Full takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a high-privileged local attacker targeting the Security component, resulting in complete compromise of confidentiality, integrity, and availability. The attack requires logon access to the infrastructure host where the application runs, limiting exposure to insider threats or attackers who have already established a foothold with elevated privileges. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the local-only attack vector substantially constrains real-world risk despite the full CIA impact.
Full system takeover of Oracle Agile Engineering Data Management 6.2.1 is achievable through a vulnerability in its Install component, exploitable by a high-privileged attacker with local logon access to the host infrastructure. The CVSS 3.1 base score of 6.7 reflects the constrained attack prerequisites - local access and high privileges - yet successful exploitation yields complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
High-privileged local exploitation of Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an attacker with existing infrastructure logon to bypass Security component controls, gaining full read access to critical Hyperion data and limited write access to accessible records, with a scope change indicating spillover risk to additional Oracle Hyperion products. The attack is confined to insiders or adversaries who have already achieved a high-privilege foothold on the Hyperion infrastructure, making this most relevant to insider threat models and post-compromise lateral movement scenarios. No public exploit code has been identified at time of analysis; Oracle addressed this vulnerability in the August 2026 Critical Patch Update.
Local privilege escalation in mise (jdx/mise), the polyglot dev tool version manager, allows a local user with UID and GID 1001 to gain ownership of a root-installed system binary. Prior to version 2026.7.1, release tar archives embedded non-root UID/GID 1001 metadata from the build environment, and the standalone install script failed to normalize ownership before placing the binary in shared paths such as /usr/local/bin, leaving the installed executable writable by any user matching that UID/GID pair. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the attack path is mechanically straightforward in multi-user environments where a local account happens to share UID/GID 1001 with the build system.
Full takeover of Oracle Shipping Execution (versions 12.2.3-12.2.15) within Oracle E-Business Suite is achievable by a high-privileged, network-based attacker over HTTP when high-complexity conditions are satisfied. Despite requiring elevated privileges and difficult attack conditions, successful exploitation yields complete compromise of confidentiality, integrity, and availability - effectively a system takeover of the Shipping Execution module. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability is disclosed via Oracle's August 2026 Critical Patch Update.
Full system takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a high-privileged attacker with network access via HTTP, exploiting a flaw in the Access and Security component. Successful exploitation results in complete compromise of confidentiality, integrity, and availability, consistent with a CVSS 3.1 score of 6.6 that is tempered by high attack complexity and high privilege prerequisites. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Incorrect reference resolution in the Core component of Google Chrome on Android exposes sensitive information to remote attackers who can socially engineer users into visiting a malicious HTML page. Affected versions are all Chrome for Android builds prior to 151.0.7922.169. Exploitation requires user interaction but no authentication, and the vulnerability is platform-specific to Android. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available.
Broken authentication in the Flutterwave WooCommerce WordPress plugin (versions <= 3.3.0) allows unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), resulting in limited integrity and availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no credentials, no user interaction, and no special network position, making it trivially accessible to any internet-connected attacker targeting WordPress sites running this payment gateway plugin. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Network-exploitable denial-of-service in Oracle MySQL Connector/ODBC 26.7.0 allows low-privileged authenticated attackers to cause a complete hang or repeatable crash of the connector via multiple protocols. Oracle characterizes this as easily exploitable, consistent with the low-complexity, low-privilege CVSS vector (AV:N/AC:L/PR:L). No public exploit code or active exploitation has been identified at time of analysis, though the availability impact is rated High with no confidentiality or integrity exposure.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged authenticated network attackers to gain complete read access to all data accessible by the application via HTTP. The vulnerability resides in the Security component and is tagged as an Authentication Bypass, indicating that an attacker with a valid but low-privileged account can circumvent authorization controls to read critical financial data beyond their intended scope. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network attack vector make this straightforward to exploit once credentials are obtained.
Unauthorized data disclosure in Oracle Hyperion Financial Management version 11.2.25.0.000 allows low-privileged, network-based attackers to access critical or complete application data via HTTP. The vulnerability resides in the Security component and is tagged as an authentication bypass, indicating that existing authorization controls can be circumvented by an attacker holding any low-privilege account, exposing all financial data accessible within the application. No public exploit code has been identified at time of analysis, and Oracle has addressed the issue in its Critical Patch Update for August 2026.
