Oracle Unified Directory (OUD) versions 12.2.1.4.0 and 14.1.2.1.0 expose a network-accessible LDAP authorization bypass that enables a low-privileged authenticated attacker to gain unauthorized access to critical or complete directory data. Intelligence sources tag this as an authentication bypass in the OUD Core component, with confirmed scope change impact on additional Oracle Fusion Middleware products consuming OUD identity data. No active exploitation confirmed at time of analysis and no public exploit code has been identified; however, the low attack complexity and network accessibility make this a credible priority for Oracle Fusion Middleware environments.
Unauthorized data access and modification in Oracle Public Sector Human Resources (E-Business Suite versions 12.2.3-12.2.15) is achievable by a high-privileged remote attacker via HTTP, with exploitation triggering a scope change that can affect systems beyond the directly targeted component. The flaw resides in the Regression Testing component and carries CVSS 3.1 Base Score 7.7, reflecting high confidentiality and integrity impacts. No public exploit or CISA KEV active-exploitation listing has been identified at time of analysis.
Oracle Siebel CRM End User versions 17.0 through 26.6 expose a network-exploitable flaw in the Open UI component that, when triggered via a crafted HTTPS interaction, grants a low-privileged attacker full read and write access to critical CRM data - including complete confidentiality and integrity compromise with a documented scope change to additional products. The 'Authentication Bypass' tag reported by Oracle's security team suggests the Open UI layer can be manipulated to circumvent access controls in the context of an authenticated victim's session. No exploit code is publicly available and the vulnerability is not listed in the CISA KEV catalog at the time of analysis.
Session cookie forgery in Zabbix 7.4 is possible because the cryptographic key used to sign Frontend sessions is erroneously written to the database seed, making it readable by anyone with adjacent database access. The vendor-confirmed exploitation path is narrowly scoped: only deployments running both SAML authentication and guest users simultaneously are at known risk, where the extracted key can be used to forge valid session cookies and achieve unauthorized frontend access. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the vendor explicitly states no known impact for deployments outside the SAML-plus-guest-user configuration.
Oracle VM VirtualBox 7.2.14 Core component exposes a scope-changing integrity vulnerability that allows a local unauthenticated attacker - with logon access to the infrastructure hosting the hypervisor - to critically compromise VirtualBox data when a legitimate third party interacts with the product. The attack vector is local and requires human interaction, but the CVSS scope change (S:C) indicates that a successful exploit can break VM containment and significantly impact the host system or co-resident components beyond VirtualBox itself. No public exploit is identified at time of analysis, and the vulnerability is addressed via Oracle's August 2026 Critical Security Patch Update.
Device identity replay in UNITRONIX BetterDesk through version 2.3.0 permits unauthenticated clients to resurrect soft-deleted peer registrations by presenting a known deleted device ID, bypassing administrator-enforced device exclusion controls. The root cause is an implicit SQL upsert that cleared soft-deletion flags on any conflicting registration insert, meaning deletion was not enforced at the database layer. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, CVSS AC:H reflects the non-trivial but realistic prerequisite of possessing a previously issued device identifier.
Use-after-free in Valkey's TLS connection handler allows an authenticated remote attacker to crash the server or potentially achieve remote code execution on TLS-enabled deployments. The flaw exists across all Valkey branches prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, confirmed via GitHub security advisory GHSA-53mc-f3m3-99vh and EUVD-2026-60822. No active exploitation has been confirmed (not in CISA KEV), but the full C:H/I:H/A:H CVSS impact and the RCE/Memory Corruption tags warrant prompt patching for any TLS-configured Valkey instance.
Server-side template injection in GBIF Integrated Publishing Toolkit (IPT) versions before 3.3.4 permits remote low-privileged authenticated attackers to read arbitrary server-side files and access internal application state by injecting template directives into unsanitized user-controlled input. Disclosed by Mandiant (MNDT-2026-0016), the flaw maps to CWE-1336 and carries a CVSS 4.0 score of 7.6 with high confidentiality and integrity impact on the vulnerable system. No confirmed active exploitation or CISA KEV listing exists at time of analysis, but the potential for credential and configuration file exposure makes this a meaningful risk for biodiversity data publishing deployments.
