Integrity and availability compromise in Oracle Siebel Apps - Marketing (versions 17.0 through 26.6) is reachable by any low-privileged, network-authenticated attacker over HTTP with no user interaction required. Successful exploitation allows unauthorized creation, deletion, or modification of critical Marketing data, and can cause a complete denial of service via persistent hang or crash of the Marketing component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a credible threat in environments running unpatched Siebel deployments.
Remote integrity compromise and denial-of-service in Oracle WebLogic Server's Core component allows a low-privileged, network-accessible attacker to corrupt or destroy critical application data and crash the server via HTTP. All currently supported release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are affected, giving this vulnerability a wide blast radius across enterprise Oracle Fusion Middleware deployments. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified, but Oracle's own characterization of the flaw as 'easily exploitable' combined with only a low-privilege account requirement makes patching under the August 2026 CPU urgent.
SQL-layer exploitation in Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged network attacker to fully compromise data confidentiality and integrity across all accessible financial data. The flaw resides in the Security component, and successful exploitation permits unauthorized read, creation, deletion, and modification of critical data - a particularly severe outcome for an EPM platform handling sensitive financial consolidation records. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network-accessible vector make this a high-priority patch target for any Oracle EPM deployment.
Unauthorized data access and modification in Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged, network-adjacent attackers over HTTP, with no user interaction required. The vulnerability resides in the Access and Security component and is tagged as an authentication bypass, enabling an attacker who holds minimal credentials to escalate their effective access to critical or all DRM-accessible data - achieving both full confidentiality and full integrity compromise without triggering availability disruption. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and lack of user interaction make exploitation straightforward for any authenticated user.
Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes an access control bypass in its 'Access and security' component that permits low-privileged authenticated users, reachable over HTTP, to gain unauthorized read access to all application data and unauthorized write access enabling creation, deletion, or modification of critical data. Tagged as an Authentication Bypass by the advisory, the flaw delivers CVSS 3.1 High severity (8.1) with combined confidentiality and integrity impact against an enterprise master data management platform. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data access and manipulation in Oracle iRecruitment (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker to compromise the Internal Operations component via HTTP, resulting in full read access to and arbitrary creation, modification, or deletion of all iRecruitment-accessible data. Tagged as an Authentication Bypass class vulnerability, the flaw enables an attacker with minimal account privileges to exceed their authorization boundary - likely bypassing object-level access controls within the HR recruitment workflow. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; remediation is available via Oracle's Critical Security Patch Update (CPU) for August 2026.
Oracle Internet Procurement Connector in E-Business Suite versions 12.2.3 through 12.2.15 allows low-privileged authenticated network attackers to fully compromise data confidentiality and integrity within the connector via HTTP. Tagged as an authentication bypass by ENISA EUVD (EUVD-2026-61766), the flaw enables unauthorized creation, modification, deletion, and exfiltration of all connector-accessible data with no user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis, but Oracle's own characterization as 'easily exploitable' combined with low attack complexity and network accessibility make this a credible remediation priority for organizations running Oracle E-Business Suite.
Oracle Purchasing versions 12.2.5 through 12.2.15 within Oracle E-Business Suite expose an authorization bypass flaw in the Internal Operations component, allowing any authenticated low-privileged network user to gain complete read access to all purchasing data and perform unauthorized creation, deletion, or modification of critical records. Tagged as an Authentication Bypass by ENISA EUVD-2026-61762, the vulnerability is exploitable over HTTP with no user interaction and low attack complexity, making it a high-priority remediation target in Oracle EBS deployments. No public exploit code has been identified and the vulnerability is not currently listed in the CISA KEV catalog at time of analysis.
Oracle Risk Management versions 12.2.3 through 12.2.15 in Oracle E-Business Suite exposes critical data to low-privileged authenticated attackers over HTTP via a flaw in the Internal Operations component, tagged as an authentication bypass. A successful attack grants full unauthorized read access to all Risk Management data and the ability to create, delete, or modify critical records. No public exploit or CISA KEV listing has been identified at this time, but the low attack complexity and broad version range make this a high-priority patching target for Oracle EBS deployments.
