Oracle Reports Developer 14.1.2.0.0 exposes an unauthenticated authentication bypass in its Security and Authentication component, allowing an attacker on the same physical network segment to fully compromise confidentiality and integrity of all accessible data - including critical data - without any credentials or user interaction. The vulnerability carries a scope change, meaning successful exploitation may cascade to impact additional Oracle Fusion Middleware products beyond Reports Developer itself. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.22% (13th percentile), suggesting low opportunistic risk despite the critical vendor-stated CVSS base score.
Improper access control in Oracle Reports Developer 12.2.1.19.0 enables unauthenticated attackers positioned on the same network segment as the host to fully compromise confidentiality and integrity of all data accessible by the product, with scope change allowing impact to additional Oracle Fusion Middleware components. The vulnerability carries tags of Authentication Bypass and is tracked under CWE-284 (Improper Access Control). No public exploit code or CISA KEV entry exists at time of analysis, and the EPSS score of 0.22% (13th percentile) reflects low observed exploitation probability despite the high theoretical severity.
Local privilege escalation and denial-of-service in Oracle VM VirtualBox 7.2.14 allows a high-privileged attacker with local infrastructure access to crash the hypervisor, partially read or modify VM-accessible data, and - critically - extend impact beyond the vulnerable instance to additional products via a confirmed scope change. The CVSS 3.1 vector (AV:L/PR:H/S:C/A:H) indicates this is not a remote threat but a post-compromise or insider-level concern targeting the virtualization layer. No public exploit code or active exploitation has been identified at time of analysis, and Oracle disclosed this through its Critical Patch Update for August 2026.
Local privilege escalation with scope change in Oracle VM VirtualBox 7.2.14 allows a high-privileged local attacker to crash the hypervisor repeatedly, modify limited guest data, and read a subset of accessible data - with impacts that extend beyond the VirtualBox process to additional co-hosted products. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog. The scope change (S:C in CVSS) is the critical differentiator, indicating that a compromised VirtualBox instance can affect the host OS or sibling VMs, raising the actual blast radius above what the per-component impact ratings suggest.
Oracle SDP Number Portability versions 12.2.3 through 12.2.15, a telecommunications management component of Oracle E-Business Suite, exposes a local privilege-abuse flaw in its Internal Operations component that enables high-privileged insiders or post-breach actors to compromise the affected system. Successful exploitation grants unauthorized creation, deletion, or modification of critical data, read access to a subset of accessible data, and the ability to cause a partial denial of service - with a scope change (S:C) extending potential impact to additional Oracle products co-hosted in the same E-Business Suite environment. No public exploit code exists and this CVE does not appear in the CISA KEV catalog at time of analysis; the CVSS 3.1 base score of 7.3 reflects the scope change rather than inherent exploitability from the perimeter.
Symlink following vulnerability across nine Dell enterprise storage and infrastructure products enables a locally authenticated, low-privileged attacker to elevate their privileges, potentially achieving full system compromise (C:H/I:H/A:H). Affected platforms span Dell AppSync 4.6.0.0, Metro Node 8.0.0, UCC Edge 3.0.1, VxRail 8.0.322, PowerMax 10.3.0, Unity 5.4, PowerFlex Manager 4.5.4, PowerFlex Intelligent Catalog 46.377.00 and 46.382.00, and PowerFlex Rack 4.5.4 and prior. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis, but the breadth of affected Dell enterprise products and the high-impact CVSS metrics make patching a priority for organizations running Dell storage infrastructure.
Local privilege abuse in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) allows a low-privileged OS-level user on the hosting infrastructure to compromise the Siebel Cloud Manager component, achieving full read access to all CRM application data and limited write access, with a confirmed scope change extending impact to additional co-hosted products. The attack vector is local infrastructure access, making this primarily an insider threat or post-compromise lateral movement risk rather than an external internet-facing exposure. No public exploit has been identified, and Oracle addressed this vulnerability in the August 2026 Critical Patch Update (CPU Aug 2026).
Complete compromise of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 is achievable through the Presentation Services component by a low-privileged attacker who already holds a local logon on the OBIEE host and can engineer interaction from a second user. Successful exploitation yields full confidentiality, integrity, and availability impact - effectively a takeover of the OBIEE instance. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog as of this analysis.
Elevation of privileges in Dell Alienware Command Center (AWCC) versions prior to 6.14.20.0 allows a low-privileged local user to gain higher system access by exploiting a Least Privilege Violation (CWE-272). The application operates with or invokes components carrying excessive privileges, which a local attacker can abuse through an interaction-dependent trigger to achieve full confidentiality, integrity, and availability impact on the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the full C:H/I:H/A:H triad indicates complete system compromise potential if the privilege boundary is crossed successfully.