Unauthorized data disclosure in Oracle Hyperion Financial Reporting 11.2.25.0.000 allows a low-privileged authenticated attacker with HTTP network access to read all financial reporting data accessible to the application server. Tagged as an authentication bypass in intelligence metadata, suggesting the Server component fails to enforce authorization boundaries between privilege levels, enabling vertical privilege escalation over data access. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network vector make this straightforward to exploit once any valid account is obtained.
Oracle Production Scheduling versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, exposes a network-accessible HTTP endpoint in its Internal Operations component that can be abused by a low-privileged authenticated attacker to read all data accessible to the application. The impact is limited to confidentiality - no integrity or availability loss - but the scope covers 'complete access to all Oracle Production Scheduling accessible data,' which may include sensitive operational and supply-chain planning records. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
Unauthorized data disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged attacker with HTTP network access to read critical or all accessible data within the platform's Common Security component. The vulnerability is tagged as an authentication bypass, suggesting that an already-authenticated low-privilege user can escalate their data access beyond authorized scope. No public exploit code or active exploitation has been identified at this time, but the low attack complexity makes it a credible lateral movement or data exfiltration vector in environments where Oracle Hyperion is internet-facing or accessible to untrusted internal users.
Unauthenticated path traversal in reportico-web <= 8.1.0 allows remote attackers to expose PHP source files or execute existing PHP files on the server by manipulating the target_format parameter of the run.php endpoint combined with the execute_mode=EXECUTE directive. The vulnerability requires no authentication and is reachable over the network, meaning any internet-exposed instance is at risk. Publicly available exploit research exists (kilotel/vulnerability-research); no public exploit identified as confirmed actively exploited (CISA KEV). EPSS stands at 0.37% (30th percentile), suggesting low observed exploitation frequency at time of analysis.
Remote unauthenticated exploitation of Oracle Helidon 4.5.0's Imperative Web Server component via HTTP/2 permits partial data disclosure and partial denial of service without any credentials or user interaction. Oracle's own advisory characterizes this as 'easily exploitable', and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms zero-prerequisite network reachability. No public exploit code or CISA KEV listing has been identified at time of analysis, and impact is bounded to partial confidentiality and availability degradation rather than full system compromise.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a network-exploitable vulnerability in its Security component that allows a high-privileged authenticated attacker to exfiltrate critical financial data or cause a complete denial of service via crafted HTTP requests. Disclosed as part of Oracle's Critical Patch Update for August 2026 (CSPUAUG2026), this flaw carries a CVSS 3.1 base score of 6.5, driven by High confidentiality and High availability impacts with no integrity effect. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag in the intelligence data introduces a notable ambiguity regarding actual privilege requirements that warrants verification.
Unauthorized data disclosure in Oracle Agile PLM MCAD Connector 3.6 allows any low-privileged authenticated attacker with HTTP network access to bypass authorization controls in the CAX Client component and read the entire dataset accessible to the connector. The vulnerability is tagged Authentication Bypass, indicating that after obtaining a minimal credential foothold, no additional privilege escalation is needed to access critical PLM data such as engineering designs and product specifications. Oracle's own advisory characterizes the flaw as 'easily exploitable,' and no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data exposure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows a low-privileged network attacker to access critical or complete Hyperion data via HTTP. The vulnerability resides in the Installation and Configuration component and is rated CVSS 6.5, with high confidentiality impact and no integrity or availability consequence. No public exploit or active exploitation has been identified at time of analysis, though the low attack complexity makes it accessible to any authenticated attacker with network reach.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 enables low-privileged authenticated users to access critical financial data or all application-accessible data over HTTP. The vulnerability resides in the Security component, and the 'Authentication Bypass' tag in the intelligence data suggests a breakdown in authorization enforcement that allows an authenticated low-privileged user to exceed their intended access scope - effectively escalating read access to sensitive financial records. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and network accessibility make this a practical risk for any organization relying on HFM for financial consolidation.
