Remote takeover in Oracle Helidon 4.5.0 lets an unauthenticated attacker fully compromise the framework's Imperative Web Server component over HTTP. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and no authentication or user interaction required, per Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the trivial exploitability rating warrants urgent patching.
Remote takeover of Oracle Helidon 3.2.18 (Imperative Web Server component, part of Oracle Fusion Middleware) allows an unauthenticated attacker to fully compromise the framework over HTTP. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity and availability impact, and requires no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivially exploitable, network-facing nature makes it a high-priority patch item.
Full compromise of Oracle Agile PLM 9.3.6 is achievable by a remote, unauthenticated attacker sending crafted HTTP requests to the product's Security component, resulting in complete takeover with high confidentiality, integrity, and availability impact. The flaw carries a CVSS 3.1 base score of 9.8 and requires no user interaction or privileges. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network reach make it a high-priority patch.
Complete takeover of Oracle WebCenter Portal is possible by a remote, unauthenticated attacker sending crafted HTTP requests to the Runtime Tools component, affecting versions 12.2.1.4.0 and 14.1.2.0.0 of this Oracle Fusion Middleware product. The flaw yields full high-impact compromise of confidentiality, integrity, and availability (CVSS 9.8) with no user interaction or credentials required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'easily exploitable' language from Oracle and the pre-auth network vector make it a high-priority patch.
SAML-based authentication bypass and full product takeover affects Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware's Agent infrastructure component. A remote attacker with no credentials can reach the SAML processing surface over the network and, per Oracle's own rating, easily compromise the identity broker outright - CVSS 9.8 with full confidentiality, integrity, and availability impact. Because Oracle Access Manager is a single-sign-on and access-enforcement gatekeeper, its takeover cascades to every downstream application it protects. No public exploit identified at time of analysis; not listed in CISA KEV.
Full remote takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible by an unauthenticated attacker who can reach the service over the network via TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Access and security component and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch.
Remote takeover of Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allows an unauthenticated attacker with HTTP network access to fully compromise the application. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and per the CVSS vector requires no privileges or user interaction, making it a prime candidate for opportunistic exploitation. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; despite the Oracle-supplied 'Information Disclosure' tag, the CVSS I:H/A:H metrics and 'takeover' language indicate impact well beyond disclosure.
Remote takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 allows an unauthenticated attacker with HTTP network access to fully compromise the Server component, yielding complete confidentiality, integrity, and availability loss. Rated CVSS 9.8 and flagged as 'easily exploitable' by Oracle, though tagged as Information Disclosure in EUVD; no public exploit identified at time of analysis and it is not listed in CISA KEV. This is part of Oracle's August 2026 Critical Patch Update and should be treated as high-priority given the unauthenticated network vector.
Remote takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows an unauthenticated attacker with only HTTP network reach to fully compromise the application, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact reflects complete product compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication profile makes it a high-priority patch.
Remote takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows an unauthenticated attacker with only HTTP network access to fully compromise the application, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable.' At time of analysis there is no public exploit identified and no CISA KEV listing, but the trivial exploitability and complete-compromise outcome make it a high patch priority.
Complete takeover of Oracle Essbase 21.8.1.0.0 is possible by an unauthenticated remote attacker over HTTP, per Oracle's August 2026 Critical Patch Update. Oracle rates it CVSS 9.8 with full confidentiality, integrity, and availability impact and flags it as 'easily exploitable,' meaning no authentication, no user interaction, and low attack complexity are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of network reach and unauthenticated takeover makes it a high-priority patch candidate.
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible for an unauthenticated attacker who can reach the service over IIOP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the flaw is network-reachable, low-complexity, and requires no credentials or user interaction, yielding full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV; it was reported by Oracle and fixed in the August 2026 Critical Patch Update.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible for a remote, unauthenticated attacker who can reach the product's CORBA interface over the network, per the Oracle Critical Patch Update of August 2026. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is rated by Oracle as easily exploitable. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Full system takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible when a remote, unauthenticated attacker reaches the product over CORBA. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a top-priority patch item.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible by a remote, unauthenticated attacker over TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch.
Full compromise of Oracle Reports Developer 12.2.1.19.0 is possible when an unauthenticated attacker reaches the product over the network via the IIOP protocol, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Security and Authentication component and yields complete takeover with high confidentiality, integrity, and availability impact (CVSS 9.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
Remote takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows an unauthenticated attacker with network access over the IIOP protocol to fully compromise the product, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible via a Security and Authentication component flaw that lets a remote attacker take over the product over TCP without credentials or user interaction. Oracle rates it CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch in the August 2026 Critical Patch Update.
Remote takeover in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) lets an unauthenticated network attacker fully compromise the product via UDP. Oracle rates the flaw CVSS 9.8 with high confidentiality, integrity, and availability impact and describes it as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP via the Security and Authentication component. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle describes successful attacks as resulting in complete takeover of the product. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable takeover profile makes it a high patch priority.