Unauthorized data access and modification in Oracle Payables (E-Business Suite versions 12.2.3-12.2.15) is exploitable by any low-privileged authenticated attacker with HTTP network access, enabling full compromise of Payables confidentiality and integrity. The vulnerability resides in the Internal Operations component and is tagged as an authentication bypass, indicating that access-control deficiencies allow a low-privileged account holder to read or manipulate critical financial data-including supplier invoices, payments, and transaction records-beyond their intended authorization scope. No public exploit code and no CISA KEV listing exist at time of analysis; however, the low attack complexity, vendor-confirmed CVSS 8.1, and sensitive financial data at stake make this a meaningful priority for Oracle EBS environments.
Unauthorized data access and modification in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by low-privileged network attackers via the Common Events component over HTTP. The vulnerability enables complete confidentiality and integrity compromise of all Hyperion-accessible data without requiring elevated privileges or user interaction, yielding a CVSS 3.1 base score of 8.1. Oracle addressed this issue in the August 2026 Critical Patch Update; no public exploit has been identified at time of analysis.
Oracle Purchasing (E-Business Suite component: Internal Operations), versions 12.2.3 through 12.2.15, exposes critical data to unauthorized read and write operations by low-privileged authenticated network attackers over HTTP. The vulnerability is tagged as an Authentication Bypass, suggesting that a user with minimal system privileges can circumvent authorization controls to access or manipulate purchasing data beyond their permitted scope - including complete confidentiality and integrity compromise of all Oracle Purchasing accessible data. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but the low attack complexity and broad affected version range make this a meaningful priority for Oracle EBS deployments.
Unauthorized data access and modification in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows authenticated low-privileged attackers to bypass access controls in the Common Security component via HTTP, gaining read and write access to all critical EPM platform data. The 'Authentication Bypass' tag combined with a PR:L CVSS vector indicates an authorization bypass scenario: a minimal valid account is required but is sufficient to exceed intended access boundaries across confidentiality and integrity dimensions. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Full system takeover of Oracle PeopleSoft Enterprise FIN Common Objects 9.2 is achievable by an unauthenticated remote attacker over HTTP, with successful exploitation yielding complete compromise of confidentiality, integrity, and availability. The vulnerability resides in the Security component and is categorized as difficult to exploit, reflected in the CVSS AC:H rating, suggesting a precision exploitation condition such as a race condition or specific state requirement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the total-takeover impact and unauthenticated network vector make this a high-priority finding for any organization running affected PeopleSoft FIN deployments.
Full system takeover of Oracle Agile PLM MCAD Connector 3.6 is achievable by unauthenticated network attackers over HTTP, with successful exploitation yielding complete compromise of confidentiality, integrity, and availability. The flaw resides specifically in the CAX Client component of Oracle's Supply Chain suite and carries a CVSS 3.1 base score of 8.1 (High), moderated by high attack complexity (AC:H). No public exploit code or CISA KEV listing has been identified at time of analysis.
Full system takeover of Oracle Agile Engineering Data Management 6.2.1 is achievable by unauthenticated remote attackers via HTTP through a weakness in the Web Services Security component. The CVSS 3.1 score of 8.1 reflects complete confidentiality, integrity, and availability compromise (C:H/I:H/A:H), tempered by high attack complexity (AC:H). No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; Oracle addressed it in the Critical Patch Update for August 2026.
Full system takeover is achievable in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 via an unauthenticated HTTP attack targeting the Forge component. The CVSS 3.1 score of 8.1 reflects high confidentiality, integrity, and availability impact, though the AC:H rating indicates exploitation is not trivial and requires the attacker to meet specific conditions. No public exploit code has been identified and CISA has not listed this in KEV at time of analysis, but the vendor-confirmed full-takeover outcome warrants urgent patching given the absence of authentication requirements.
Full system takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by an unauthenticated remote attacker over HTTP, with successful exploitation resulting in complete compromise of confidentiality, integrity, and availability. The vendor-assigned CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms network reachability without authentication, though the high attack complexity rating indicates non-trivial exploitation conditions that reduce the likelihood of opportunistic mass exploitation. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Full system takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by unauthenticated remote attackers over HTTP without user interaction. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates the attack is network-accessible and requires no credentials, but high attack complexity (AC:H) implies specific preconditions - such as race conditions, timing requirements, or environmental factors - that prevent trivial mass exploitation. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though full CIA impact at CVSS 8.1 makes this a high-priority remediation target for organizations running this EPM platform.
