Oracle MES for Process Manufacturing versions 12.2.3 through 12.2.15 exposes unauthenticated remote attackers to complete confidentiality compromise and partial integrity loss via HTTP, contingent on a victim's interaction. The scope change in the CVSS vector confirms that a successful attack can cascade beyond the MES module itself into additional Oracle E-Business Suite components. No public exploit code or CISA KEV active-exploitation confirmation exists at time of analysis, but the low attack complexity and zero privilege requirement make this a credible phishing or watering-hole vector against manufacturing-sector targets.
Unauthorized data access and manipulation in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 is possible via an authentication bypass flaw in the Installation and Configuration component, exploitable by low-privileged network attackers over HTTP. Successful exploitation triggers a scope change, meaning compromise extends beyond the directly targeted component to additional Oracle Hyperion products, enabling full read access to critical data and unauthorized create, delete, or modify operations on critical Hyperion data. No public exploit code has been identified at time of analysis, though the CVSS 8.2 rating and scope-change designation elevate this above typical high-complexity findings.
Unauthorized data access and modification in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a low-privileged, network-based attacker to bypass access controls via a crafted SQL interaction, resulting in full confidentiality and integrity compromise of critical DRM data. The scope change (S:C) in the CVSS vector indicates successful exploitation can significantly impact additional Oracle products beyond DRM itself. No public exploit code or CISA KEV listing is identified at time of analysis, though the 'Authentication Bypass' tag signals the vulnerability undermines a core security control.
Unauthorized read and write access to critical data in Oracle Agile Engineering Data Management 6.2.1 is achievable by low-privileged network attackers targeting the Engineering Communication Interface (ECI) component via HTTP, with successful exploitation yielding high confidentiality and integrity impact (C:H/I:H) that can cascade to additional Oracle products via scope change. The 'Authentication Bypass' tag in reporter intelligence suggests the flaw enables attackers to exceed their granted access level within the ECI, despite requiring an initial low-privileged foothold. Oracle addressed this in the August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Critical confidentiality and integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables low-privileged network attackers to exploit the Security component via SFTP, gaining unauthorized read and write access to all critical data within the system. The CVSS scope change indicator confirms that successful exploitation can cascade beyond the directly targeted instance, significantly impacting additional Oracle Hyperion products sharing the same environment. No public exploit identified at time of analysis, though the combination of an authentication bypass tag and high-impact dual confidentiality and integrity outcomes makes this a material risk for any organization running this EPM platform.
Unauthenticated denial-of-service and partial data integrity compromise in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes the Content Acquisition System component to remote HTTP exploitation. An attacker with network access can repeatedly crash or hang the service and perform unauthorized data manipulation (insert, update, or delete) against accessible data stores. No public exploit code has been identified at time of analysis, and Oracle disclosed this in the August 2026 Critical Patch Update.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all application-accessible master data to unauthenticated remote attackers over HTTP, with additional limited write capability (insert, update, delete). The flaw resides in the Access and Security component, and Oracle's own advisory classifies it as 'easily exploitable' with a PR:N/AC:L attack vector - meaning any network-reachable instance requires no credentials or special conditions to exploit. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the low attack complexity and high confidentiality impact make this a high-priority patch target for enterprises running Oracle Hyperion.
Unauthenticated arbitrary content deletion in the Breeze WordPress caching plugin (≤ 2.5.12, by Cloudways) exposes any WordPress site running this plugin to remote content destruction without credentials. The missing authorization check (CWE-862) on deletion-capable endpoints allows any internet-facing attacker to trigger content removal, producing high availability impact and minor integrity impact per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H vector. No public exploit or CISA KEV listing has been identified at time of analysis, but the trivial exploitation profile makes rapid weaponization probable once a proof-of-concept surfaces.
Unauthenticated remote attackers can bypass access controls in the Imperative Web Server component of Oracle Helidon 3.2.18, gaining complete read access to all data accessible by the application and limited ability to modify or insert records via HTTP. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 8.2 (High), reflecting a fully network-accessible, zero-complexity attack requiring no credentials or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is addressed in Oracle's Critical Security Patch Update for August 2026.
Remote unauthenticated exploitation of Oracle VM VirtualBox 7.2.14 via its RDP component allows attackers to bypass authentication and gain full read access to all VirtualBox-accessible session data as well as limited write capability, without requiring any credentials or user interaction. The vulnerability resides in the Core component's Virtual Remote Desktop Extension (VRDE), exposed over the network via RDP. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-authentication network vector and low attack complexity make this a high-priority patching candidate for any deployment with VRDE enabled.
