EPSS sits at 1.63%, suggesting limited real-world exploitation activity at time of analysis.
Credential exposure in Netflix Lemur's destination API allows any authenticated low-privilege user to retrieve plaintext SFTP passwords and private key passphrases stored in destination plugin configurations. Affected versions prior to 1.9.3 expose GET /api/1/destinations endpoints without the admin_permission guard applied to sibling write handlers, and DestinationOutputSchema serializes raw plugin options - including fields marked as storing passwords - without redaction. The CVSS Scope:Changed rating reflects that the exposed SFTP credentials extend attacker reach beyond Lemur itself to remote certificate-deployment infrastructure. No public exploit code has been identified, though the fix commit is publicly available and the attack path is trivially constructable from the diff.
Server-side request forgery in Netflix Lemur's authority update path allows an authenticated user holding an authority role to redirect the Lemur backend into fetching arbitrary internal URLs, including cloud instance metadata endpoints such as 169.254.169.254. This is an incomplete-fix bypass of CVE-2026-55166 (GHSA-v2wp-frmc-5q3v): the creation-time allowlist check in `_validate_acme_url` was never applied to the `PUT /api/1/authorities/` update path, leaving the stored `acme_url` writable without re-validation. The fix is shipped in v1.9.3 with no public exploit identified at time of analysis.
Resource exhaustion in Brainstorm Force SureForms before version 2.1.3 enables unauthenticated remote attackers to submit crafted form entries that exhaust server resources, block administrator access to the Entries interface, and trigger HTTP 500 errors sitewide. The root cause is CWE-400: the Entries component imposes no adequate limits on user-controlled field content during processing and rendering, making the attack low-complexity and fully automatable. A publicly available proof-of-concept exploit exists on GitHub, materially lowering the barrier to exploitation, though no CISA KEV listing confirms mass active exploitation at time of analysis.
Unauthenticated access to the classifieds-types REST endpoint in WPAdverts - Classifieds Plugin for WordPress (all versions through 2.3.2) exposes internal site configuration data due to a missing authorization check in class-rest-blocks.php. Remote attackers without any credentials can retrieve registered post types, taxonomy definitions, form schema metadata, contact options, and custom field meta keys - information that supports targeted reconnaissance for follow-on attacks. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV, but the CVSS AV:N/PR:N vector means any internet-facing WordPress site running the affected plugin version is reachable without precondition.
Server-side request forgery in Netflix Lemur prior to 1.9.3 allows authority-role users to redirect ACME certificate issuance workflows to attacker-controlled servers, enabling JWS-signed HTTP requests to reach internal services or cloud metadata endpoints. The flaw exists in two components acting together: the PUT /api/1/authorities/ endpoint accepted acme_url modifications without revalidating the host against an allowlist, and the ACME ClientV2 blindly followed server-supplied URLs for nonce, order, authorization, and finalize operations without confirming the hostname matched the configured directory. No public exploit identified at time of analysis; vendor-released patch available in version 1.9.3.
Prompt-injection-driven privilege escalation in CodeWhale 0.8.41-0.8.63 allows an attacker who can place malicious instructions in content the agent ingests to execute arbitrary commands inside an already-approved long-running interactive shell session - such as python3 -i, mysql, ssh, or sudo -i - without triggering any user approval prompt. The root cause is that exec_shell_interact (and its RlmEvalTool counterpart) hardcoded ApprovalRequirement::Auto, overriding the default Required gate that governs code-executing tools. Fixed in version 0.8.64; no public exploit or CISA KEV listing has been identified at time of analysis.
Second-order SQL injection in Froxlor (versions before 2.3.8) enables an authenticated administrator with the change_serversettings=1 privilege to store a UNION-based SQL payload in the panel_admins.ip column via Admins.add or Admins.update, which executes without further victim interaction when IpsAndPorts.listing is called by the poisoned account, returning all administrator login names and bcrypt password hashes. A confirmed, publicly available proof-of-concept demonstrates the complete two-step store-then-trigger chain against a live instance, enabling full database exfiltration and privilege escalation from reseller admin to super-admin. No active exploitation is confirmed in CISA KEV, though the working PoC and the specific threat model of multi-admin hosting deployments materially elevate real-world risk.
