Unauthorized data access and partial data manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a network-accessible, low-privileged authenticated attacker to compromise the Endeca Application Controller through HTTP, provided a victim user interacts with attacker-controlled content. The vulnerability carries a scope change, meaning successful exploitation can cascade to affect additional Oracle Commerce components beyond the directly targeted product, resulting in high confidentiality impact and limited integrity compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vendor-tagged 'Authentication Bypass' nature elevates practical concern for multi-tenant or externally accessible deployments.
Unauthorized data access and limited data manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 is achievable by a low-privileged network attacker who can induce a victim user to interact with a crafted HTTP request targeting the Endeca Application Controller component. Successful exploitation causes a scope change, meaning the impact extends beyond the directly targeted application to additional Oracle Commerce products, enabling high-confidentiality data exposure and limited unauthorized data modification. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the combination of low attack complexity and scope change elevates the practical business risk.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a flaw in its Security component that enables a network-accessible, low-privileged attacker to compromise the application via HTTP when a legitimate user is induced to interact with malicious content. Successful exploitation results in complete unauthorized read access to all data within Calculation Manager and limited write capability, with a confirmed scope change that may extend impact to other interconnected Oracle Hyperion EPM products. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the 'Authentication Bypass' tag sourced from EUVD metadata suggests the root cause involves bypassing higher-privilege access controls within the Security component after initial low-privilege authentication.
Unauthorized data access in Oracle Enterprise Asset Management (E-Business Suite, Linear Asset Management component), versions 12.2.3 through 12.2.15, is achievable by a low-privileged authenticated network attacker over HTTP when a victim interacts with attacker-controlled content, resulting in complete confidentiality exposure and limited integrity compromise with a confirmed scope change to additional products. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C) combined with an Authentication Bypass tag from the reporter suggests a client-side attack pathway - likely cross-site scripting or a similar injection technique - where a victim must interact with attacker-influenced material to trigger the exploit. No public exploit code has been identified and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Unauthenticated arbitrary file download in the Extra Product Options & Add-Ons for WooCommerce plugin (all versions prior to 7.6) allows any remote attacker without credentials to traverse directory paths and retrieve arbitrary files from the web server, including highly sensitive files such as wp-config.php containing database credentials and secret keys. Rooted in CWE-22 path traversal, the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network exploitation with high confidentiality impact. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Insufficient session expiration in FUXA 1.3.2 and earlier allows a former privileged user to continue minting valid privileged JWTs long after their account has been deleted, disabled, demoted, or had roles removed. The refresh endpoint falls back to stale group data embedded in the token rather than enforcing a live database check, and the heartbeat endpoint re-signs inbound JWT claims without validating the current database record, enabling indefinite session extension through cookie rotation. No public exploit code has been identified at time of analysis, but the fix is available in v1.3.3 and the GitHub advisory and patch commit are public.
Remote denial-of-service in Oracle Payables (E-Business Suite versions 12.2.3 through 12.2.15) allows unauthenticated network attackers to crash or hang the Payables service via HTTP, completely disrupting accounts payable operations. Oracle describes the flaw as 'easily exploitable' with no authentication requirement, and the vendor-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) corroborates full availability impact with minimal attacker effort. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Oracle Critical Patch Update for August 2026 confirms the issue and provides remediation.
Remote denial-of-service in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated network attackers to hang or repeatedly crash the service via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivial, zero-prerequisite exploitation against any reachable instance. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this a credible threat to internet-facing deployments.
Denial-of-service in Oracle Helidon 3.2.20 (Imperative Web Server component) allows unauthenticated remote attackers to repeatedly crash or indefinitely hang the server via crafted HTTP requests. The vulnerability is rated CVSS 7.5 with no authentication, no user interaction, and low attack complexity, making it trivially exploitable at scale against any exposed instance. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ease of exploitation and complete availability impact warrant prompt patching.
Remote unauthenticated denial-of-service in Oracle Helidon 1.4.20 allows network-accessible attackers to crash or indefinitely hang the Imperative Web Server via HTTP, with no authentication or user interaction required. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivially low exploitation complexity against exposed instances. No public exploit code or CISA KEV listing exists at time of analysis, but the combination of network accessibility and zero prerequisites makes this a realistic operational risk for any deployment of the affected version.