Remote unauthorized data access in Oracle Demand Planning versions 12.1 and 12.2 enables unauthenticated network attackers over HTTP to read all data accessible to the application and perform limited unauthorized write operations, with no authentication, elevated privileges, or user interaction required. Tagged as an authentication bypass by Oracle's own security team, this flaw carries a CVSS 3.1 base score of 8.2, reflecting high confidentiality and low integrity impact with no availability component. No public exploit code has been identified at the time of analysis, though the low attack complexity and complete absence of authentication barriers make this a straightforward target for automated or opportunistic exploitation once a proof-of-concept surfaces.
Oracle Hyperion Data Relationship Management version 11.2.25.0.000 exposes a network-exploitable flaw in its Access and Security component that allows low-privileged authenticated attackers to achieve full read and write access to critical master data and propagate impact across additional Oracle Hyperion components via a scope change. Oracle assigned a CVSS 8.2 base score and tagged the issue as an authentication bypass, indicating a breakdown in authorization enforcement rather than a trivial credential attack. No public exploit code or CISA KEV listing exists at time of analysis, but the scope change and high confidentiality and integrity impacts make this a priority patch target for organizations running integrated Hyperion environments.
Unauthenticated remote exploitation of Oracle Helidon 1.4.19's Imperative Web Server component via HTTP allows attackers to perform unauthorized creation, deletion, and modification of critical application data, with partial read access to Helidon-accessible data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero barriers to exploitation - no credentials, no user interaction, and low attack complexity over standard HTTP. Reported via Oracle's Critical Patch Update for August 2026 and tagged as an Authentication Bypass, with no public exploit code or CISA KEV listing identified at time of analysis.
Partial authentication bypass in Oracle Business Intelligence Enterprise Edition's BI Platform Security component allows a low-privileged remote attacker to compromise both confidentiality and integrity of critical OBIEE data, with a scope change indicating spillover impact on additional Oracle products within the same environment. Affected versions span three distinct release lines - 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 - covering a wide enterprise install base. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the combination of high-impact scope change and low privilege requirement elevates urgency even given the high attack complexity.
Unauthenticated remote attackers can compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via HTTP by exploiting an authentication bypass in the Endeca Application Controller component, with successful attacks requiring human interaction from a victim user. Exploitation yields complete read access to all data accessible by the Oracle Commerce application (C:H) and limited write capability (I:L), with a confirmed scope change meaning additional Oracle Commerce platform components beyond the targeted instance can be significantly impacted. Oracle characterizes this as easily exploitable in its August 2026 Critical Security Patch Update advisory; no public exploit has been identified at time of analysis.
Oracle Partner Management versions 12.2.3 through 12.2.15 (within Oracle E-Business Suite) exposes a network-accessible authentication bypass in its Internal Operations component, allowing unauthenticated remote attackers to compromise the application via HTTP - subject to a single victim interaction. Successful exploitation yields high-confidence access to critical partner data and limited write capability, with a scope change that may laterally impact additional Oracle EBS modules beyond Partner Management itself. No active exploitation (CISA KEV) or public POC has been identified at time of analysis, but the low-complexity, unauthenticated attack surface warrants priority patching for internet-facing EBS deployments.
Oracle Email Center versions 12.2.3 through 12.2.15 contains a network-exploitable authentication bypass in its Message Component that allows unauthenticated remote attackers to gain unauthorized access to critical data and perform limited data manipulation via HTTP, contingent on victim user interaction. The scope change embedded in the CVSS vector (S:C) indicates successful exploitation can extend impact beyond Email Center to other Oracle E-Business Suite components, materially amplifying real-world risk beyond the immediate application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this vulnerability in the August 2026 Critical Patch Update.
Buffer overflow in Dell PowerStore SDNAS's NFS/RPC subsystem exposes the entire PowerStore appliance line (500T through 7000T and beyond) to unauthenticated remote exploitation. The CWE-120 flaw in the RPC request handler allows an unauthenticated network attacker to achieve arbitrary command execution or denial of service against the NAS service. The CVSS 8.1 score is tempered by High Attack Complexity (AC:H), indicating exploitation requires non-trivial payload engineering rather than a simple spray-and-pray approach; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Full takeover of Oracle VM VirtualBox 7.2.14 is achievable by a locally-authenticated, high-privileged attacker, with confirmed scope change indicating the compromise extends beyond the hypervisor to additional products - consistent with a VM escape or host privilege escalation pattern. The CVSS vector (AV:L/PR:H/S:C/C:H/I:H/A:H) signals that despite the elevated privilege bar, successful exploitation yields complete confidentiality, integrity, and availability impact across system boundaries. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability is disclosed via Oracle's August 2026 Critical Patch Update advisory.