Unauthorized data manipulation in Oracle General Ledger (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged, network-authenticated attacker to create, delete, or modify critical financial records via HTTP, with secondary read and partial availability impacts. The vulnerability resides in the Internal Operations component and requires only a valid low-privilege account - no elevated rights or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high integrity impact make this a significant risk for any organization running Oracle EBS financials.
Improper authorization in Atlassian Bamboo Data Center across six affected release lines (10.0.x through 12.1.x) enables authenticated low-privilege users to bypass access controls and reach restricted resources or functionality, with Atlassian tagging the flaw as carrying arbitrary code execution risk. The vulnerability was discovered through Atlassian's own penetration testing program and affects Data Center deployments only - not Bamboo Cloud. No public exploit code or CISA KEV listing exists at time of analysis, but the high confidentiality and integrity impact ratings (VC:H/VI:H in CVSS 4.0) and the RCE tag make this a credible escalation risk in any environment where untrusted or lightly-privileged users hold Bamboo accounts.
Unauthorized data access and partial denial of service affect Oracle General Ledger versions 12.2.3 through 12.2.15, a core financial management component of Oracle E-Business Suite. A low-privileged, network-authenticated attacker can exploit the Internal Operations component via HTTP to gain complete read access to all Oracle General Ledger data, perform unauthorized insert/update/delete operations on a subset of that data, and cause a partial availability disruption. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Oracle Advanced Inbound Telephony versions 12.2.3 through 12.2.15 exposes its Internal Operations component to low-privileged HTTP attackers who can achieve full read access to sensitive telephony data, limited data manipulation, and partial denial of service. The 'Authentication Bypass' tag suggests that while a valid low-privilege account is required to initiate the attack, the Internal Operations component fails to enforce additional authorization controls, allowing privilege escalation within the application. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the vulnerability was disclosed by Oracle's own security team via the August 2026 Critical Patch Update.
Oracle General Ledger within E-Business Suite versions 12.2.3 through 12.2.15 exposes critical financial data to high-privileged network attackers through a flaw in the Internal Operations component accessible over HTTP. Successful exploitation grants complete read access to all General Ledger data and partial write capability, with a confirmed scope change meaning compromise can cascade to additional Oracle EBS products. Disclosed through Oracle's August 2026 Critical Patch Update, no public exploit code has been identified at time of analysis.
Oracle Product Lifecycle Analytics 3.6.1 exposes a network-accessible vulnerability in its installation component that allows low-privileged authenticated attackers to fully read all application data, perform limited data modification, and cause partial service disruption via HTTP. The CVSS 3.1 score of 7.6 reflects meaningful real-world impact, particularly the high confidentiality impact against a supply chain analytics platform that may contain sensitive product and operational data. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 expose a high-severity flaw in the Runtime Tools component that allows a low-privileged, network-accessible attacker to gain complete read access to all portal-accessible data and perform limited data manipulation and partial denial of service via HTTP. The vulnerability is rated CVSS 7.6 and disclosed as part of Oracle's Critical Patch Update for August 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag in the intelligence metadata suggests potential elevation from low-privilege access that warrants close attention.
Product review management in Vvveb CMS prior to 1.0.8.4 exposes a broken object-level authorization flaw (CWE-639) allowing any authenticated low-privileged Vendor to read, modify, and delete product reviews belonging to other Vendors. The backend SQL queries for all supported database drivers (mysqli, pgsql, sqlite) accept a caller-controlled product_review_id without validating ownership against the requesting admin_id, enabling cross-Vendor review manipulation. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS 7.6 High score reflects significant integrity impact in multi-vendor marketplace deployments.