Unauthorized data exposure in Oracle Workflow (E-Business Suite 12.2.3-12.2.15) allows a low-privileged, network-authenticated attacker to read all data accessible within the Oracle Workflow system via the Worklist HTTP component. Oracle classifies this as easily exploitable in its August 2026 Critical Patch Update, with a High confidentiality impact and no integrity or availability effects. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated network exploitation of Oracle Hyperion Financial Management 11.2.25.0.000 enables remote attackers to perform unauthorized data manipulation and cause partial denial of service via HTTP against the Security component. The vulnerability requires no credentials and no user interaction, making it trivially accessible to any attacker with network reach to the application. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known at time of analysis; however, the unauthenticated, network-accessible attack surface warrants prompt patching.
Broken access control in the Appointment Hour Booking WordPress plugin (by Codepeople) versions up to and including 1.5.91 permits unauthenticated remote attackers to bypass authorization checks, resulting in unauthorized integrity and availability impact. Reported by Patchstack and tracked as EUVD-2026-60933, the flaw requires no credentials, no user interaction, and no special configuration - any network-reachable WordPress installation running an affected plugin version is exposed. No public exploit or KEV listing is identified at time of analysis, though the low attack complexity and zero privilege requirement make opportunistic exploitation straightforward if the plugin is widely scanned for.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 exposes critical data and partial denial-of-service risk via the Endeca Application Controller component over HTTP. An unauthenticated network attacker exploiting this vulnerability - tagged as an authentication bypass - can gain complete read access to all data accessible within the Oracle Commerce platform and degrade service availability. No public exploit code has been identified at time of analysis, and the high attack complexity (AC:H) reduces the realistic threat surface, though a successful attacker requires no credentials or user interaction once the exploit conditions are met.
Broken Access Control in the MasterStudy LMS WordPress plugin (versions up to and including 3.7.41) permits any authenticated subscriber to bypass role-based authorization checks and access data restricted to higher-privilege roles, resulting in high confidentiality impact. The CVSS vector confirms this is network-exploitable with low complexity and no user interaction required beyond holding a subscriber-level account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation on open-registration LMS platforms makes this a credible threat to sensitive course and student data.
Insecure Direct Object References in WP Crowdfunding (Themeum) versions prior to 2.2.1 allow authenticated subscriber-level users to access campaign objects, donor records, or financial data they are not authorized to view. The vulnerability, discovered and reported by Patchstack, stems from missing authorization checks on direct object references within the plugin, enabling lateral data exposure across campaigns or users. No public exploit or active exploitation has been identified at time of analysis, and a vendor patch is available.
Authenticated user enumeration in 4gaBoards prior to 3.3.9 allows any valid session holder to retrieve complete user records for every account in the instance via GET /api/users and GET /api/users/:id, exposing PII and administrative metadata including email, phone, organization, isAdmin flag, and SSO-linked identities. The root cause is an absent requester-specific authorization layer and no response sanitization in the users/index and users/show controllers, which pass raw sails.helpers.users.getMany() output directly to callers. No public exploit code or CISA KEV listing has been identified, but the low exploitation barrier - any authenticated account - makes this a meaningful risk for instances with untrusted or externally registered users.
Unauthenticated attackers can modify or cancel other users' appointments in wpdevart's Booking Calendar, Appointment Booking System WordPress plugin (versions ≤ 3.2.36) by substituting predictable booking object identifiers in unauthenticated requests - a classic CWE-639 authorization bypass. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero authentication and no user interaction are required, making this trivially automatable against all exposed WordPress installations. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and wide WordPress deployment surface elevate practical risk for any business relying on appointment integrity.
Broken authentication in the Piraeus Bank WooCommerce Payment Gateway WordPress plugin version 3.2.0 allows unauthenticated remote attackers to bypass authentication controls, resulting in low-severity integrity and availability impacts. Reported by Patchstack and tracked under ENISA EUVD-2026-60804, this CWE-288 flaw enables access via an alternate path or channel without requiring any credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
SQL-based exploitation in Oracle Hyperion Financial Management 11.2.25.0.000 enables a high-privileged authenticated attacker to achieve complete read and write access to all financial data within the application. The Security component - the logical gatekeeper for data authorization - is the attack surface, and successful exploitation grants unauthorized creation, deletion, modification, and disclosure of critical financial records. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the 'Authentication Bypass' tag warrants scrutiny given the contradiction with the PR:H CVSS metric (see risk assessment).