Unauthenticated remote denial-of-service in Oracle VM VirtualBox 7.2.14 allows a network attacker to hang or crash the hypervisor via the RDP interface without any credentials or user interaction. The vulnerability resides in the Core component and is rated easily exploitable by Oracle, yielding complete availability loss of the affected VirtualBox instance. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and zero authentication requirement make this straightforward to trigger against exposed deployments.
Oracle Workflow's Notification Mailer component in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes an unauthenticated HTTP endpoint vulnerable to a complete denial-of-service condition. Attackers with network access can cause the Workflow service to hang or crash repeatedly with no authentication required and low attack complexity, as confirmed by Oracle's August 2026 CPU advisory. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Remote unauthenticated denial-of-service in Oracle Helidon 3.2.18 allows network-reachable attackers to trigger a hang or repeatably crash the Imperative Web Server component via crafted HTTP requests, fully disrupting availability. The vulnerability carries a CVSS 3.1 score of 7.5, is described by Oracle as easily exploitable, and requires no authentication, no user interaction, and only standard HTTP network access. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity makes opportunistic probing straightforward against any internet-exposed Helidon instance.
Remote denial-of-service in Oracle Java SE's 2D component allows unauthenticated network attackers to hang or crash the JVM across versions 25.0.4 and 26.0.2 via multiple protocols. The attack surface spans both server-side Java deployments exposing 2D-related APIs through web services and client-side environments running sandboxed Java Web Start applications or applets processing untrusted code. Oracle characterizes this as easily exploitable with no public exploit identified at time of analysis; no KEV listing is present.
Unauthenticated denial of service in the Starter Templates by Kadence WP WordPress plugin (versions <= 2.3.3) allows remote attackers to exhaust server resources and render affected WordPress sites unavailable without any credentials. The vulnerability stems from CWE-770, meaning the plugin fails to apply rate limits or resource quotas on one or more of its endpoints, enabling trivial amplification by an unauthenticated adversary. No active exploitation is confirmed in CISA KEV, and no public exploit code is known at time of analysis, though the lack of authentication barrier significantly lowers attack friction.
Unauthenticated remote data exposure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a network-adjacent or internet-facing attacker to read critical data or achieve complete unauthorized read access to all DRM-accessible data via HTTP, with no credentials or user interaction required. The vulnerability resides in the Access and Security component and is classified as an authentication bypass by the reporting source. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes opportunistic exploitation realistic against any exposed instance.
Unauthenticated remote access to all data in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible via a network-reachable HTTP endpoint due to an authentication bypass in the Access and Security component. An unauthenticated attacker with network access can exploit this to obtain complete read access to all data managed by the affected DRM instance, including potentially sensitive master data such as financial hierarchies, organizational structures, and governance metadata. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated remote access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable via HTTP due to a failure in the Security component's authentication enforcement. Tagged as an authentication bypass, the flaw allows any network-reachable attacker with no credentials or user interaction to access all data within the application's scope, carrying a CVSS 3.1 score of 7.5 (High) reflecting complete confidentiality compromise. No public exploit code or confirmed active exploitation has been identified at the time of analysis, though the low attack complexity lowers the practical barrier for capable adversaries who can reach the service.
Unauthenticated remote information disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 exposes the complete data set accessible to the application via HTTP. The Security component contains an authentication bypass weakness that allows a network-adjacent attacker with no credentials to retrieve critical financial data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this straightforward to target.
Unauthenticated remote data exposure in Oracle SDP Number Portability (E-Business Suite versions 12.2.3 through 12.2.15) allows a network attacker over HTTP to access critical or all data managed by the component without any credentials. The vulnerability is tagged as an Authentication Bypass in the Internal Operations component, consistent with the PR:N/AC:L CVSS vector indicating trivial exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity significantly lowers the bar for opportunistic abuse.
