Unauthenticated remote exploitation of Oracle Advanced Inbound Telephony (versions 12.2.3-12.2.15) within Oracle E-Business Suite allows a network attacker to perform unauthorized creation, deletion, or modification of critical telephony data and cause a partial denial of service via HTTPS. The CVSS 3.1 base score of 8.2 reflects high integrity impact and low availability impact with no confidentiality exposure. No public exploit code or active exploitation (CISA KEV listing) has been identified at time of analysis.
Remote denial-of-service and partial data exposure in Oracle Helidon 4.5.0 allows unauthenticated network attackers via HTTP/2 to cause a complete hang or crash of the Helidon Imperative Web Server, alongside unauthorized read access to a subset of accessible data. The vulnerability is classified as easily exploitable with no authentication, user interaction, or special configuration required. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and network-accessible vector make this a realistic denial-of-service threat against any exposed Helidon 4.5.0 deployment.
Broken authentication in SupportCandy WordPress plugin versions up to and including 3.5.1 allows unauthenticated remote attackers to bypass access controls and invoke privileged plugin functionality without credentials. The vulnerability, rooted in CWE-266 (Incorrect Privilege Assignment), exposes customer support ticket data - potentially including personally identifiable information - to any external party with network access to the site. No public exploit code or CISA KEV listing has been identified at time of analysis, though the zero-authentication, low-complexity attack path makes exploitation trivial against any unpatched installation.
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 within the Fusion Middleware stack expose an unauthenticated remote attack surface over HTTP, enabling network-accessible attackers to perform unauthorized creation, deletion, or modification of critical content data across all accessible WebCenter Sites instances, as well as cause a partial denial of service. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) confirms minimal attack complexity with no authentication or user interaction required, which Oracle's own advisory characterizes as 'easily exploitable'. No public exploit or CISA KEV listing has been identified at time of analysis, though the zero-prerequisite exploitation profile elevates urgency for exposed deployments.
Unauthenticated remote exploitation of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 allows network-adjacent or internet-facing attackers to perform unauthorized creation, deletion, or modification of critical content data, and to partially degrade service availability via HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms that no authentication, user interaction, or special configuration is required, placing this in the highest-risk category for unauthenticated web vulnerabilities. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, but the low attack complexity warrants prompt remediation.
Remote unauthenticated denial-of-service and partial data integrity compromise in Oracle MySQL Cluster's NDB Operator component allows network attackers to crash or hang the cluster and perform unauthorized data modifications. Affected versions span three active release lines: 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the low attack complexity and zero authentication requirement make exploitation straightforward against exposed deployments.
Oracle WebCenter Content's Content Server component, within the Oracle Fusion Middleware stack, exposes a network-reachable integrity compromise affecting versions 12.2.1.4.0 and 14.1.2.0.0. High-privileged authenticated attackers can access the service via HTTP to arbitrarily create, delete, or modify critical repository data, read a subset of accessible content, and cause partial denial of service - with a confirmed scope change indicating potential cascading impact on additional Oracle Fusion Middleware products. No public exploit code or CISA KEV listing has been identified at time of analysis.
Multi-factor authentication bypass in Joomla! CMS versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 allows remote attackers to circumvent 2FA controls and gain authenticated access using only the first-factor credential. Insufficient state validation in the MFA flow exposes a logic path that skips the second-factor verification step entirely. No public exploit or CISA KEV listing has been identified at the time of analysis, though the vulnerability's network accessibility and lack of required privileges make it a meaningful account-takeover risk for any Joomla site with MFA-enrolled users.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all DRM-managed master data to unauthenticated remote attackers over HTTPS. The flaw resides in the Access and Security component - the gatekeeper for the application - and permits complete read access to critical DRM data alongside limited unauthorized write capability. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS vector (PR:N, AC:L) confirms trivial unauthenticated exploitability from any network-adjacent position with HTTPS reachability.