Authorization bypass in Vvveb CMS prior to version 1.0.8.4 allows authenticated low-privileged Vendor accounts to perform unauthorized read, edit, status-change, and delete operations on product Q&A entries belonging to other Vendors. The backend SQL query files for all three supported database engines (MySQL, PostgreSQL, SQLite) accepted a caller-controlled product_question_id without joining the product table to verify that the question belongs to a product owned by the current admin_id. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the fix is confirmed in the released version 1.0.8.4 via GitHub advisory GHSA-cjhq-xqq3-6xv8.
Insecure Direct Object Reference (IDOR) in Vvveb CMS prior to 1.0.8.4 allows authenticated low-privileged Authors to perform unauthorized comment operations across author boundaries in the admin backend. The admin/controller/content/comment.php and comments.php controllers accept caller-controlled comment_id values without validating that the referenced comment's parent post belongs to the requesting author, enabling cross-author comment enumeration, content manipulation, status changes, and deletion. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network-accessible attack surface make this straightforward for any authenticated low-privilege user to abuse.
Multiple broken object-level authorization flaws in Hoppscotch's GraphQL backend allow any authenticated workspace member to read co-members' private API request history, active session data, authorization headers, stored credentials in environment variables, and application settings - and to mutate or delete victims' history entries without ownership validation. All self-hosted and applicable SaaS deployments running versions prior to 2026.6.0 are affected. No public exploit code or CISA KEV listing has been identified, but the low attack complexity combined with high confidentiality impact makes this a material risk in any multi-user workspace deployment.
Cross-context data exposure in Oracle WebCenter Portal's Runtime Tools component allows a low-privileged, network-authenticated attacker to compromise confidentiality at high severity and integrity at limited scope, with a scope change that can impact additional Oracle Fusion Middleware products. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, and Oracle classifies this as 'easily exploitable' despite the user-interaction requirement. No public exploit or CISA KEV listing has been identified at time of analysis, but the Oracle-tagged 'Authentication Bypass' descriptor suggests privilege escalation beyond the attacker's granted access level is central to the vulnerability's mechanism.
Oracle WebCenter Content's Content Server component in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is exploitable by a low-privileged authenticated attacker over HTTP who can lure a higher-privileged victim into interacting with malicious content, resulting in unauthorized access to critical data and partial data manipulation with confirmed scope impact beyond WebCenter Content itself. Tagged as an authentication bypass by Oracle, this vulnerability carries a CVSS 3.1 base score of 7.6 and is classified as easily exploitable in Oracle's August 2026 Critical Patch Update. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in @neo4j/graphql exposes admin-restricted custom-resolver fields to any authenticated user holding a legitimately issued, non-admin JWT. When both a type-level @authentication directive and a stricter field-level @authentication directive are declared on the same Query or Mutation type, the library silently discards the field-level rule and evaluates only the coarser type-level check - meaning a roles: ["user"] token is sufficient to invoke a field that requires roles_INCLUDES: "admin". Affected across three major branches (5.2.0-5.12.14, 6.0.0-6.6.4, 7.0.0-7.5.x); no public exploit or CISA KEV listing identified at time of analysis.
SSO account takeover in 4gaBoards prior to version 3.3.9 allows any authenticated user to overwrite backend-managed OAuth identity fields on their own account via the PATCH /api/users/:id endpoint, redirecting a victim's SSO login to the attacker's account. The root cause is a mass-assignment flaw in server/api/controllers/users/update.js that incorrectly exposed SSO provider identifiers - including Google, GitHub, Microsoft, and OIDC subject IDs and emails - to user-controlled input. No public exploit is identified at time of analysis, but the attack mechanism is mechanically straightforward given the confirmed source code diff, and exploitation fully transfers the victim's project and board access to the attacker.