Unauthenticated Local File Inclusion in the Restaurant Menu by MotoPress WordPress plugin (versions ≤ 2.4.11) exposes WordPress deployments to arbitrary local file disclosure and potential remote code execution via PHP file-inclusion chains. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network exploitation requires no authentication or user interaction, though the high-complexity rating indicates specific server-side conditions or path knowledge are needed to reliably trigger the flaw. No confirmed active exploitation appears in CISA KEV and no public exploit code has been identified at time of analysis.
Integrity and availability compromise in Oracle Agile PLM 9.3.6 via the PGC / Excel Plugin component allows low-privileged, network-authenticated attackers to destroy or alter critical PLM data and cause complete denial-of-service through repeated application crashes. The CVSS 3.1 score of 8.1 reflects high integrity and availability impacts with no confidentiality exposure, delivered over HTTP without requiring user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes its Installation and Configuration component to unauthorized data manipulation and complete denial-of-service via HTTP by low-privileged authenticated network users. Exploitation allows an attacker to create, delete, or modify critical Hyperion EPM data and cause a full service hang or crash, directly threatening financial reporting and planning operations. No public exploit code has been identified at time of analysis, and Oracle addressed this in the August 2026 Critical Patch Update.
Oracle Workflow's Notification Mailer component in E-Business Suite versions 12.2.3 through 12.2.15 can be compromised by a low-privileged network attacker over HTTP, enabling unauthorized creation, deletion, or modification of critical workflow data and triggering a complete denial of service. The CVSS 3.1 score of 8.1 reflects high integrity and availability impacts with no confidentiality exposure, exploitable with low complexity and no user interaction. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Full takeover of Oracle Web Services Manager is achievable by unauthenticated remote attackers via HTTPS in versions 12.2.1.4.0 and 14.1.2.0.0 of the Oracle Fusion Middleware product line. The vulnerability resides in the Web Services Security component and carries a CVSS 3.1 base score of 8.1, with complete confidentiality, integrity, and availability impacts confirmed by Oracle's August 2026 Critical Patch Update advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Full system takeover of Oracle Call Center Technology - a component of Oracle E-Business Suite - is achievable by unauthenticated remote attackers via HTTP across versions 12.2.3 through 12.2.15, with successful exploitation yielding complete compromise of confidentiality, integrity, and availability. The high attack complexity (AC:H) designation indicates that exploitation requires satisfying non-trivial preconditions beyond mere network reachability, but no authentication or user interaction is necessary, keeping the attack surface entirely external. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Full takeover of Oracle Trading Community within Oracle E-Business Suite is achievable by unauthenticated remote attackers via HTTP, targeting the Party Search UI component across versions 12.2.3 through 12.2.15. The Oracle-reported CVSS vector confirms network accessibility with no privilege or user-interaction requirement, though high attack complexity (AC:H) indicates exploitation is non-trivial and likely requires precise conditions such as timing, specific request sequencing, or environment-dependent state. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Remote takeover of Oracle Enterprise Manager Base Platform is achievable by unauthenticated network attackers via HTTP targeting the Agent Next Gen component in versions 13.5 and 24.1. Despite the high attack complexity requirement (CVSS AC:H), successful exploitation yields complete compromise - high confidentiality, integrity, and availability impact, effectively full platform control. No public exploit or active exploitation has been identified at time of analysis, but the Oracle CPU August 2026 advisory documents this as a supported-version vulnerability requiring immediate attention.
Oracle Reports Developer 14.1.2.0.0, a component of Oracle Fusion Middleware, allows unauthenticated remote attackers to fully compromise the system via a network-accessible HTTP attack against its Security and Authentication component. Successful exploitation results in complete takeover - achieving high confidentiality, integrity, and availability impact - consistent with full control over the affected instance. No public exploit code has been identified at time of analysis, and exploitation requires high attack complexity (AC:H), meaning real-world exploitation depends on meeting specific non-trivial preconditions.
Full system takeover is achievable against JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.4 by an unauthenticated remote attacker over TLS, exploiting a flaw in the E1 IOT Orchestrator Security component. Successful exploitation results in complete compromise of confidentiality, integrity, and availability - effectively a full orchestrator takeover. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the high-severity impact warrants priority attention for Oracle JD Edwards deployments.
Full takeover of Oracle Identity Manager Connector is achievable by an unauthenticated remote attacker communicating over TLS, affecting the Core component of versions 12.2.1.4.0 and 14.1.2.1.0 under Oracle Fusion Middleware. The CVSS vector confirms network reachability with no privileges or user interaction required, though high attack complexity (AC:H) indicates that exploitation demands specific conditions beyond a simple point-and-shoot approach. No public exploit code or CISA KEV listing has been identified at time of analysis, but the complete confidentiality, integrity, and availability impact makes successful exploitation a full system compromise.