Unauthenticated remote access to critical HR data is possible in Oracle HCM Common Architecture (Knowledge Integration component) across versions 12.2.3 through 12.2.15 of Oracle E-Business Suite, exploitable over HTTP without credentials or user interaction. Successful exploitation yields full read access to all HCM-accessible data and partial write capability (insert/update/delete) against some HCM data stores, as confirmed by Oracle's own CVSS breakdown (C:H, I:L). Tagged as an authentication bypass by Oracle's security team, this represents a significant exposure for any organization running HCM within a network-reachable deployment. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote exploitation of the File Transmission component in Oracle Payments (E-Business Suite 12.2.3-12.2.15) allows network-accessible attackers over HTTP to gain complete read access to all Oracle Payments data and perform limited unauthorized write operations. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 8.2, and the Authentication Bypass tag confirms no credentials are required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-prerequisite attack profile makes this a high-priority patching target for any organization running Oracle EBS with the Payments module active.
Authentication bypass in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) enables unauthenticated remote attackers to gain unauthorized read access to critical application data and perform limited write operations via HTTP. Rated CVSS 8.2, this flaw requires no credentials, no user interaction, and no special network position, making it exploitable against any internet-exposed WebCenter Sites deployment. No public exploit code has been identified at time of analysis; the vulnerability was disclosed through Oracle's August 2026 Critical Patch Update.
Unauthenticated remote access in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 exposes the full confidential data set accessible to the platform and permits limited unauthorized data modification via standard HTTP, with no credentials or user interaction required. Oracle confirmed this in its August 2026 Critical Patch Update (CPU), classifying it as easily exploitable with a network attack vector. No public exploit code or CISA KEV listing has been identified at time of analysis, but the authentication bypass nature and low attack complexity make this a high-priority remediation target for all organizations running the affected versions.
Oracle Hyperion Data Relationship Management (DRM) version 11.2.23.0.000 exposes its Web Client - Unicode component to unauthenticated remote attackers over HTTP. Exploitation allows complete read access to all DRM-accessible data - which in a master data management context often includes sensitive financial hierarchies and organizational structures - plus the ability to induce a partial denial of service. No public exploit has been identified at time of analysis, but the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates trivially low attack complexity with no authentication barrier.
Path traversal in Grav CMS before 2.0.15 allows unauthenticated remote attackers to read arbitrary files from sibling directories outside the intended asset root by exploiting a string prefix collision in the static asset handler. The index.php front controller validates asset paths using a simple string prefix check rather than normalized directory-boundary logic, so a request for /assets-private/credentials.yaml passes validation when /assets is the configured base. No public exploit code has been identified and this vulnerability is not in the CISA KEV catalog; the CVSS 4.0 score of 8.2 reflects high confidentiality risk conditioned on a specific deployment layout (AT:P) rather than universal exploitability.
Remote unauthenticated access to the Forge component of Oracle Commerce Guided Search and Oracle Commerce Experience Manager 11.4.0 allows network-based attackers to read all data accessible to the platform and inflict partial denial of service via ordinary HTTP requests. The CVSS vector confirms no authentication, user interaction, or special configuration is required, placing this firmly in the automatable, high-priority tier. No public exploit has been identified at time of analysis, but the vulnerability is addressed in Oracle's Critical Security Patch Update for August 2026.