Privilege escalation and authorization bypass in Netflix Lemur before 1.9.3 permits any authenticated non-read-only user to revoke arbitrary TLS certificates fleet-wide, causing denial of service across all managed endpoints. Two chained API flaws - an unchecked upload endpoint and a row-scoped revocation check - allow an attacker to manufacture a shadow Lemur database record aliasing any real CA-side certificate, then trigger the issuer plugin to revoke the genuine certificate using stored authority credentials. No public exploit code has been identified, but the attack path is fully disclosed in the GitHub security advisory GHSA-pxmc-2ffp-8j67 and the fix commit.
Uncontrolled decompression in Malcolm's upload-processing pipeline allows any authenticated user with upload permissions to exhaust the shared Docker volume by submitting a single-stream compression bomb (.gz, .bz2, .xz, .lzma, .lz). The flaw in scripts/safe-extract.py is a logic gap: entry-count, nesting-depth, and total-uncompressed-byte guards exist for container formats (zip/tar/rar/7z via libarchive) but are entirely absent for single-stream formats, allowing unbounded expansion. Successful exploitation denies service to all platform users simultaneously by starving OpenSearch, Logstash, Arkime, and Zeek of shared disk. No public exploit or CISA KEV listing has been identified at time of analysis; however, the attack is conceptually trivial once the bypass is known.
Use-after-free in Valkey's RESTORE command allows a low-privileged remote attacker to potentially execute arbitrary code by supplying a crafted RDB stream payload that assigns a single Pending Entry List (PEL) NACK to multiple stream consumers. Valkey versions prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1 across all active release trains are affected. When one consumer referencing the shared NACK is deleted while another still holds a pointer to the same memory, a use-after-free condition occurs that can corrupt the allocator heap and enable remote code execution. No public exploit or CISA KEV listing exists at time of analysis, though the vendor's own fix PR includes a detailed reproducer test that substantially lowers the barrier to weaponization.
Unrestricted SHTML file upload in Joomla! CMS affects all versions from 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, impacting both the CMS and the Joomla! Framework Filesystem Package. The default blocklist of dangerous file types omitted SHTML files; on servers where SSI (Server Side Includes) is enabled and SHTML execution is active, a privileged user can upload a crafted SHTML file to achieve arbitrary server-side code execution. No public exploit code has been identified at time of analysis, though a vendor advisory has been published at the Joomla Security Centre.
OS command injection in the COMFAST CF-N1-S 2.6.0.1 router's CGI interface enables network-accessible, authenticated attackers to execute arbitrary operating system commands by manipulating the `ssid` parameter at the `/cgi-bin/mbox-config?method=SET§ion=ptest_ssid` endpoint. The underlying function `sub_44B438` passes unsanitized user input directly to a shell, resulting in full device compromise with scope impact extending to downstream network systems. A public proof-of-concept exploit has been published, classified under CWE-77 (Command Injection), and no vendor patch has been identified at time of analysis.
Privilege escalation and arbitrary code execution in Red Hat Advanced Cluster Management for Kubernetes (RHACM) allows an authenticated low-privilege user to hijack the governance-policy container image across managed clusters. By annotating the namespaced ManagedClusterAddOn resource - a permission that may be granted to non-administrative users - the attacker causes the governance-policy-addon-controller to deploy a malicious, attacker-controlled image running with cluster-admin privileges on every managed cluster under the hub's control. No public exploit or CISA KEV listing has been confirmed at time of analysis, but the low attack complexity and high impact across cluster boundaries make this a prioritized patching target for multi-cluster RHACM deployments.
Remote code execution in n8n workflow automation platform (all versions prior to 1.123.64, 2.29.8, and 2.30.1) stems from a TOCTOU race condition in the Git node's clone operation, allowing any low-privileged authenticated user to achieve arbitrary JavaScript execution on the server. The attacker wins a race between path validation and the actual clone, replacing a legitimate directory with a symlink to plant a crafted repository in n8n's community node directory - which the platform loads and executes as trusted JavaScript on the next restart. Both self-hosted and cloud-hosted n8n instances are affected wherever authenticated users can create and run workflows containing the Git node; no public exploit or CISA KEV listing has been identified at time of analysis.