Full takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by an unauthenticated remote attacker via HTTP, according to Oracle's August 2026 Critical Security Update. The vulnerability resides in the Server component and, if successfully exploited, results in complete compromise of confidentiality, integrity, and availability of the affected instance. No public exploit code or CISA KEV listing has been identified at time of analysis; the High attack complexity rating reduces the likelihood of opportunistic mass exploitation but does not eliminate targeted risk.
Full system takeover is achievable against Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via unauthenticated HTTP requests targeting the Lifecycle Management component. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates network-exploitable, authentication-free access, though the high attack complexity (AC:H) suggests a non-trivial exploitation barrier such as a race condition, specific timing requirement, or environmental precondition. Successful exploitation yields complete confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by a remote unauthenticated attacker via HTTP, exploiting the Common Events component. The CVSS vector confirms no authentication or user interaction is required, though high attack complexity (AC:H) indicates exploitation is not trivial and likely requires specific timing, configuration state, or precise request crafting. Successful exploitation yields complete compromise of confidentiality, integrity, and availability, consistent with a system takeover - no public exploit or CISA KEV listing identified at time of analysis.
Full takeover of PeopleSoft Enterprise CC Common Application Objects version 9.2 is achievable by an unauthenticated remote attacker via the Oracle Net protocol. Despite the high-severity classification (CVSS 8.1), the attack complexity is rated High, meaning specific technical conditions must be satisfied for exploitation to succeed. No public exploit code exists at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the full C:H/I:H/A:H impact (confidentiality, integrity, and availability) makes this a meaningful risk for organizations running PeopleSoft 9.2 in network-accessible configurations.
Full system takeover is achievable against Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 via an unauthenticated HTTP attack targeting the Integration Broker component. The vulnerability carries a CVSS 3.1 score of 8.1 with complete confidentiality, integrity, and availability impact, though the AC:H metric indicates exploitation is not trivial and requires meeting specific attack complexity conditions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network attack path and full-takeover impact class make this a high-priority patching candidate for organizations running affected PeopleTools versions.
Complete system takeover of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61 through 8.63) is achievable by unauthenticated network attackers via HTTP, specifically through the PIA Core Technology component. Despite the high attack complexity rating (AC:H), successful exploitation yields full confidentiality, integrity, and availability compromise - effectively handing an attacker control over the PeopleSoft environment. No public exploit code or CISA KEV listing has been identified at time of analysis, but the severity of the impact warrants prioritized remediation through Oracle's August 2026 Critical Patch Update.
Full server takeover in Oracle WebLogic Server Core component is achievable by unauthenticated remote attackers via the T3 and IIOP protocols, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Successful exploitation yields complete compromise of confidentiality, integrity, and availability of the targeted server instance. No public exploit has been identified at time of analysis, and exploitation is constrained by high attack complexity; however, WebLogic's T3/IIOP surface has a well-established history of critical deserialization exploits that warrants prioritized patching.
Unauthorized data access and tampering in Oracle Helidon 4.5.0's Imperative Web Server component allows low-privileged authenticated attackers to read or modify critical application data over HTTPS. The vulnerability is tagged as an authentication bypass, suggesting that a legitimately authenticated low-privilege user can circumvent authorization controls to access or alter data beyond their permitted scope. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 8.1 CVSS score and high confidentiality and integrity impacts make this a meaningful risk in any deployment where untrusted low-privileged users have HTTPS access.
Oracle Commerce Guided Search and Experience Manager 11.4.0 exposes a high-severity authorization bypass over HTTP that allows any low-privileged, network-accessible attacker to achieve full confidentiality and integrity compromise of commerce data. The 'Authentication Bypass' tag combined with a PR:L vector indicates that authenticated users with minimal permissions can escalate access to read or manipulate all data accessible to the application, including potentially sensitive customer, catalog, and configuration data. No public exploit or CISA KEV listing has been identified at time of analysis, but Oracle has released a fix through the August 2026 Critical Patch Update.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes a high-severity flaw in its Installation and Configuration component that allows low-privileged authenticated attackers to achieve full confidentiality and integrity compromise over HTTP. The CVSS 3.1 score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects an easily exploitable network path requiring minimal attacker capability - classified by Oracle as 'easily exploitable.' No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the 'Authentication Bypass' tag in available intelligence suggests the low-privilege threshold may itself be circumventable.