Unauthorized data access and partial data manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by a low-privileged authenticated attacker over HTTP when a victim user interacts with attacker-influenced content. The Endeca Application Controller component is the attack surface, and successful exploitation triggers a scope change that can significantly impact additional Oracle Commerce products beyond the directly targeted instance. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability is rated High (CVSS 7.6) with low attack complexity, making it a realistic threat in environments where low-privilege accounts are broadly granted.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a Security component flaw - tagged as an authentication bypass - that enables low-privileged authenticated attackers to gain complete read access to all data within the application and limited write access, with a confirmed scope change extending impact to additional Oracle Hyperion suite products. Exploitation requires human interaction from a victim but carries low attack complexity and is reachable over HTTP without elevated privileges. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Patch Update.
Oracle Application Testing Suite 13.3.0.1 exposes a network-accessible vulnerability allowing low-privileged attackers holding the Load Testing for Web Apps role to achieve unauthorized complete read access to critical data and limited write access through HTTP-based exploitation that requires victim interaction. The attack carries a confirmed scope change, meaning successful exploitation can cascade to impact additional Oracle products beyond the testing suite itself. No public exploit code has been identified and CISA KEV listing is absent, though the low attack complexity and network accessibility make this a credible targeted threat for any environment running this specific version.
Unauthorized data access and partial integrity compromise in Oracle Service Fulfillment Manager (E-Business Suite Fulfillment Engine component) affects all releases from 12.2.3 through 12.2.15. A low-privileged network attacker can, after inducing a victim user to interact with a crafted payload delivered over HTTP, achieve complete confidentiality loss of all data accessible to the application and limited unauthorized write access - with confirmed scope change affecting additional EBS products. No public exploit code has been identified at time of analysis, and Oracle has addressed this vulnerability in the August 2026 Critical Patch Update. The Authentication Bypass tag warrants verification, as the provided CVSS vector assigns PR:L rather than PR:N, suggesting privilege escalation within the session rather than a full authentication bypass.
Oracle Transportation Execution (E-Business Suite versions 12.2.3 through 12.2.15) exposes a network-exploitable integrity flaw in its Internal Operations component that allows a low-privileged authenticated attacker to gain unauthorized create, delete, and modify access to critical data - including a partial confidentiality breach - with a scope change impacting additional Oracle EBS products. The attack requires human interaction from a victim other than the attacker, consistent with a client-side injection pattern (e.g., stored XSS or similar), amplified by the 'Authentication Bypass' tag suggesting privilege escalation from low to higher access tiers. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Oracle Reports Developer 14.1.2.0.0 is exposed to a full system takeover through an authentication bypass (CWE-284) in its Security and Authentication component, exploitable by unauthenticated attackers with access to the adjacent network segment hosting the software. Two conflicting CVSS vectors are present in the source data - the embedded description asserts AV:A (Adjacent Network, score 9.6) while the separately provided vector field records AV:P (Physical, score 7.6) - a material discrepancy that affects risk prioritization and requires vendor clarification. Scope change (S:C) is confirmed, meaning successful exploitation may extend impact to other Oracle Fusion Middleware components; no public exploit or CISA KEV listing has been identified, and EPSS probability is very low at 0.26%.
The Workbench component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes a network-exploitable flaw that allows a low-privileged authenticated attacker to compromise confidentiality across a changed scope, affecting additional Oracle Commerce products beyond the directly targeted component. Successful exploitation yields unauthorized access to critical or complete Commerce-accessible data and limited write capability, contingent on a victim user interacting with attacker-controlled content. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Oracle disclosed this via the August 2026 Critical Patch Update.
Unauthorized data access and partial data manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a network-accessible, low-privileged authenticated attacker to compromise the Endeca Application Controller through HTTP, provided a victim user interacts with attacker-controlled content. The vulnerability carries a scope change, meaning successful exploitation can cascade to affect additional Oracle Commerce components beyond the directly targeted product, resulting in high confidentiality impact and limited integrity compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vendor-tagged 'Authentication Bypass' nature elevates practical concern for multi-tenant or externally accessible deployments.