Integrity and availability compromise in Oracle Siebel Apps - Marketing (versions 17.0 through 26.6) is reachable by any low-privileged, network-authenticated attacker over HTTP with no user interaction required. Successful exploitation allows unauthorized creation, deletion, or modification of critical Marketing data, and can cause a complete denial of service via persistent hang or crash of the Marketing component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a credible threat in environments running unpatched Siebel deployments.
Remote integrity compromise and denial-of-service in Oracle WebLogic Server's Core component allows a low-privileged, network-accessible attacker to corrupt or destroy critical application data and crash the server via HTTP. All currently supported release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are affected, giving this vulnerability a wide blast radius across enterprise Oracle Fusion Middleware deployments. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified, but Oracle's own characterization of the flaw as 'easily exploitable' combined with only a low-privilege account requirement makes patching under the August 2026 CPU urgent.
SQL-layer exploitation in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged network attacker to fully compromise data confidentiality and integrity across all accessible financial data. The flaw resides in the Security component, and successful exploitation permits unauthorized read, creation, deletion, and modification of critical data - a particularly severe outcome for an EPM platform handling sensitive financial consolidation records. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network-accessible vector make this a high-priority patch target for any Oracle EPM deployment.
Unauthorized data access and modification in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged, network-adjacent attackers over HTTP, with no user interaction required. The vulnerability resides in the Access and Security component and is tagged as an authentication bypass, enabling an attacker who holds minimal credentials to escalate their effective access to critical or all DRM-accessible data - achieving both full confidentiality and full integrity compromise without triggering availability disruption. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and lack of user interaction make exploitation straightforward for any authenticated user.
Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes an access control bypass in its 'Access and security' component that permits low-privileged authenticated users, reachable over HTTP, to gain unauthorized read access to all application data and unauthorized write access enabling creation, deletion, or modification of critical data. Tagged as an Authentication Bypass by the advisory, the flaw delivers CVSS 3.1 High severity (8.1) with combined confidentiality and integrity impact against an enterprise master data management platform. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data access and manipulation in Oracle iRecruitment (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker to compromise the Internal Operations component via HTTP, resulting in full read access to and arbitrary creation, modification, or deletion of all iRecruitment-accessible data. Tagged as an Authentication Bypass class vulnerability, the flaw enables an attacker with minimal account privileges to exceed their authorization boundary - likely bypassing object-level access controls within the HR recruitment workflow. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; remediation is available via Oracle's Critical Security Patch Update (CPU) for August 2026.
Oracle Internet Procurement Connector in E-Business Suite versions 12.2.3 through 12.2.15 allows low-privileged authenticated network attackers to fully compromise data confidentiality and integrity within the connector via HTTP. Tagged as an authentication bypass by ENISA EUVD (EUVD-2026-61766), the flaw enables unauthorized creation, modification, deletion, and exfiltration of all connector-accessible data with no user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but Oracle's own characterization as 'easily exploitable' combined with low attack complexity and network accessibility make this a credible remediation priority for organizations running Oracle E-Business Suite.
Oracle Purchasing versions 12.2.5 through 12.2.15 within Oracle E-Business Suite expose an authorization bypass flaw in the Internal Operations component, allowing any authenticated low-privileged network user to gain complete read access to all purchasing data and perform unauthorized creation, deletion, or modification of critical records. Tagged as an Authentication Bypass by ENISA EUVD-2026-61762, the vulnerability is exploitable over HTTP with no user interaction and low attack complexity, making it a high-priority remediation target in Oracle EBS deployments. No public exploit code has been identified and the vulnerability is not currently listed in the CISA KEV catalog at time of analysis.
Oracle Risk Management versions 12.2.3 through 12.2.15 in Oracle E-Business Suite exposes critical data to low-privileged authenticated attackers over HTTP via a flaw in the Internal Operations component, tagged as an authentication bypass. A successful attack grants full unauthorized read access to all Risk Management data and the ability to create, delete, or modify critical records. No public exploit or CISA KEV listing has been identified at this time, but the low attack complexity and broad version range make this a high-priority patching target for Oracle EBS deployments.