Oracle Hyperion Financial Management 11.2.25.0.000 contains an authentication bypass in its Security component that allows a low-privileged authenticated attacker to exceed their authorized access over HTTP, resulting in full confidentiality and integrity compromise of all application data. The flaw enables unauthorized read access to sensitive corporate financial records as well as creation, deletion, or modification of critical data across the entire HFM instance. No public exploit has been identified at time of analysis, and Oracle addressed this vulnerability in the Critical Patch Update for August 2026.
Unauthorized data access and modification in Oracle Project Planning and Control (E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged authenticated network attacker via HTTP, targeting the Change Management component. The vulnerability is tagged as an authentication bypass, suggesting an attacker with minimal credentials can exceed their authorized access level to read or manipulate critical project data without any user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but Oracle rates this as easily exploitable with a CVSS 8.1, making it a high-priority patching target in enterprise environments running E-Business Suite.
Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 exposes critical financial data to full unauthorized read and write access through an authorization bypass flaw in its Deployment component, exploitable over HTTP by any low-privileged authenticated user. The dual high-severity impacts - complete confidentiality loss and full integrity compromise covering unauthorized creation, deletion, and modification of all PCM-accessible data - make this a significant threat to enterprise financial management environments. No public exploit has been identified at time of analysis, and CISA KEV listing is not confirmed.
Unauthorized data access and modification in Oracle Sales Foundation (Oracle E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged, network-authenticated attacker via HTTP, with no user interaction required. The vulnerability resides in the Security API component and is tagged as an authentication bypass, enabling an attacker to read, create, delete, or modify critical data across the entire Sales Foundation dataset. No public exploit code has been identified at time of analysis, and the CVE does not appear in the CISA KEV catalog, though the low exploitation complexity makes this a realistic near-term threat for exposed deployments.
Oracle Reports Developer 14.1.2.0.0 contains an authentication bypass flaw in its Security and Authentication component that allows a low-privileged network attacker to gain unauthorized read and write access to all data managed by the application over HTTP. Rated 8.1 CVSS with low attack complexity and no user interaction required, this represents a significant confidentiality and integrity risk for any organization with Oracle Reports Developer exposed on a network-accessible interface. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Sales versions 12.2.3 through 12.2.15 within Oracle E-Business Suite allows low-privileged, network-authenticated attackers to gain full read and write access to critical data via the Internal Operations component over HTTP. The CVSS 3.1 score of 8.1 reflects high confidentiality and integrity impacts with low attack complexity, making this easily exploitable by any user with a valid low-privilege account. No public exploit has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog; Oracle's Critical Security Patch Update for August 2026 addresses this flaw.
Unauthorized data access and manipulation in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by low-privileged, network-connected attackers via HTTP against the Siebel Cloud Manager component. Successful exploitation grants complete read access to all CRM data and the ability to create, delete, or modify critical records, with no availability disruption to the service itself. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity and low privilege requirement lower the bar for a targeted threat actor with valid credentials.
Authentication bypass in Oracle Hyperion Data Relationship Management 11.2.25.0.000 exposes critical master data to unauthenticated remote attackers over HTTP. Exploitation requires human interaction from a victim user - consistent with a reflected or client-side attack vector - allowing an attacker to read or tamper with all data accessible within the DRM platform, including sensitive master data governance records. No public exploit or CISA KEV listing has been identified at time of analysis, though the Oracle August 2026 Critical Patch Update addresses this issue.
Oracle Hyperion Financial Reporting version 11.2.25.0.000 is affected by an authentication bypass vulnerability exposing critical financial data to unauthenticated remote attackers over HTTP. Successful exploitation, which requires human interaction from a victim user, grants unauthorized read access to all accessible financial data as well as the ability to create, modify, or delete critical records. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the Authentication Bypass tag and CVSS 8.1 score highlight significant risk to corporate financial data confidentiality and integrity.
Remote authentication bypass in Oracle Siebel CRM Integration (Open Integration component, versions 25.12-26.6) allows unauthenticated network attackers via HTTP to achieve full confidentiality and integrity compromise of CRM data when a victim user interacts with attacker-controlled content. The vulnerability enables unauthorized read, create, delete, and modification access to all Siebel CRM Integration accessible data. Tagged as an Authentication Bypass by Oracle and scored CVSS 8.1 (High), no public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle Hyperion Calculation Manager version 11.2.25.0.000 is achievable by an unauthenticated remote attacker over HTTP, resulting in complete loss of confidentiality, integrity, and availability. The attack is classified as difficult to exploit (AC:H), meaning specific conditions must align, but no credentials or user interaction are required once those conditions are met. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the severity of impact warrants priority patching for any affected deployment.