Remote unauthenticated takeover in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows an attacker with network access via the IIOP protocol to fully compromise the product without credentials or user interaction. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, this was disclosed in Oracle's August 2026 Critical Patch Update (CPUAUG2026). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Complete takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible by a remote, unauthenticated attacker over TCP, per Oracle's August 2026 Critical Patch Update. The flaw resides in the Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, but the trivial exploitability and complete-takeover outcome make this a high-priority patch.
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is possible by an unauthenticated remote attacker over HTTP, per Oracle's August 2026 Critical Patch Update. Affected releases span Siebel CRM Integration 25.12 through 26.6, and successful exploitation yields complete takeover of the Integration component with full confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the unauthenticated, low-complexity network profile makes it a high-priority patch item.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible by a remote, unauthenticated attacker over HTTP against the Installation and Configuration component. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit or CISA KEV listing has been identified at the time of analysis, so this is a pre-exploitation, patch-now situation rather than confirmed active exploitation.
Full product takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Common Events component) is possible by an unauthenticated remote attacker sending crafted HTTP requests. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable exploitation with no privileges or user interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the 9.8 base score and unauthenticated nature make it a high-priority patch target.
Full-system takeover of Oracle WebCenter Enterprise Capture (Oracle Fusion Middleware, Client Bundle component) is achievable by a remote, unauthenticated attacker reaching the server over the T3 or IIOP protocols. Oracle rates this CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable,' meaning a single crafted protocol interaction can yield complete compromise of the Capture instance. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the T3/IIOP attack surface has a long history of reliable Java-deserialization exploitation in the WebLogic/Fusion Middleware stack.
Full remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, allowing an unauthenticated attacker with only HTTP network access to fully compromise the product. Oracle rates this CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning no credentials or user interaction are needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-takeover profile makes it a top-priority patch in Oracle's August 2026 Critical Patch Update.
Complete takeover of Oracle WebCenter Enterprise Capture is possible via the Client Bundle component, where an unauthenticated network attacker leveraging the RMI protocol can fully compromise the affected server. Oracle's August 2026 Critical Patch Update rates this at CVSS 9.8 with full confidentiality, integrity, and availability impact against supported versions 12.2.1.4.0 and 14.1.2.0.0. No public exploit identified at time of analysis, though the trivial exploitability (AC:L, PR:N) and RMI attack surface make it a high-priority patch item.
Full remote takeover of Oracle WebCenter Enterprise Capture (Fusion Middleware, Client Bundle component) is possible by an unauthenticated attacker reaching the product over Java RMI, per Oracle's August 2026 Critical Patch Update. The flaw is rated CVSS 9.8 with high confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable,' affecting versions 12.2.1.4.0 and 14.1.2.0.0. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of network reach, no authentication, and complete compromise makes it a top-priority patch.
Remote takeover of Oracle WebCenter Enterprise Capture (versions 12.2.1.4.0 and 14.1.2.0.0) allows an unauthenticated network attacker to fully compromise the product via the WebLogic T3 and IIOP protocols exposed by the Client Bundle component. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact), reflecting easy, no-privilege exploitation. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the T3/IIOP attack class is historically a high-value target in Oracle Fusion Middleware.
Full compromise of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 is possible via the Business Interlink component, where a remote unauthenticated attacker sending crafted HTTP requests can take over the product. Oracle rates this at CVSS 9.8 with high confidentiality, integrity, and availability impact, describing it as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch in the August 2026 Critical Patch Update.
Full takeover of Oracle Payments (Oracle E-Business Suite, File Transmission component) is possible by remote unauthenticated attackers over HTTP, affecting supported releases 12.2.3 through 12.2.15. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network-facing profile makes it a top-tier patch priority.
Remote takeover of Oracle Identity Manager (Oracle Fusion Middleware) affects the OIM Legacy UI component in versions 12.2.1.4.0 and 14.1.2.1.0, allowing an unauthenticated attacker with only HTTP network access to fully compromise the identity-management platform. The maximum CVSS 3.1 base score of 9.8 reflects complete loss of confidentiality, integrity, and availability, and because OIM governs enterprise identity and access, compromise cascades to every system it provisions. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile makes it a high priority for immediate patching.
Full product takeover in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (Legacy UI component) allows a remote, unauthenticated attacker to compromise the identity-governance platform over HTTP. Rated CVSS 9.8 with high confidentiality, integrity, and availability impact, this issue is trivially exploitable and requires no user interaction; at time of analysis there is no public exploit identified and it is not listed in CISA KEV. Because OIM brokers provisioning and access to downstream enterprise systems, a takeover here has cascading blast radius across connected accounts and applications.