SQL-based compromise of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a network-accessible, high-privileged attacker to gain unauthorized read and write access to all critical data managed by the platform. The vulnerability resides in the Installation and Configuration component and requires no user interaction once network SQL access is established. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog, though the 'Authentication Bypass' tag attached to this CVE warrants scrutiny given the high-privilege prerequisite in the CVSS vector.
Authentication bypass in Oracle Hyperion Financial Reporting 11.2.25.0.000 (Server component) allows unauthenticated remote attackers to obtain complete read access to all financial data accessible to the application, along with limited write capability (insert, update, delete) over HTTP. The vulnerability is classified as difficult to exploit (AC:H), moderately containing real-world risk despite requiring no credentials. No public exploit code or CISA KEV listing exists at time of analysis, but the authentication bypass classification from Oracle's own reporting makes this a meaningful confidentiality risk for organizations using this platform for sensitive financial reporting.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged authenticated network attackers to access all data accessible to the application via HTTP, targeting the Security component. The 'Authentication Bypass' tag suggests an authorization control failure permitting privilege escalation within an authenticated session, enabling full confidentiality compromise of sensitive financial consolidation data. No public exploit or active exploitation has been identified; this was disclosed as part of Oracle's Critical Security Patch Update for August 2026.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows a network-accessible low-privileged attacker to read all data the application can access via a flaw in its Security component over HTTP. The vulnerability is tagged as an authentication bypass, suggesting that while a low-privilege session is sufficient to initiate the attack, the Security component fails to enforce authorization boundaries that should restrict access to higher-privilege data. No public exploit code has been identified and no active exploitation is confirmed by CISA KEV at the time of analysis.
Unauthenticated remote compromise of Oracle Hyperion Financial Reporting version 11.2.25.0.000 allows network-accessible attackers to read and tamper with financial reporting data via HTTP without any credentials. The Server component is the affected entry point, and the attack is characterized by Oracle as 'easily exploitable,' meaning no special tooling or chaining is required. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, though the authentication bypass tag and zero-privilege requirement lower the bar for opportunistic targeting.
Broken authorization in Saleor's centralized GraphQL permission utility allows unauthenticated callers to silently modify channel-level order settings and enumerate hidden storefront objects that should require management privileges. Versions 3.14.67 through the pre-patch releases across the 3.21.x, 3.22.x, and 3.23.x branches are affected, with the headless GraphQL API serving as the attack surface. Fixed releases 3.21.67, 3.22.63, and 3.23.22 are vendor-confirmed; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows attackers with HTTP network access to read a subset of application-accessible data and trigger partial denial of service conditions. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L vector confirms low-complexity, zero-authentication exploitation with no user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis; this issue was disclosed through Oracle's Critical Security Patch Update for August 2026 (EUVD-2026-62158).
Authentication bypass in Oracle Helidon 3.2.18's Imperative Web Server component exposes sensitive application data to unauthenticated network attackers over HTTP. Successful exploitation yields complete read access to all Helidon-accessible data and limited write capability (insert, update, delete), with no availability impact. No active exploitation or public proof-of-concept code has been identified at time of analysis, and the high attack complexity rating tempers immediate mass-exploitation risk, though the confidentiality impact warrants prompt patching for internet-exposed deployments.
Unauthorized data disclosure in Oracle Commerce Experience Manager 11.4.0 allows low-privileged authenticated attackers to access critical or complete application data via HTTP. The vulnerability is tagged as an authentication bypass, suggesting that despite requiring a low-privileged account, the flaw circumvents authorization controls that should restrict data access within the Experience Manager component. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and network accessibility make this straightforward to exploit once an attacker has any valid credential.
Unauthorized access to sensitive financial data in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by any low-privileged, network-authenticated attacker over HTTP. The flaw resides in the Security component and, per the Oracle tag classification, represents an authorization bypass that permits a low-privilege account to read critical or complete HFM data assets well beyond their assigned permissions. No public exploit has been identified at time of analysis, though Oracle's Critical Security Update for August 2026 formally acknowledges and patches the issue.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows any low-privileged authenticated attacker with HTTP network access to bypass security controls within the Security component, gaining read access to all financial data accessible by the application. Tagged as an Authentication Bypass, this suggests low-privileged users can circumvent authorization logic to access data sets beyond their permitted scope. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor's 'easily exploitable' designation and low attack complexity make this a practical risk for organizations running HFM in financial consolidation environments.