The Common Events component of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes an unauthenticated network-accessible attack path requiring victim interaction, enabling complete unauthorized read access to all Hyperion-accessible data and limited write capability through a scope-changing exploit. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) combined with the Authentication Bypass tag and scope change indicator is strongly consistent with a client-side injection flaw - such as reflected XSS or CSRF - in the Common Events interface that can hijack or bypass authenticated session controls. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated remote exploitation of Oracle WebCenter Portal's Runtime Tools component (versions 12.2.1.4.0 and 14.1.2.0.0) enables a network-based authentication bypass over HTTP, contingent on a single human-interaction step by a target user. Successful exploitation yields complete confidentiality exposure of all data accessible to the portal instance and limited unauthorized write capability, with scope-change implications that can cascade into co-hosted Oracle Fusion Middleware products. Oracle confirmed the issue through its August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 expose a network-accessible, unauthenticated vulnerability in the Content Server component that can be triggered via HTTP with user interaction, resulting in a scope change affecting additional products. Successful exploitation grants attackers complete read access to all data accessible within Oracle WebCenter Content and limited write capabilities (insert/update/delete) against some accessible data. No public exploit or CISA KEV listing has been identified at time of analysis, though the Oracle-assigned tag of 'Authentication Bypass' and the high CVSS score of 8.2 warrant prompt patching within Oracle Critical Patch Update cycles.
Remote exploitation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Endeca Application Controller component) allows unauthenticated network attackers to achieve a scope change, compromising confidentiality of all data accessible to the Oracle Commerce platform and enabling limited unauthorized data modification. The attack requires victim interaction, suggesting a client-side exploitation vector such as cross-site scripting or cross-site request forgery that bypasses authentication controls per the advisory's Authentication Bypass tag. Disclosed under the Oracle August 2026 Critical Patch Update with a CVSS 8.2 High rating; no public exploit or active exploitation confirmed at time of analysis.
Oracle MES for Process Manufacturing versions 12.2.3 through 12.2.15 exposes unauthenticated remote attackers to complete confidentiality compromise and partial integrity loss via HTTP, contingent on a victim's interaction. The scope change in the CVSS vector confirms that a successful attack can cascade beyond the MES module itself into additional Oracle E-Business Suite components. No public exploit code or CISA KEV active-exploitation confirmation exists at time of analysis, but the low attack complexity and zero privilege requirement make this a credible phishing or watering-hole vector against manufacturing-sector targets.
Unauthorized data access and manipulation in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 is possible via an authentication bypass flaw in the Installation and Configuration component, exploitable by low-privileged network attackers over HTTP. Successful exploitation triggers a scope change, meaning compromise extends beyond the directly targeted component to additional Oracle Hyperion products, enabling full read access to critical data and unauthorized create, delete, or modify operations on critical Hyperion data. No public exploit code has been identified at time of analysis, though the CVSS 8.2 rating and scope-change designation elevate this above typical high-complexity findings.
Unauthorized data access and modification in Oracle Hyperion Data Relationship Management 11.2.25.0.000 allows a low-privileged, network-based attacker to bypass access controls via a crafted SQL interaction, resulting in full confidentiality and integrity compromise of critical DRM data. The scope change (S:C) in the CVSS vector indicates successful exploitation can significantly impact additional Oracle products beyond DRM itself. No public exploit code or CISA KEV listing is identified at time of analysis, though the 'Authentication Bypass' tag signals the vulnerability undermines a core security control.
Unauthorized read and write access to critical data in Oracle Agile Engineering Data Management 6.2.1 is achievable by low-privileged network attackers targeting the Engineering Communication Interface (ECI) component via HTTP, with successful exploitation yielding high confidentiality and integrity impact (C:H/I:H) that can cascade to additional Oracle products via scope change. The 'Authentication Bypass' tag in reporter intelligence suggests the flaw enables attackers to exceed their granted access level within the ECI, despite requiring an initial low-privileged foothold. Oracle addressed this in the August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Critical confidentiality and integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables low-privileged network attackers to exploit the Security component via SFTP, gaining unauthorized read and write access to all critical data within the system. The CVSS scope change indicator confirms that successful exploitation can cascade beyond the directly targeted instance, significantly impacting additional Oracle Hyperion products sharing the same environment. No public exploit identified at time of analysis, though the combination of an authentication bypass tag and high-impact dual confidentiality and integrity outcomes makes this a material risk for any organization running this EPM platform.