Unauthorized data access and limited data manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 is achievable by a low-privileged network attacker who can induce a victim user to interact with a crafted HTTP request targeting the Endeca Application Controller component. Successful exploitation causes a scope change, meaning the impact extends beyond the directly targeted application to additional Oracle Commerce products, enabling high-confidentiality data exposure and limited unauthorized data modification. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the combination of low attack complexity and scope change elevates the practical business risk.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a flaw in its Security component that enables a network-accessible, low-privileged attacker to compromise the application via HTTP when a legitimate user is induced to interact with malicious content. Successful exploitation results in complete unauthorized read access to all data within Calculation Manager and limited write capability, with a confirmed scope change that may extend impact to other interconnected Oracle Hyperion EPM products. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the 'Authentication Bypass' tag sourced from EUVD metadata suggests the root cause involves bypassing higher-privilege access controls within the Security component after initial low-privilege authentication.
Unauthorized data access in Oracle Enterprise Asset Management (E-Business Suite, Linear Asset Management component), versions 12.2.3 through 12.2.15, is achievable by a low-privileged authenticated network attacker over HTTP when a victim interacts with attacker-controlled content, resulting in complete confidentiality exposure and limited integrity compromise with a confirmed scope change to additional products. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C) combined with an Authentication Bypass tag from the reporter suggests a client-side attack pathway - likely cross-site scripting or a similar injection technique - where a victim must interact with attacker-influenced material to trigger the exploit. No public exploit code has been identified and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Unauthenticated arbitrary file download in the Extra Product Options & Add-Ons for WooCommerce plugin (all versions prior to 7.6) allows any remote attacker without credentials to traverse directory paths and retrieve arbitrary files from the web server, including highly sensitive files such as wp-config.php containing database credentials and secret keys. Rooted in CWE-22 path traversal, the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network exploitation with high confidentiality impact. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Insufficient session expiration in FUXA 1.3.2 and earlier allows a former privileged user to continue minting valid privileged JWTs long after their account has been deleted, disabled, demoted, or had roles removed. The refresh endpoint falls back to stale group data embedded in the token rather than enforcing a live database check, and the heartbeat endpoint re-signs inbound JWT claims without validating the current database record, enabling indefinite session extension through cookie rotation. No public exploit code has been identified at time of analysis, but the fix is available in v1.3.3 and the GitHub advisory and patch commit are public.
Remote denial-of-service in Oracle Payables (E-Business Suite versions 12.2.3 through 12.2.15) allows unauthenticated network attackers to crash or hang the Payables service via HTTP, completely disrupting accounts payable operations. Oracle describes the flaw as 'easily exploitable' with no authentication requirement, and the vendor-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) corroborates full availability impact with minimal attacker effort. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Oracle Critical Patch Update for August 2026 confirms the issue and provides remediation.
Remote denial-of-service in Oracle Helidon 4.5.1's Imperative Web Server component allows unauthenticated network attackers to hang or repeatedly crash the service via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivial, zero-prerequisite exploitation against any reachable instance. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this a credible threat to internet-facing deployments.
Denial-of-service in Oracle Helidon 3.2.20 (Imperative Web Server component) allows unauthenticated remote attackers to repeatedly crash or indefinitely hang the server via crafted HTTP requests. The vulnerability is rated CVSS 7.5 with no authentication, no user interaction, and low attack complexity, making it trivially exploitable at scale against any exposed instance. No public exploit code or CISA KEV listing has been identified at time of analysis, though the ease of exploitation and complete availability impact warrant prompt patching.
Remote unauthenticated denial-of-service in Oracle Helidon 1.4.20 allows network-accessible attackers to crash or indefinitely hang the Imperative Web Server via HTTP, with no authentication or user interaction required. The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms trivially low exploitation complexity against exposed instances. No public exploit code or CISA KEV listing exists at time of analysis, but the combination of network accessibility and zero prerequisites makes this a realistic operational risk for any deployment of the affected version.