Unauthorized data disclosure in Oracle Mobile Application Server's MWA Terminal Server component affects all supported E-Business Suite deployments running versions 12.2.3 through 12.2.15. Low-privileged network attackers with HTTP access can exploit an authorization bypass to gain complete read access to all data within the Mobile Application Server's scope - including sensitive warehouse, inventory, and business records. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog, but Oracle's advisory language explicitly flags it as 'easily exploitable,' reducing the practical barrier significantly.
Unauthenticated remote exploitation of Oracle Helidon 4.1.0's Imperative Web Server component allows network-accessible attackers to bypass authentication controls via HTTP, resulting in unauthorized partial read and write access to application data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable with no prerequisites beyond network reachability, and the 'Authentication Bypass' tag corroborates an access-control failure in the web server layer. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity and zero-authentication requirement make this an attractive target for automated scanning.
Unauthenticated remote exploitation of Oracle Helidon 4.5.0's Imperative Web Server component allows network-adjacent attackers to bypass authentication and perform unauthorized read and write operations on application data over HTTP. Tagged explicitly as an Authentication Bypass by Oracle's security team, this vulnerability exposes a subset of Helidon-accessible data to disclosure and tampering without requiring credentials or user interaction. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the low attack complexity and zero-privilege requirement make it a straightforward target for automated scanning.
Authentication bypass in Oracle Helidon 4.5.0's Imperative Web Server component exposes HTTP endpoints to unauthenticated network attackers, enabling unauthorized read access to a subset of application data and unauthorized write, insert, or delete operations on accessible data. The flaw, tagged as an Authentication Bypass by Oracle and reported via the August 2026 Critical Patch Update, is reachable by any attacker with HTTP connectivity to the service with no complexity barriers. No public exploit code has been identified and the vulnerability is not currently listed in CISA KEV, but the zero-authentication network attack vector warrants prompt patching of affected Helidon 4.5.0 deployments.
Unauthenticated network exploitation of Oracle Helidon 3.2.18's Imperative Web Server component allows remote attackers to bypass authentication controls, gaining unauthorized read access to a subset of application data and unauthorized write/insert/delete capability against some accessible data. Tagged as an authentication bypass by Oracle Security (secalert_us@oracle.com), the vulnerability requires no privileges and no user interaction, making it trivially automatable over HTTP. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle has disclosed this via their August 2026 Critical Patch Update.
Unauthenticated remote access to Oracle Learning Management (E-Business Suite versions 12.2.3 through 12.2.15) enables attackers to read, insert, update, or delete subsets of application data via HTTP without any credentials. Tagged as an authentication bypass in the Internal Operations component, this vulnerability exposes organizations running these specific EBS versions to unauthorized data manipulation affecting confidentiality and integrity. No public exploit code or active exploitation has been identified at time of analysis, but the low-complexity, no-authentication attack profile warrants prompt patching under Oracle's August 2026 Critical Patch Update.
Unauthenticated remote data compromise affects Oracle Service Delivery Platform 14.1.2.0.0 via its Messaging Enabler component, reachable over HTTP without credentials. The authentication bypass allows network attackers to read a subset of platform data and perform unauthorized insert, update, or delete operations against accessible data stores. No public exploit code or active exploitation has been identified at time of analysis, and Oracle addressed this in the August 2026 Critical Patch Update.
Unauthenticated remote compromise of Oracle Hyperion Financial Reporting 11.2.25.0.000 allows network-adjacent attackers to read a subset of financial reporting data and perform unauthorized insert, update, or delete operations against Repository data via HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) combined with the 'Authentication Bypass' tag confirms that no credentials are required and exploitation is straightforward against exposed instances. No patch bypass, public exploit code, or CISA KEV listing has been identified at time of analysis, though Oracle classifies this as 'easily exploitable.'
Unauthenticated network-accessible data disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes critical or complete confidentiality of data via HTTP, requiring human interaction from a victim to complete the attack. Tagged as an Authentication Bypass in the Common Security component, a remote attacker can circumvent authentication controls to read sensitive data accessible to the Hyperion platform. No public exploit has been identified at time of analysis, and the vulnerability is addressed in Oracle's August 2026 Critical Patch Update.