Unauthenticated denial-of-service and partial data integrity compromise in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes the Content Acquisition System component to remote HTTP exploitation. An attacker with network access can repeatedly crash or hang the service and perform unauthorized data manipulation (insert, update, or delete) against accessible data stores. No public exploit code has been identified at time of analysis, and Oracle disclosed this in the August 2026 Critical Patch Update.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes all application-accessible master data to unauthenticated remote attackers over HTTP, with additional limited write capability (insert, update, delete). The flaw resides in the Access and Security component, and Oracle's own advisory classifies it as 'easily exploitable' with a PR:N/AC:L attack vector - meaning any network-reachable instance requires no credentials or special conditions to exploit. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the low attack complexity and high confidentiality impact make this a high-priority patch target for enterprises running Oracle Hyperion.
Unauthenticated arbitrary content deletion in the Breeze WordPress caching plugin (≤ 2.5.12, by Cloudways) exposes any WordPress site running this plugin to remote content destruction without credentials. The missing authorization check (CWE-862) on deletion-capable endpoints allows any internet-facing attacker to trigger content removal, producing high availability impact and minor integrity impact per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H vector. No public exploit or CISA KEV listing has been identified at time of analysis, but the trivial exploitation profile makes rapid weaponization probable once a proof-of-concept surfaces.
Unauthenticated remote attackers can bypass access controls in the Imperative Web Server component of Oracle Helidon 3.2.18, gaining complete read access to all data accessible by the application and limited ability to modify or insert records via HTTP. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 8.2 (High), reflecting a fully network-accessible, zero-complexity attack requiring no credentials or user interaction. No public exploit code has been identified at time of analysis, and the vulnerability is addressed in Oracle's Critical Security Patch Update for August 2026.
Remote unauthenticated exploitation of Oracle VM VirtualBox 7.2.14 via its RDP component allows attackers to bypass authentication and gain full read access to all VirtualBox-accessible session data as well as limited write capability, without requiring any credentials or user interaction. The vulnerability resides in the Core component's Virtual Remote Desktop Extension (VRDE), exposed over the network via RDP. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-authentication network vector and low attack complexity make this a high-priority patching candidate for any deployment with VRDE enabled.
Remote unauthorized data access in Oracle Demand Planning versions 12.1 and 12.2 enables unauthenticated network attackers over HTTP to read all data accessible to the application and perform limited unauthorized write operations, with no authentication, elevated privileges, or user interaction required. Tagged as an authentication bypass by Oracle's own security team, this flaw carries a CVSS 3.1 base score of 8.2, reflecting high confidentiality and low integrity impact with no availability component. No public exploit code has been identified at the time of analysis, though the low attack complexity and complete absence of authentication barriers make this a straightforward target for automated or opportunistic exploitation once a proof-of-concept surfaces.
Oracle Hyperion Data Relationship Management version 11.2.25.0.000 exposes a network-exploitable flaw in its Access and Security component that allows low-privileged authenticated attackers to achieve full read and write access to critical master data and propagate impact across additional Oracle Hyperion components via a scope change. Oracle assigned a CVSS 8.2 base score and tagged the issue as an authentication bypass, indicating a breakdown in authorization enforcement rather than a trivial credential attack. No public exploit code or CISA KEV listing exists at time of analysis, but the scope change and high confidentiality and integrity impacts make this a priority patch target for organizations running integrated Hyperion environments.
Unauthenticated remote exploitation of Oracle Helidon 1.4.19's Imperative Web Server component via HTTP allows attackers to perform unauthorized creation, deletion, and modification of critical application data, with partial read access to Helidon-accessible data. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero barriers to exploitation - no credentials, no user interaction, and low attack complexity over standard HTTP. Reported via Oracle's Critical Patch Update for August 2026 and tagged as an Authentication Bypass, with no public exploit code or CISA KEV listing identified at time of analysis.