Full system takeover of Oracle Call Center Technology (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a high-privileged attacker with network access over HTTP targeting the Internal Operations component. The vulnerability is rated 7.2 CVSS 3.1 with complete Confidentiality, Integrity, and Availability impacts, meaning successful exploitation yields effective control of the affected instance. No public exploit code has been identified at time of analysis, and the requirement for high-privilege credentials is the primary limiting factor constraining real-world exposure.
Full system takeover of Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 is achievable by a high-privileged attacker over HTTP, targeting the Analytics Web Answers component with no user interaction required. The C:H/I:H/A:H impact triad confirms complete compromise of confidentiality, integrity, and availability once exploitation succeeds. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the low attack complexity (AC:L) means that any attacker who clears the authentication barrier faces minimal technical obstacles to achieving full takeover.
Full system takeover of Oracle Hyperion Financial Management version 11.2.25.0.000 is achievable by a network-accessible, high-privileged attacker exploiting a flaw in the Security component via HTTP. The vulnerability carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, amounting to effective product compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and complete CIA triad impact warrant prompt remediation attention.
Oracle Hyperion Financial Management 11.2.25.0.000 contains a flaw in its Security component that allows a high-privileged, network-authenticated attacker to achieve full system takeover via HTTP, impacting confidentiality, integrity, and availability. Disclosed via Oracle's August 2026 Critical Security Patch Update (CSPU) and corroborated by EUVD-2026-61886, the attack requires no user interaction and has low complexity once privileged credentials are available. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Full takeover of PeopleSoft Enterprise FIN Common Objects Brazil 9.1 is achievable by a high-privileged attacker with network access using Oracle's T3 or IIOP protocols. The vulnerability carries a CVSS 3.1 score of 7.2, reflecting complete confidentiality, integrity, and availability impact despite the PR:H prerequisite. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though Oracle's August 2026 Critical Patch Update advisory addresses it.
Full takeover of Oracle Proposals (Oracle E-Business Suite component) is achievable by a high-privileged, network-adjacent attacker over HTTP, resulting in complete compromise of confidentiality, integrity, and availability. Affected deployments span versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, a widely deployed enterprise ERP platform. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Patch Update.
Full system takeover in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 is achievable by a high-privileged, network-authenticated attacker via HTTP against the Deployment component, resulting in complete confidentiality, integrity, and availability compromise. Disclosed as part of Oracle's August 2026 Critical Security Update (CPU) and registered in ENISA EUVD (EUVD-2026-61690), with no confirmed active exploitation or public exploit code at time of analysis. The PR:H prerequisite significantly constrains the attacker population to insiders, compromised administrator accounts, or actors with prior lateral movement to admin-level access.
Full compromise of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61-8.63) is achievable by a network-accessible, highly privileged attacker via a flaw in the PeopleCode component over HTTP. Successful exploitation results in complete confidentiality, integrity, and availability impact - Oracle characterizes the outcome as a full 'takeover' of the PeopleSoft environment. No public exploit code or CISA KEV listing has been identified at time of analysis, and the PR:H requirement narrows the realistic attacker population to those already holding administrative-level credentials.
PHP Object Injection in the OptionTree WordPress plugin (versions <= 2.7.3) enables authenticated administrators to submit crafted serialized PHP data through the plugin's Editor interface, triggering dangerous deserialization that can culminate in arbitrary code execution on the host server. The CVSS vector (PR:H) confirms that exploitation is gated behind WordPress administrator credentials, constraining the immediate threat surface. No public exploit code or active exploitation has been identified at time of analysis.
Full system takeover of Oracle HRMS (Netherlands) versions 12.2.3 through 12.2.15 is achievable by a high-privileged remote attacker targeting the Netherlands Payroll component over HTTP. The CVSS vector confirms network accessibility with low attack complexity, no user interaction, and complete compromise of confidentiality, integrity, and availability upon successful exploitation. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Full system takeover in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged attacker with HTTP network access, exploiting a flaw in the Security component. Oracle's own description characterizes the outcome as complete compromise, with CVSS 3.1 confirming full confidentiality, integrity, and availability impact (C:H/I:H/A:H), making this more severe than the accompanying 'Information Disclosure' tag suggests. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Purchasing, a procurement module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes a high-severity network-exploitable vulnerability in its Internal Operations component that enables full system takeover - complete loss of confidentiality, integrity, and availability. Oracle itself classifies this as 'easily exploitable' despite the high-privilege requirement (PR:H), meaning that once an attacker possesses elevated credentials, exploitation presents no meaningful technical barrier. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the full CIA impact and low attack complexity make this a priority patching target for any organization running internet-exposed or broadly network-accessible Oracle EBS deployments.