Unauthenticated remote data exposure in Oracle Warehouse Management (versions 12.2.3 through 12.2.15) allows any network-accessible attacker to read critical warehouse management data via HTTP without credentials. Tagged as an authentication bypass in the Internal Operations component, this vulnerability provides complete read access to all data within the WMS module's scope. No public exploit code or CISA KEV listing has been identified at time of analysis, though the trivial attack complexity (AC:L, PR:N) elevates practical risk relative to the absence of observed exploitation.
Unauthenticated remote disclosure of sensitive financial data affects Oracle Hyperion Financial Reporting 11.2.25.0.000 via HTTP, with no credentials required to trigger the flaw. Tagged as an authentication bypass, the vulnerability allows a network-adjacent attacker to read critical data or gain complete access to all data accessible by the Financial Reporting server component. No public exploit or CISA KEV listing has been identified at time of analysis, but Oracle's own description characterizes it as 'easily exploitable.'
Unauthenticated remote access to sensitive data is possible in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via an authentication bypass in the Installation and Configuration component exposed over HTTP. An attacker with network access can achieve complete read access to all data accessible by the Hyperion infrastructure layer without any credentials or user interaction. No public exploit has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog, but the trivial exploitation profile (AV:N/AC:L/PR:N/UI:N) represents a meaningful confidentiality risk for any organization running this specific version.
Unauthorized data exposure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows unauthenticated remote attackers to access critical or complete sensitive data via HTTP. The vulnerability resides in the Installation and Configuration component and is tagged as an authentication bypass, consistent with the CVSS PR:N rating. No public exploit has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this a high-priority patching target for any organization running the affected version.
Unauthorized data access in Oracle Helidon 4.5.0 exposes all data reachable through the Imperative Web Server component to unauthenticated remote attackers over HTTP. Tagged as an authentication bypass, the flaw allows complete confidentiality compromise - an attacker can read critical or all accessible application data without supplying credentials. No public exploit has been identified at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is trivially executable from any network position.
Unauthorized data disclosure in Oracle Helidon 3.2.18's Imperative Web Server component allows unauthenticated remote attackers to access critical or all Helidon-accessible data via HTTP. The vulnerability is tagged as an authentication bypass, consistent with the CVSS vector showing no privileges or user interaction required (PR:N/UI:N) and a high confidentiality impact. Disclosed as part of Oracle's Critical Patch Update for August 2026, no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated information disclosure in Oracle Helidon 4.5.0's Imperative Web Server component exposes complete application data to remote network attackers via HTTP. Tagged as an authentication bypass, the flaw allows any unauthenticated actor with network access to read critical or all Helidon-accessible data without any privileges or user interaction. No patch version has been independently confirmed beyond the Oracle CPU August 2026 advisory, and no active exploitation has been identified at time of analysis.
Unauthenticated confidentiality breach in Oracle Helidon 3.2.18's Imperative Web Server component exposes all accessible data to remote attackers over HTTP. Tagged as an authentication bypass, this flaw requires no credentials, no user interaction, and no special network positioning - any attacker with HTTP access to a vulnerable instance can read critical application data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this straightforward to exploit opportunistically.
Unauthenticated remote data exposure in Oracle Helidon 3.2.18's Imperative Web Server component allows network attackers to bypass authentication and gain complete access to data served by the application via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials, user interaction, or special access are required, and Oracle's own advisory characterizes the vulnerability as 'easily exploitable.' No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the authentication bypass nature paired with a High confidentiality impact warrants prompt remediation.
Unauthorized data disclosure in Oracle Helidon 3.2.18's Imperative Web Server component exposes all Helidon-accessible data to unauthenticated remote attackers via HTTP. Tagged as an Authentication Bypass, the flaw enables any network-positioned attacker to read critical or complete Helidon-managed data without credentials or user interaction, as confirmed by the AV:N/AC:L/PR:N/UI:N CVSS 3.1 vector. No public exploit has been identified at time of analysis, but the absence of any exploitation prerequisites significantly elevates real-world urgency for any internet-facing or internally networked Helidon 3.2.18 deployment.