Partial authentication bypass in Oracle Business Intelligence Enterprise Edition's BI Platform Security component allows a low-privileged remote attacker to compromise both confidentiality and integrity of critical OBIEE data, with a scope change indicating spillover impact on additional Oracle products within the same environment. Affected versions span three distinct release lines - 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 - covering a wide enterprise install base. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the combination of high-impact scope change and low privilege requirement elevates urgency even given the high attack complexity.
Unauthenticated remote attackers can compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via HTTP by exploiting an authentication bypass in the Endeca Application Controller component, with successful attacks requiring human interaction from a victim user. Exploitation yields complete read access to all data accessible by the Oracle Commerce application (C:H) and limited write capability (I:L), with a confirmed scope change meaning additional Oracle Commerce platform components beyond the targeted instance can be significantly impacted. Oracle characterizes this as easily exploitable in its August 2026 Critical Security Patch Update advisory; no public exploit has been identified at time of analysis.
Oracle Partner Management versions 12.2.3 through 12.2.15 (within Oracle E-Business Suite) exposes a network-accessible authentication bypass in its Internal Operations component, allowing unauthenticated remote attackers to compromise the application via HTTP - subject to a single victim interaction. Successful exploitation yields high-confidence access to critical partner data and limited write capability, with a scope change that may laterally impact additional Oracle EBS modules beyond Partner Management itself. No active exploitation (CISA KEV) or public POC has been identified at time of analysis, but the low-complexity, unauthenticated attack surface warrants priority patching for internet-facing EBS deployments.
Oracle Email Center versions 12.2.3 through 12.2.15 contains a network-exploitable authentication bypass in its Message Component that allows unauthenticated remote attackers to gain unauthorized access to critical data and perform limited data manipulation via HTTP, contingent on victim user interaction. The scope change embedded in the CVSS vector (S:C) indicates successful exploitation can extend impact beyond Email Center to other Oracle E-Business Suite components, materially amplifying real-world risk beyond the immediate application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this vulnerability in the August 2026 Critical Patch Update.
Buffer overflow in Dell PowerStore SDNAS's NFS/RPC subsystem exposes the entire PowerStore appliance line (500T through 7000T and beyond) to unauthenticated remote exploitation. The CWE-120 flaw in the RPC request handler allows an unauthenticated network attacker to achieve arbitrary command execution or denial of service against the NAS service. The CVSS 8.1 score is tempered by High Attack Complexity (AC:H), indicating exploitation requires non-trivial payload engineering rather than a simple spray-and-pray approach; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Full takeover of Oracle VM VirtualBox 7.2.14 is achievable by a locally-authenticated, high-privileged attacker, with confirmed scope change indicating the compromise extends beyond the hypervisor to additional products - consistent with a VM escape or host privilege escalation pattern. The CVSS vector (AV:L/PR:H/S:C/C:H/I:H/A:H) signals that despite the elevated privilege bar, successful exploitation yields complete confidentiality, integrity, and availability impact across system boundaries. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability is disclosed via Oracle's August 2026 Critical Patch Update advisory.
Unauthenticated Local File Inclusion in the Restaurant Menu by MotoPress WordPress plugin (versions ≤ 2.4.11) exposes WordPress deployments to arbitrary local file disclosure and potential remote code execution via PHP file-inclusion chains. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network exploitation requires no authentication or user interaction, though the high-complexity rating indicates specific server-side conditions or path knowledge are needed to reliably trigger the flaw. No confirmed active exploitation appears in CISA KEV and no public exploit code has been identified at time of analysis.
Integrity and availability compromise in Oracle Agile PLM 9.3.6 via the PGC / Excel Plugin component allows low-privileged, network-authenticated attackers to destroy or alter critical PLM data and cause complete denial-of-service through repeated application crashes. The CVSS 3.1 score of 8.1 reflects high integrity and availability impacts with no confidentiality exposure, delivered over HTTP without requiring user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes its Installation and Configuration component to unauthorized data manipulation and complete denial-of-service via HTTP by low-privileged authenticated network users. Exploitation allows an attacker to create, delete, or modify critical Hyperion EPM data and cause a full service hang or crash, directly threatening financial reporting and planning operations. No public exploit code has been identified at time of analysis, and Oracle addressed this in the August 2026 Critical Patch Update.