Full system takeover of Oracle Cost Management (versions 12.2.3-12.2.15) is achievable by a highly privileged network attacker via HTTP, resulting in complete compromise of confidentiality, integrity, and availability. The vulnerability resides in the Cost Planning component of Oracle E-Business Suite and is characterized by Oracle as 'easily exploitable' - meaning low attack complexity once credentials are obtained. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote exploitation of Oracle Helidon 4.5.3's Imperative Web Server component allows attackers to bypass authentication controls via HTTP, resulting in unauthorized read access to a subset of application data and the ability to insert, update, or delete accessible records. The CVSS scope change (S:C) indicates successful exploitation can affect additional systems beyond the Helidon instance itself - a compounding factor in microservices topologies where Helidon acts as a gateway or intermediary. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated, low-complexity attack path makes this credible against any internet-exposed deployment.
Unauthenticated remote exploitation of the Imperative Web Server component in Oracle Helidon 4.5.0 allows network-accessible attackers to perform unauthorized read and write operations against application-accessible data, with confirmed scope change indicating downstream impact on adjacent systems beyond the directly targeted Helidon instance. The vulnerability is tagged as an authentication bypass, meaning the HTTP-exposed service fails to enforce access controls on one or more endpoints. No public exploit code has been identified at time of analysis, and the issue is not listed in the CISA KEV catalog, though Oracle's Critical Patch Update advisory for August 2026 confirms the vulnerability's existence and assigns a CVSS 3.1 score of 7.2.
Authentication bypass in Oracle Helidon 3.2.18's Imperative Web Server allows remote unauthenticated attackers to read a subset of application data and make unauthorized modifications via HTTP, with a scope change indicating potential cascade impact to downstream services. The CVSS 3.1 score of 7.2 (High) is elevated by the scope change (S:C), reflecting Helidon's common role as a gateway or orchestrator in microservices architectures. No public exploit or CISA KEV listing has been identified at time of analysis, but the fully unauthenticated, low-complexity, network-accessible attack profile makes this a credible and time-sensitive patching priority for any internet-exposed deployment.
Authentication bypass in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated remote attackers to read a subset of accessible data and perform unauthorized insert, update, or delete operations via HTTP. The vulnerability carries a scope-change designation (S:C in CVSS), meaning successful exploitation may cascade beyond Helidon itself to impact additional products or services in the surrounding microservices environment. No public exploit code or active exploitation has been confirmed at time of analysis, but the zero-prerequisite attack profile - no authentication, low complexity, no user interaction - makes this straightforward to exploit once the bypass mechanism is understood.
Unauthenticated network exploitation of Oracle Helidon 3.2.19's Imperative Web Server component allows remote attackers to bypass authentication over HTTP, gaining unauthorized read access to a subset of data and the ability to insert, update, or delete accessible data. The CVSS S:C scope change is particularly significant: in microservices environments where Helidon acts as a service layer, successful exploitation may cascade to impact downstream or co-located systems beyond the initially compromised component. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the zero-prerequisites attack profile (AV:N/AC:L/PR:N/UI:N) and scope change make this a prioritized patching target for any organization running the affected version.
Unauthenticated remote exploitation of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via HTTP allows attackers to read a subset of accessible data and perform unauthorized data modification (insert, update, delete) through the Endeca Application Controller component. The scope change indicator in the CVSS vector (S:C) signals that successful attacks can impact systems beyond the directly targeted instance. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-authentication, network-accessible attack surface lowers the bar for exploitation significantly.
Unauthenticated remote exploitation of Oracle Reports Developer 12.2.1.19.0 via SMTP allows attackers to perform unauthorized data manipulation and cause a partial denial of service against the affected instance. The vulnerability resides in the Security and Authentication component of Oracle Fusion Middleware, and carries a scope-change designation indicating that successful attacks may cascade to impact additional Oracle products sharing the same environment. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated SSRF in OttoKit WordPress plugin (≤1.1.35) allows any remote attacker without credentials to coerce the host server into making arbitrary outbound HTTP requests to attacker-controlled targets, including internal network resources and cloud metadata endpoints. The CVSS S:C (Scope Changed) rating confirms the vulnerability crosses security boundaries beyond the WordPress instance itself, enabling internal network reconnaissance, credential harvesting from cloud metadata services (e.g., AWS IMDSv1), or interaction with internal APIs. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Unauthenticated Server-Side Request Forgery in PDF Smart Viewer for Elementor (WordPress plugin by Deknows, versions up to and including 1.0.4) allows any remote, unauthenticated attacker to coerce the WordPress server into issuing arbitrary HTTP requests to attacker-controlled destinations. With a CVSS scope change (S:C), this vulnerability can be leveraged to probe and interact with internal network services not directly exposed to the internet, including cloud metadata endpoints, internal APIs, and adjacent infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-barrier entry (PR:N, UI:N, AC:L) makes it trivially scriptable.