Unauthenticated remote denial-of-service in Oracle VM VirtualBox 7.2.14 allows a network attacker to hang or crash the hypervisor via the RDP interface without any credentials or user interaction. The vulnerability resides in the Core component and is rated easily exploitable by Oracle, yielding complete availability loss of the affected VirtualBox instance. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and zero authentication requirement make this straightforward to trigger against exposed deployments.
Oracle Workflow's Notification Mailer component in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes an unauthenticated HTTP endpoint vulnerable to a complete denial-of-service condition. Attackers with network access can cause the Workflow service to hang or crash repeatedly with no authentication required and low attack complexity, as confirmed by Oracle's August 2026 CPU advisory. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Remote unauthenticated denial-of-service in Oracle Helidon 3.2.18 allows network-reachable attackers to trigger a hang or repeatably crash the Imperative Web Server component via crafted HTTP requests, fully disrupting availability. The vulnerability carries a CVSS 3.1 score of 7.5, is described by Oracle as easily exploitable, and requires no authentication, no user interaction, and only standard HTTP network access. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity makes opportunistic probing straightforward against any internet-exposed Helidon instance.
Remote denial-of-service in Oracle Java SE's 2D component allows unauthenticated network attackers to hang or crash the JVM across versions 25.0.4 and 26.0.2 via multiple protocols. The attack surface spans both server-side Java deployments exposing 2D-related APIs through web services and client-side environments running sandboxed Java Web Start applications or applets processing untrusted code. Oracle characterizes this as easily exploitable with no public exploit identified at time of analysis; no KEV listing is present.
Unauthenticated denial of service in the Starter Templates by Kadence WP WordPress plugin (versions <= 2.3.3) allows remote attackers to exhaust server resources and render affected WordPress sites unavailable without any credentials. The vulnerability stems from CWE-770, meaning the plugin fails to apply rate limits or resource quotas on one or more of its endpoints, enabling trivial amplification by an unauthenticated adversary. No active exploitation is confirmed in CISA KEV, and no public exploit code is known at time of analysis, though the lack of authentication barrier significantly lowers attack friction.
Unauthenticated remote data exposure in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a network-adjacent or internet-facing attacker to read critical data or achieve complete unauthorized read access to all DRM-accessible data via HTTP, with no credentials or user interaction required. The vulnerability resides in the Access and Security component and is classified as an authentication bypass by the reporting source. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes opportunistic exploitation realistic against any exposed instance.
Unauthenticated remote access to all data in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible via a network-reachable HTTP endpoint due to an authentication bypass in the Access and Security component. An unauthenticated attacker with network access can exploit this to obtain complete read access to all data managed by the affected DRM instance, including potentially sensitive master data such as financial hierarchies, organizational structures, and governance metadata. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated remote access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable via HTTP due to a failure in the Security component's authentication enforcement. Tagged as an authentication bypass, the flaw allows any network-reachable attacker with no credentials or user interaction to access all data within the application's scope, carrying a CVSS 3.1 score of 7.5 (High) reflecting complete confidentiality compromise. No public exploit code or confirmed active exploitation has been identified at the time of analysis, though the low attack complexity lowers the practical barrier for capable adversaries who can reach the service.
Unauthenticated remote information disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 exposes the complete data set accessible to the application via HTTP. The Security component contains an authentication bypass weakness that allows a network-adjacent attacker with no credentials to retrieve critical financial data. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this straightforward to target.
Unauthenticated remote data exposure in Oracle SDP Number Portability (E-Business Suite versions 12.2.3 through 12.2.15) allows a network attacker over HTTP to access critical or all data managed by the component without any credentials. The vulnerability is tagged as an Authentication Bypass in the Internal Operations component, consistent with the PR:N/AC:L CVSS vector indicating trivial exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity significantly lowers the bar for opportunistic abuse.