Oracle Workflow's Notification Mailer component in E-Business Suite versions 12.2.3 through 12.2.15 can be compromised by a low-privileged network attacker over HTTP, enabling unauthorized creation, deletion, or modification of critical workflow data and triggering a complete denial of service. The CVSS 3.1 score of 8.1 reflects high integrity and availability impacts with no confidentiality exposure, exploitable with low complexity and no user interaction. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Full takeover of Oracle Web Services Manager is achievable by unauthenticated remote attackers via HTTPS in versions 12.2.1.4.0 and 14.1.2.0.0 of the Oracle Fusion Middleware product line. The vulnerability resides in the Web Services Security component and carries a CVSS 3.1 base score of 8.1, with complete confidentiality, integrity, and availability impacts confirmed by Oracle's August 2026 Critical Patch Update advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Full system takeover of Oracle Call Center Technology - a component of Oracle E-Business Suite - is achievable by unauthenticated remote attackers via HTTP across versions 12.2.3 through 12.2.15, with successful exploitation yielding complete compromise of confidentiality, integrity, and availability. The high attack complexity (AC:H) designation indicates that exploitation requires satisfying non-trivial preconditions beyond mere network reachability, but no authentication or user interaction is necessary, keeping the attack surface entirely external. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Full takeover of Oracle Trading Community within Oracle E-Business Suite is achievable by unauthenticated remote attackers via HTTP, targeting the Party Search UI component across versions 12.2.3 through 12.2.15. The Oracle-reported CVSS vector confirms network accessibility with no privilege or user-interaction requirement, though high attack complexity (AC:H) indicates exploitation is non-trivial and likely requires precise conditions such as timing, specific request sequencing, or environment-dependent state. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Remote takeover of Oracle Enterprise Manager Base Platform is achievable by unauthenticated network attackers via HTTP targeting the Agent Next Gen component in versions 13.5 and 24.1. Despite the high attack complexity requirement (CVSS AC:H), successful exploitation yields complete compromise - high confidentiality, integrity, and availability impact, effectively full platform control. No public exploit or active exploitation has been identified at time of analysis, but the Oracle CPU August 2026 advisory documents this as a supported-version vulnerability requiring immediate attention.
Oracle Reports Developer 14.1.2.0.0, a component of Oracle Fusion Middleware, allows unauthenticated remote attackers to fully compromise the system via a network-accessible HTTP attack against its Security and Authentication component. Successful exploitation results in complete takeover - achieving high confidentiality, integrity, and availability impact - consistent with full control over the affected instance. No public exploit code has been identified at time of analysis, and exploitation requires high attack complexity (AC:H), meaning real-world exploitation depends on meeting specific non-trivial preconditions.
Full system takeover is achievable against JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.4 by an unauthenticated remote attacker over TLS, exploiting a flaw in the E1 IOT Orchestrator Security component. Successful exploitation results in complete compromise of confidentiality, integrity, and availability - effectively a full orchestrator takeover. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the high-severity impact warrants priority attention for Oracle JD Edwards deployments.
Full takeover of Oracle Identity Manager Connector is achievable by an unauthenticated remote attacker communicating over TLS, affecting the Core component of versions 12.2.1.4.0 and 14.1.2.1.0 under Oracle Fusion Middleware. The CVSS vector confirms network reachability with no privileges or user interaction required, though high attack complexity (AC:H) indicates that exploitation demands specific conditions beyond a simple point-and-shoot approach. No public exploit code or CISA KEV listing has been identified at time of analysis, but the complete confidentiality, integrity, and availability impact makes successful exploitation a full system compromise.