Remote File Inclusion in the Easy Google Maps WordPress plugin (versions below 1.14.2) by Supsystic exposes unauthenticated remote attackers to include arbitrary external files into the server-side execution context with no credentials or user interaction required. The CVSS scope change (S:C) indicates impact extends beyond the plugin itself to the broader WordPress installation, enabling limited confidentiality and integrity compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-prerequisite attack surface makes this a meaningful priority for any site running the affected plugin.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a high-privileged, network-exploitable vulnerability in its Security component that enables complete unauthorized read access to all data accessible by the application, with additional limited integrity and availability impacts. The CVSS scope change (S:C) is a critical signal: successful exploitation can significantly affect other products within the same Oracle Hyperion suite deployment, amplifying organizational risk beyond the directly targeted component. No public exploit identified at time of analysis, and no CISA KEV listing; however, the combination of scope change and high confidentiality impact warrants prioritization in Oracle Hyperion deployments.
Unauthenticated remote exploitation of the Endeca Application Controller in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 permits attackers to read a subset of application data and perform unauthorized inserts or modifications over HTTP without any credentials. The vulnerability carries a confirmed scope change, meaning successful exploitation can propagate impact into adjacent Oracle Commerce components beyond the directly targeted service. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-friction exploitation path - no authentication, no user interaction, low complexity - makes this an attractive opportunistic target for any attacker able to reach the exposed HTTP service.
Stored Cross-Site Scripting in the Quill Forms WordPress plugin (all versions through 5.7.1) enables unauthenticated attackers to permanently inject arbitrary JavaScript into pages rendered by the plugin. The CVSS vector (PR:N, S:C) confirms no authentication is needed to plant the payload, and the scope change indicates injected scripts execute in victims' browser sessions - enabling session hijacking, credential theft, or admin account takeover when privileged users view affected pages. Reported by Wordfence and corroborated by Patchstack; no public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Order Management's Product Diagnostic Tools component exposes a local privilege-dependent flaw affecting versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, allowing a high-privileged local attacker to achieve unauthorized read and write access to critical data with scope impact extending beyond the Order Management module itself. The CVSS vector (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) confirms that exploitation is constrained to infrastructure-level access, requiring both physical or logical logon to the host system and an elevated account, but successful exploitation yields complete confidentiality and integrity compromise. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed.
Local code execution and data compromise in Oracle PeopleSoft Enterprise PeopleTools (Data Mover component) affects versions 8.61 through 8.63, requiring a highly privileged attacker with physical or logical infrastructure access and human interaction from a secondary party. Successful exploitation results in full confidentiality and integrity compromise of PeopleTools data, potential modification or deletion of critical records, and partial denial of service, with a confirmed scope change that can cascade impact to additional dependent PeopleSoft products. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Oracle CSPU August 2026 advisory confirms this as a patched, vendor-acknowledged vulnerability.
Oracle General Ledger versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, contains an authentication bypass weakness in the Internal Operations component that allows a highly privileged local attacker to gain unauthorized read and write access to critical financial ledger data, with a scope change that may cascade impact to additional Oracle EBS products. The attack requires local infrastructure logon and high attack complexity, substantially constraining the realistic attacker population to insiders or those who have already compromised the host environment. No public exploit code has been identified and Oracle has addressed this through the August 2026 Critical Patch Update.
Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 expose critical identity and access management data to local, low-privileged attackers who can engineer mandatory third-party user interaction, with successful exploitation crossing scope boundaries into additional Oracle Fusion Middleware components. The CVSS 3.1 base score of 7.2 reflects high confidentiality and integrity impacts under a scope-change scenario, though the local attack vector and high complexity substantially constrain real-world reach. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Oracle Applications DBA, the administrative component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, exposes critical internal operations over HTTP to low-privileged attackers. Successful exploitation enables unauthorized access to critical or complete data accessible by the Applications DBA component, along with the ability to trigger partial denial-of-service conditions against the same component. No public exploit has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog, though the low complexity and broad network accessibility make it a meaningful risk in unpatched EBS deployments.