PHP Object Injection in TaxoPress versions up to and including 3.51.0 enables authenticated low-privileged WordPress users to inject malicious serialized PHP objects through the plugin's editor interface. When a suitable Property-Oriented Programming (POP) gadget chain is present in the target WordPress environment, this can escalate to full remote code execution, unauthorized file writes, or complete site compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 High rating reflects the severe potential impact achievable with low authentication requirements.
Full system takeover of Oracle Financial Services Enterprise Case Management versions 8.0.8.2 and 8.1.2.11 is achievable by low-privileged, network-authenticated attackers targeting the Web UI component over HTTP. Oracle rates this as easily exploitable with a CVSS 3.1 score of 8.8, reflecting full confidentiality, integrity, and availability impact - consistent with complete application compromise. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Oracle Product Hub versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, exposes a full system takeover path via a network-accessible flaw in its Outbound Data component, exploitable by any low-privileged authenticated user over HTTP with no user interaction required. Oracle classifies this as 'easily exploitable' and confirms complete confidentiality, integrity, and availability compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, but the low attack complexity warrants urgent remediation for all affected deployments.
Full system takeover is achievable in Oracle Call Center Technology (versions 12.2.3-12.2.15) by a low-privileged, network-authenticated attacker via HTTP, with no user interaction required. The vendor describes this as 'easily exploitable' and confirms full Confidentiality, Integrity, and Availability compromise - consistent with a CVSS 8.8 High rating and system takeover outcome. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal privilege threshold lower the bar for exploitation significantly. Notably, the vulnerability tag 'Information Disclosure' understates the confirmed impact scope, which extends to full takeover.
Full takeover of Oracle Customers Online (E-Business Suite component) is achievable by any low-privileged authenticated user over HTTP, across versions 12.2.3 through 12.2.15. The Customer Tab component contains a flaw that, when exploited, yields complete confidentiality, integrity, and availability compromise - Oracle's own description uses the word 'takeover.' No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad authentication baseline (any portal account qualifies) make this a critical patching priority for Oracle EBS deployments.
Full system takeover is achievable in Oracle Enterprise Manager for Systems Infrastructure (versions 13.5 and 24.1) via the Storage Server Management component, exploitable by any low-privileged attacker with HTTP network access. The CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impact confirms complete compromise of the affected OEM instance - not merely information disclosure despite the 'Information Disclosure' tag in the source intelligence. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though Oracle's opaque CPU advisory format historically delays exploit development rather than preventing it.
Full takeover of Oracle Teleservice (E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged attacker with network access via HTTP, exploiting a flaw in the Service Request Form component. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation is straightforward - no elevated privileges, no user interaction, and no complex preconditions beyond a valid low-privilege account. Oracle's own advisory characterizes the outcome as complete product takeover, implying full loss of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle Sales Foundation (E-Business Suite 12.2.3-12.2.15) is achievable by a low-privileged network attacker via HTTP, targeting the Security API component. The vulnerability is rated CVSS 8.8 with high impact across confidentiality, integrity, and availability, indicating the attacker can gain complete control of the affected application. No public exploit or CISA KEV listing has been identified at time of analysis, though Oracle's classification as 'easily exploitable' elevates urgency for patching.
Full system compromise of Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by a low-privileged network attacker via HTTP, with the Security component identified as the vulnerable surface. The CVSS 3.1 score of 8.8 reflects high impacts across confidentiality, integrity, and availability, consistent with Oracle's own characterization of complete product 'takeover.' No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the low attack complexity and minimal privilege requirements make this a credible near-term exploitation target.
Oracle Scripting versions 12.2.3 through 12.2.15, as part of Oracle E-Business Suite, exposes an easily exploitable flaw in its Internal Operations component that enables a low-privileged network attacker to achieve full system takeover over HTTP. The vulnerability scores CVSS 3.1 8.8, reflecting High impacts across all three pillars - Confidentiality, Integrity, and Availability - with low attack complexity and no user interaction required. No public exploit has been identified at time of analysis, but the minimal authentication barrier and network accessibility make this a high-urgency remediation target for organizations running Oracle EBS.