Remote code execution and denial of service in Dell PowerStore T-series arrays (SDNAS software) stem from an out-of-bounds write in the SMB/CIFS file-sharing service, reachable by an unauthenticated remote attacker (CVSS 9.8, AV:N/PR:N). A single specially crafted SMB packet can crash the storage node, and because affected models are configured to auto-restart, the crash becomes a persistent, repeatable DoS; a more capable attacker can leverage the same memory-corruption primitive for arbitrary code execution. No public exploit has been identified at time of analysis, but this is a network-facing storage controller flaw and Dell has already shipped a fix.
Path traversal in NVIDIA Triton Inference Server for Linux (CWE-22) lets remote attackers manipulate file paths to reach locations outside intended directories, with the vendor citing denial of service as the primary outcome. NVIDIA assigned a critical 9.8 CVSS score claiming full confidentiality, integrity, and availability impact, though the published description only asserts DoS. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Insecure deserialization in the Youzify WordPress plugin (versions 1.3.7 and earlier) allows remote unauthenticated attackers to submit crafted serialized PHP objects that the plugin deserializes without validation, per a Patchstack advisory. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, successful exploitation can lead to object injection and potentially full site compromise. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated PHP Object Injection in the Ultimate Maps by Supsystic WordPress plugin (all versions before 1.5.0) lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, instantiating arbitrary PHP objects. If a usable POP (property-oriented programming) gadget chain is present in the plugin, WordPress core, or any other active plugin, this can escalate to remote code execution, file operations, or database compromise. Reported by Patchstack and assigned CVSS 9.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated PHP Object Injection in the RegistrationMagic WordPress plugin (versions <= 6.0.9.7) allows remote attackers to inject crafted serialized PHP objects that are deserialized by the application without validation. Depending on the POP gadget chains available in the plugin, WordPress core, or other installed plugins, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack with a CVSS 9.8; no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is not confirmed in the wild.
Unauthenticated PHP Object Injection in the FundEngine WordPress fundraising/donation plugin (slug wp-fundraising-donation) affects all versions up to and including 1.7.9, letting a remote attacker with no authentication inject a crafted serialized PHP object into an application deserialization sink. Given the CWE-502 root cause and the PR:N/UI:N vector, a successful attack can pivot to remote code execution, data theft, or full site takeover when a suitable POP gadget chain is reachable. Reported by Patchstack and rated CVSS 9.8, with no public exploit identified at time of analysis and no CISA KEV listing.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible when an unauthenticated remote attacker sends crafted HTTP requests to the Security and Authentication component of this Oracle Fusion Middleware reporting tool. The flaw carries a CVSS 9.8 base score with full confidentiality, integrity, and availability impact, and requires no privileges or user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; it was disclosed via Oracle's August 2026 Critical Patch Update.
Full compromise of Oracle Internet Directory (OID) LDAP Server is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a remote unauthenticated attacker reaching the LDAP service over the network can take over the directory instance. The flaw scores CVSS 9.8 with high confidentiality, integrity, and availability impact and is addressed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Full product takeover in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows a remote, unauthenticated attacker to compromise the application over HTTP with low attack complexity. Rated CVSS 3.1 9.8 with complete confidentiality, integrity, and availability impact, this flaw was disclosed by Oracle in the August 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Remote takeover in Oracle Helidon 1.4.20 (Imperative Web Server component of Oracle Fusion Middleware) allows an unauthenticated attacker with network access over HTTP to fully compromise the affected instance. The flaw carries a critical CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity and availability, and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is not yet confirmed in the wild.
Remote takeover of Oracle Helidon 4.5.0 is possible when an unauthenticated attacker reaches the Imperative Web Server component over HTTP, per Oracle's August 2026 Critical Patch Update. The flaw yields full compromise of confidentiality, integrity, and availability (CVSS 9.8) without credentials or user interaction. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing profile makes it a high-priority patch.
Complete takeover of Oracle Helidon 4.5.0 is achievable by remote, unauthenticated attackers over HTTP through the Imperative Web Server component, per Oracle's August 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact) reflects easy exploitation with no privileges or user interaction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Complete takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via the Endeca Application Controller, which is reachable over HTTP by unauthenticated network attackers. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact, meaning a single crafted request can yield full control of the search/merchandising tier. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-authentication profile makes it a high-priority patch item disclosed in Oracle's August 2026 Critical Patch Update.
Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with only HTTP network access to fully compromise the platform, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and Oracle characterizes it as 'easily exploitable' requiring no authentication or user interaction. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Remote takeover in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with only TCP network access to fully compromise the platform. Rated CVSS 9.8 with complete confidentiality, integrity and availability loss, the flaw requires no authentication or user interaction, making it a top-tier remediation priority. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and total-compromise impact warrant immediate patching via Oracle's August 2026 Critical Patch Update.
Full product takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a remote, unauthenticated attacker over TCP, per Oracle's Critical Patch Update advisory (CSPU August 2026). The flaw resides in the Access and security component and yields complete confidentiality, integrity, and availability compromise (CVSS 3.1 base 9.8). No public exploit identified at time of analysis, and it is not currently listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch item.