Unauthorized data disclosure in Oracle Communications Unified Inventory Management (versions 7.5.0-7.5.1, 7.6.0-7.8.0, and 8.0.1) exposes critical inventory data to unauthenticated remote attackers over HTTP. The flaw resides in the Security Component and is tagged as an Authentication Bypass, meaning the platform's access controls can be circumvented without any credentials or user interaction, granting complete read access to all data the application can reach. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in CISA KEV, but the trivially low exploitation complexity makes rapid patching essential.
Unauthenticated remote data exposure in Oracle Business Intelligence Enterprise Edition (OBIEE) versions 8.2.0.0.0 and 26.01.0.0.0 allows network-adjacent attackers to read critical or all accessible analytics data via HTTP without credentials. The authentication bypass (per vendor tagging) in the Analytics Server component yields complete confidentiality loss - CVSS C:H - with no integrity or availability impact. No public exploit or CISA KEV listing has been identified at time of analysis, though Oracle's own security team reported and patched this issue in the August 2026 CPU, suggesting internal discovery.
Unauthenticated remote attackers can fully read all data accessible to Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 by exploiting an authentication bypass in the Forge component's SOAP interface, requiring no credentials, no user interaction, and no elevated access. Disclosed as part of Oracle's August 2026 Critical Security Patch Update (CSPU), the flaw is tagged as an Authentication Bypass targeting the SOAP protocol with a CVSS 3.1 base score of 7.5. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-prerequisite attack vector makes opportunistic exploitation technically straightforward for any network-reachable instance.
Unauthenticated remote data exposure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows network-accessible attackers to obtain complete access to all data managed by the platform via HTTP, with no credentials or user interaction required. The vulnerability resides in the Content Acquisition System component and is tagged as an authentication bypass, meaning access controls protecting sensitive commerce data can be circumvented entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial CVSS attack complexity and zero prerequisite conditions make this a priority patch target for any exposed instance.
Unauthenticated remote access to all confidential data is possible in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via the Content Acquisition System (CAS) component over HTTP. The vulnerability, tagged as an authentication bypass, requires no privileges and no user interaction, making it easily exploitable by any network-adjacent attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and complete confidentiality impact make this a significant exposure for any deployment with CAS reachable from untrusted networks.
Unauthenticated remote data exposure in Oracle Siebel CRM Integration's REST component allows network attackers to read all CRM-accessible data without credentials across versions 17.0 through 26.6. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable with no authentication and minimal attack complexity, yielding complete confidentiality loss. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Unauthorized data exposure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows unauthenticated network attackers to access the complete dataset managed by the platform via HTTP, without requiring credentials or user interaction. The vulnerability resides in the Access and Security component and has been tagged as an Authentication Bypass, indicating a fundamental failure in access control rather than a logic edge case. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, though the low attack complexity and absence of authentication prerequisites make this an attractive reconnaissance target.
Unauthenticated remote data disclosure in Oracle Scripting (Oracle E-Business Suite component: Internal Operations) affects all supported releases from 12.2.3 through 12.2.15. Exploitation over HTTP requires no credentials, no user interaction, and no special configuration - consistent with the Authentication Bypass tag reported alongside this vulnerability. Successful exploitation grants an attacker unauthorized read access to all data accessible within Oracle Scripting, including potentially critical business data. No public exploit or active exploitation has been confirmed at time of analysis.
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 expose all managed content to unauthenticated remote attackers via an HTTP-accessible authentication bypass. The flaw, tagged explicitly as Authentication Bypass by Oracle, enables complete unauthorized read access to every data asset within the WebCenter Sites platform without credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-complexity, zero-authentication attack profile makes opportunistic exploitation readily achievable by any attacker with HTTP reach to the application.
Unauthenticated remote disclosure of all Oracle Unified Directory data is possible via the LDAP protocol in versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Unified Directory (Oracle Fusion Middleware). The 'Authentication Bypass' tag and a CVSS vector of AV:N/AC:L/PR:N/UI:N confirm that a network-accessible attacker with no credentials can exploit the OUD Core component to read critical or complete directory data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this a straightforward target for opportunistic scanning.