Full system takeover in Oracle Siebel CRM's Marketing component is achievable by low-privileged authenticated attackers over HTTP across all versions 17.0 through 26.6. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no user interaction required, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the straightforward exploitation conditions and full-triad impact make this a high-priority patch target for any organization running exposed Siebel Marketing instances.
Full takeover of Oracle WebCenter Portal is achievable by a low-privileged network attacker targeting the Composer component via Java RMI in versions 12.2.1.4.0 and 14.1.2.0.0. Oracle describes the vulnerability as 'easily exploitable,' with the CVSS 3.1 score of 8.8 reflecting complete Confidentiality, Integrity, and Availability compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and this CVE has not appeared in the CISA Known Exploited Vulnerabilities catalog, though it is disclosed as part of Oracle's Critical Patch Update for August 2026.
Oracle Identity Manager (OIM Legacy UI) in versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware allows a low-privileged remote attacker to fully take over the identity management platform via the T3 and IIOP protocols. The attack requires no user interaction and low complexity, resulting in complete confidentiality, integrity, and availability compromise of the OIM system. No public exploit has been identified at time of analysis, but the low barrier to exploitation makes this a critical patching priority for any enterprise running the affected versions.
Full system takeover of Oracle Identity Manager is achievable by low-privileged network attackers via the OIM Legacy UI component using the T3 or IIOP protocols. Affected versions are 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware's Identity Manager product. Successful exploitation yields complete compromise of confidentiality, integrity, and availability, effectively handing an attacker full control over the identity management platform. No public exploit has been identified at the time of analysis, and this issue is disclosed as part of Oracle's Critical Patch Update for August 2026.
Full takeover of Oracle Agile PLM MCAD Connector 3.6 is achievable by a low-privileged network attacker targeting the CAX Client component over HTTP. Oracle's own advisory characterizes this as 'easily exploitable,' consistent with the CVSS vector showing no attack complexity and no user interaction required. No public exploit code or CISA KEV listing exists at time of analysis, but the combination of high-impact metrics and Oracle's 'easily exploitable' classification makes this a serious priority for affected Supply Chain environments.
Full system takeover of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 is achievable by any low-privileged authenticated user over HTTP, with no user interaction required. The Platform Security component flaw yields complete confidentiality, integrity, and availability compromise as described in Oracle's August 2026 Critical Security Patch Update. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network accessibility make this a high-priority remediation target for organizations running OBIEE 12.2.1.4.0.
Oracle Agile PLM 9.3.6 Application Server is susceptible to complete system takeover by a low-privileged attacker operating over HTTP, with no user interaction required. The CVSS 3.1 score of 8.8 reflects full confidentiality, integrity, and availability impact, consistent with Oracle's description of total compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, network-accessible attack path makes this a credible priority for any organization running the affected version.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by any low-privileged attacker with network HTTP access, requiring no user interaction. The vulnerability resides in the Installation and Configuration component and yields complete compromise across confidentiality, integrity, and availability - Oracle's own advisory characterizes the outcome as a full product takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and low privilege bar make this a credible, high-priority remediation target for any organization running the affected release.
Full system takeover in Oracle Siebel CRM Deployment's Server Infrastructure component is achievable by any low-privileged attacker with network HTTP access, affecting versions 17.0 through 26.6. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation is straightforward - no elevated privileges, no user interaction, and low complexity - resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation makes this a high-priority patching target for organizations running affected Siebel deployments.
Full takeover of Oracle Purchasing within Oracle E-Business Suite is achievable by any low-privileged, network-authenticated attacker exploiting this unspecified flaw in versions 12.2.3 through 12.2.15. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms exploitation requires no special conditions beyond a valid low-privilege account and HTTP access, with resulting impacts across confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full-impact triad make this a credible priority for any Oracle EBS deployment.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged network attacker via TCP, with no user interaction required. The vulnerability resides in the Security component and results in complete compromise of confidentiality, integrity, and availability upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a credible lateral-movement risk in enterprise financial environments.
Full system takeover is achievable in Oracle Hyperion Financial Management 11.2.25.0.000 through a flaw in its Security component, exploitable over HTTP by any low-privileged attacker with network access and no required user interaction. The CVSS 3.1 score of 8.8 reflects complete high-impact compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.