Unauthorized data access and modification in Oracle Payables (E-Business Suite versions 12.2.3-12.2.15) is exploitable by any low-privileged authenticated attacker with HTTP network access, enabling full compromise of Payables confidentiality and integrity. The vulnerability resides in the Internal Operations component and is tagged as an authentication bypass, indicating that access-control deficiencies allow a low-privileged account holder to read or manipulate critical financial data-including supplier invoices, payments, and transaction records-beyond their intended authorization scope. No public exploit code and no CISA KEV listing exist at time of analysis; however, the low attack complexity, vendor-confirmed CVSS 8.1, and sensitive financial data at stake make this a meaningful priority for Oracle EBS environments.
Unauthorized data access and modification in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by low-privileged network attackers via the Common Events component over HTTP. The vulnerability enables complete confidentiality and integrity compromise of all Hyperion-accessible data without requiring elevated privileges or user interaction, yielding a CVSS 3.1 base score of 8.1. Oracle addressed this issue in the August 2026 Critical Patch Update; no public exploit has been identified at time of analysis.
Oracle Purchasing (E-Business Suite component: Internal Operations), versions 12.2.3 through 12.2.15, exposes critical data to unauthorized read and write operations by low-privileged authenticated network attackers over HTTP. The vulnerability is tagged as an Authentication Bypass, suggesting that a user with minimal system privileges can circumvent authorization controls to access or manipulate purchasing data beyond their permitted scope - including complete confidentiality and integrity compromise of all Oracle Purchasing accessible data. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but the low attack complexity and broad affected version range make this a meaningful priority for Oracle EBS deployments.
Unauthorized data access and modification in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows authenticated low-privileged attackers to bypass access controls in the Common Security component via HTTP, gaining read and write access to all critical EPM platform data. The 'Authentication Bypass' tag combined with a PR:L CVSS vector indicates an authorization bypass scenario: a minimal valid account is required but is sufficient to exceed intended access boundaries across confidentiality and integrity dimensions. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Full system takeover of Oracle PeopleSoft Enterprise FIN Common Objects 9.2 is achievable by an unauthenticated remote attacker over HTTP, with successful exploitation yielding complete compromise of confidentiality, integrity, and availability. The vulnerability resides in the Security component and is categorized as difficult to exploit, reflected in the CVSS AC:H rating, suggesting a precision exploitation condition such as a race condition or specific state requirement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the total-takeover impact and unauthenticated network vector make this a high-priority finding for any organization running affected PeopleSoft FIN deployments.
Full system takeover of Oracle Agile PLM MCAD Connector 3.6 is achievable by unauthenticated network attackers over HTTP, with successful exploitation yielding complete compromise of confidentiality, integrity, and availability. The flaw resides specifically in the CAX Client component of Oracle's Supply Chain suite and carries a CVSS 3.1 base score of 8.1 (High), moderated by high attack complexity (AC:H). No public exploit code or CISA KEV listing has been identified at time of analysis.
Full system takeover of Oracle Agile Engineering Data Management 6.2.1 is achievable by unauthenticated remote attackers via HTTP through a weakness in the Web Services Security component. The CVSS 3.1 score of 8.1 reflects complete confidentiality, integrity, and availability compromise (C:H/I:H/A:H), tempered by high attack complexity (AC:H). No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; Oracle addressed it in the Critical Patch Update for August 2026.
Full system takeover is achievable in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via an unauthenticated HTTP attack targeting the Forge component. The CVSS 3.1 score of 8.1 reflects high confidentiality, integrity, and availability impact, though the AC:H rating indicates exploitation is not trivial and requires the attacker to meet specific conditions. No public exploit code has been identified and CISA has not listed this in KEV at time of analysis, but the vendor-confirmed full-takeover outcome warrants urgent patching given the absence of authentication requirements.
Full system takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by an unauthenticated remote attacker over HTTP, with successful exploitation resulting in complete compromise of confidentiality, integrity, and availability. The vendor-assigned CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms network reachability without authentication, though the high attack complexity rating indicates non-trivial exploitation conditions that reduce the likelihood of opportunistic mass exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Full system takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by unauthenticated remote attackers over HTTP without user interaction. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates the attack is network-accessible and requires no credentials, but high attack complexity (AC:H) implies specific preconditions - such as race conditions, timing requirements, or environmental factors - that prevent trivial mass exploitation. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though full CIA impact at CVSS 8.1 makes this a high-priority remediation target for organizations running this EPM platform.
Full takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by an unauthenticated remote attacker via HTTP, according to Oracle's August 2026 Critical Security Update. The vulnerability resides in the Server component and, if successfully exploited, results in complete compromise of confidentiality, integrity, and availability of the affected instance. No public exploit code or CISA KEV listing has been identified at time of analysis; the High attack complexity rating reduces the likelihood of opportunistic mass exploitation but does not eliminate targeted risk.