Broken authentication in MWB HubSpot for WooCommerce versions 1.6.7 and earlier allows subscriber-level authenticated WordPress users to bypass access controls and invoke functionality reserved for higher-privileged roles. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) places the primary impact on availability (High), with limited integrity impact and no confirmed confidentiality exposure - notable given the 'Information Disclosure' tag applied by Patchstack, which is not reconciled by the official scoring. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthorized data access and partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 are achievable by any low-privileged, network-connected attacker via HTTP, with no user interaction required. The vulnerability resides in the Security component and, per vendor-assigned tags, involves an authentication bypass mechanism that elevates effective access beyond the attacker's granted privileges, enabling exposure of critical financial data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's KEV catalog; however, the low attack complexity and broad network exposure make it a high-priority remediation target for organizations running the affected release.
Unauthorized data disclosure and partial denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to gain complete read access to all financial data accessible within the application and degrade service availability via HTTP. The 'Authentication Bypass' tag suggests the Security component vulnerability enables privilege escalation beyond the attacker's granted role, exposing sensitive financial consolidation data. No public exploit or CISA KEV listing exists at time of analysis, but the combination of low attack complexity, network accessibility, and high confidentiality impact against enterprise financial data makes this a meaningful priority for affected organizations.
Unauthorized data disclosure and partial denial of service in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 is achievable by any low-privileged attacker with network access over HTTP targeting the Deployment component. The combination of a high confidentiality impact and an 'Authentication Bypass' tag from EUVD suggests the flaw may allow authenticated users to escalate access beyond their authorization level, potentially exposing all financial and operational data managed by the platform. No public exploit code or CISA KEV listing exists at time of analysis, though Oracle has addressed this in the August 2026 Critical Security Patch Update.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes critical data and partial availability loss to low-privileged network attackers via a flaw in its Security component, accessible over HTTP. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms easy network exploitation requiring only a low-privilege account with no interaction, yielding high confidentiality impact and partial denial of service. Notably, the 'Authentication Bypass' tag in the intelligence data suggests the effective exploitation barrier may be lower than the PR:L metric implies. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthorized data disclosure and partial service disruption affect Oracle Siebel CRM's Marketing component across versions 17.0 through 26.6, exploitable by a low-privileged authenticated attacker via HTTP without requiring user interaction. The flaw enables complete read access to all data within the Siebel Apps - Marketing scope alongside degraded service availability, as confirmed by Oracle's August 2026 Critical Security Patch Update. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog.
Oracle Warehouse Management versions 12.2.3 through 12.2.15 within Oracle E-Business Suite allows low-privileged network-authenticated attackers to corrupt, delete, or create critical warehouse data and partially disrupt service availability over HTTP. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms easy exploitability requiring only a low-privilege account and HTTP connectivity - no user interaction or elevated rights are needed. No public exploit code or CISA KEV listing has been identified at time of analysis; the August 2026 Oracle Critical Patch Update references a fix.
Oracle WebCenter Portal's Runtime Tools component in versions 12.2.1.4.0 and 14.1.2.0.0 is exploitable over HTTP by unauthenticated remote attackers, subject to victim user interaction, enabling unauthorized modification or deletion of portal data and a partial denial of service. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R vector confirms low-complexity network exploitation requiring no credentials, only that a victim user be induced to interact with attacker-controlled content. No public exploit code or CISA KEV listing has been identified at time of analysis; this was disclosed as part of Oracle's August 2026 Critical Patch Update.
Remote authentication bypass in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to gain unauthorized access to all content managed by the platform and perform limited data modification, provided a victim user interacts with attacker-controlled material. The Oracle August 2026 CPU advisory confirms both supported release trains are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of unauthenticated network access, low complexity, and a high confidentiality impact makes this a priority patch for any Oracle Fusion Middleware deployment.
Authenticated low-privileged network exploitation of Oracle Financials for Asia/Pacific (versions 12.2.3-12.2.15) enables unauthorized creation, deletion, or modification of critical financial data, with partial read access to additional records. The vulnerability resides in the Internal Operations component of Oracle E-Business Suite and is reachable over HTTP without user interaction. No public exploit or active KEV listing has been identified at time of analysis, though Oracle classifies it as 'easily exploitable,' and the 'Authentication Bypass' tag suggests the low-privilege requirement may be bypassed or trivially satisfied under certain conditions.