Unauthenticated remote access to all confidential data managed by Oracle WebCenter Content's Content Server component is achievable across two currently supported Fusion Middleware release lines. Tagged as an authentication bypass, this vulnerability allows a network-accessible attacker to read sensitive documents and managed content by sending HTTP requests without supplying any credentials, requiring no user interaction and no elevated privileges. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-authentication, low-complexity attack profile makes this a high-priority remediation item for any deployment reachable from untrusted network segments.
Unauthenticated remote data exposure in Oracle Unified Directory allows attackers with network access via LDAP to read all directory-accessible data without credentials. Affected versions 12.2.1.4.0 and 14.1.2.1.0 of this Fusion Middleware identity store component are vulnerable to what Oracle and ENISA tag as an authentication bypass. With a CVSS 3.1 score of 7.5 and an AV:N/AC:L/PR:N/UI:N vector, exploitation is considered trivial for any attacker with network reach to the LDAP service port. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack surface makes this a high-priority patch target for organizations running OUD as a directory backend.
Unauthenticated confidentiality breach in Oracle Unified Directory (OUD Core) exposes all directory-accessible data via LDAP. Both supported releases - 12.2.1.4.0 and 14.1.2.1.0 - are affected, confirming this is not a legacy-only issue. The 'Authentication Bypass' tag combined with a PR:N/AV:N CVSS vector indicates attackers can read sensitive directory contents without credentials over the network; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote access to Oracle Hospitality Simphony's POS component enables complete unauthorized read access to all application data via an HTTP-based authentication bypass across three actively supported release lines. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms that no credentials, interaction, or special configuration are required - any network-reachable attacker can exploit the flaw. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated remote data exposure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows any network-accessible attacker to read critical or all data managed by the platform via HTTP, without any credentials or user interaction. The Lifecycle Management component contains an authentication bypass (per vendor tags) that collapses access controls entirely, exposing sensitive enterprise performance management data. No public exploit or CISA KEV listing is confirmed at time of analysis, but the low-complexity, zero-privilege CVSS vector indicates straightforward exploitability for any attacker with network reach.
Unauthenticated remote access to sensitive financial data is possible in Oracle Hyperion Financial Reporting version 11.2.25.0.000 via an authentication bypass in its Server component, exploitable over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no interaction, and no special configuration is required - making this trivially exploitable from any network-reachable position. Impact is limited to confidentiality, but the data exposed (financial reporting data) carries significant business and regulatory risk. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated broken access control in ThumbPress WordPress plugin (all versions before 6.5) exposes restricted functionality to remote unauthenticated attackers, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and low attack complexity, making it trivially automatable against any internet-facing WordPress site running the affected plugin. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, vendor-patched version 6.5 is available.
Unauthenticated broken access control in the Online Contact Widget WordPress plugin (versions ≤ 1.3.0) permits any network-accessible attacker to bypass authorization checks entirely, yielding high confidentiality impact against affected WordPress installations. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and minimal complexity, making the attack trivially repeatable at scale. No public exploit code or active exploitation has been confirmed at time of analysis, though the low complexity substantially reduces the barrier for independent exploit development.
Path traversal in AKINSOFT Wolvox9 ERP's KontrolPanel.exe component exposes arbitrary server-side files to unauthenticated remote attackers via unsanitized file path inputs. Affected deployments span versions s26.02.17 through s26.02.21, with a confirmed fix in version 26.02.22 per TR-CERT advisory TR-26-0851. No public exploit code or CISA KEV listing has been identified at time of analysis, but the PR:N/AC:L CVSS profile (7.5 High, C:H) means exploitation requires no specialized knowledge or credentials - any attacker with network reach to the service can trivially exfiltrate sensitive ERP data.
Full system takeover is possible in Oracle Process Manufacturing Systems (OPM), an Oracle E-Business Suite component, via a network-accessible flaw in the Internal Operations sub-component affecting versions 12.2.3 through 12.2.15. A low-privileged attacker operating over HTTP can, under high-complexity conditions, compromise confidentiality, integrity, and availability simultaneously - Oracle's own language is 'takeover of Oracle Process Manufacturing Systems.' No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope of impact makes this a priority patch target for manufacturing-sector organizations running Oracle EBS. Oracle addressed this in the Critical Patch Update for August 2026.