Two-Factor Authentication is fully bypassed in Froxlor's API layer (versions prior to 2.3.7), allowing any holder of a valid API key and secret to invoke all API operations - including management of domains, DNS records, SSL certificates, email, FTP, and databases - without supplying the configured TOTP code. The web UI enforces 2FA correctly via `FroxlorTwoFactorAuth::verifyCode()`, but the API authentication function `FroxlorRPC::validateAuth` in `lib/Froxlor/Api/FroxlorRPC.php` checks only key validity, expiration, API permission, and account status, with zero references to 2FA logic across the entire `lib/Froxlor/Api/` directory. Publicly available exploit code exists per the GHSA advisory, which documents a confirmed PoC environment against Froxlor 2.3.5 with a 2FA-enabled admin account.
Oracle Process Manufacturing Systems (OPM), part of Oracle E-Business Suite versions 12.2.3 through 12.2.15, exposes a high-severity authenticated network vulnerability in the Internal Operations component that allows low-privileged attackers to both read and manipulate critical data. The CVSS 3.1 score of 8.1 reflects high confidentiality and integrity impact with no availability impact, exploitable over HTTP without user interaction. Tagged as an Authentication Bypass, this vulnerability is described as 'easily exploitable,' raising the effective risk for any organization running unpatched OPM installations; no public exploit or CISA KEV listing has been identified at time of analysis.
Oracle Labor Distribution versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, allows a low-privileged network attacker to bypass internal authorization controls via HTTP, resulting in complete unauthorized read and write access to critical labor and payroll cost distribution data. The vendor characterizes this as 'easily exploitable,' and the 'Authentication Bypass' tag indicates that a standard EBS account holder can escalate beyond their assigned access level within the Internal Operations component. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low attack complexity and high dual confidentiality and integrity impact make this a high-priority item in the August 2026 Oracle CPU.
Unauthorized data access and manipulation in Oracle JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.4 is achievable by any low-privileged network attacker over HTTP, with no user interaction required. Tagged as an authentication bypass in the E1 IOT Orchestrator Security component, the vulnerability exposes both confidentiality and integrity of all data accessible to the Orchestrator - including critical business records - to unauthorized reads, creates, deletes, and modifications. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range make this a credible risk for all unpatched deployments.
Remote data compromise in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0-9.2.26.4) allows a low-privileged authenticated attacker to fully breach confidentiality and integrity of critical ERP data via HTTP, with no user interaction required. The vulnerability resides in the Business Logic Infra SEC component and is tagged as an Authentication Bypass, indicating the flaw permits unauthorized escalation beyond the attacker's assigned privilege level. No public exploit has been identified at time of analysis; Oracle's August 2026 Critical Patch Update is the designated remediation vehicle.
Full takeover of Oracle Applications Platform Engineering (Oracle E-Business Suite versions 12.2.3-12.2.15) is achievable by unauthenticated remote attackers via the Oracle Net protocol by exploiting a flaw in the Valid Session component. The CVSS 3.1 score of 8.1 reflects complete confidentiality, integrity, and availability impact, tempered by a high attack complexity (AC:H) that limits opportunistic mass exploitation. No public exploit code or CISA KEV listing exists at time of analysis, though the unauthenticated network vector over Oracle Net makes this a high-priority patch target for any internet-adjacent EBS deployment.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by unauthenticated remote attackers via HTTP, targeting the Common Events component. The CVSS 3.1 score of 8.1 reflects maximum CIA impact (C:H/I:H/A:H) offset by high attack complexity (AC:H), indicating that while no credentials are required, specific conditions must be met to exploit the vulnerability. No public exploit code or active exploitation has been identified at time of analysis, but Oracle's August 2026 CPU advisory confirms the issue and a patch is available.
Full takeover of Oracle WebCenter Portal is achievable by an unauthenticated remote attacker via HTTP, affecting the Runtime Tools component in versions 12.2.1.4.0 and 14.1.2.0.0 of the Fusion Middleware stack. The CVSS vector rates this 8.1 due to high attack complexity (AC:H), meaning exploitation requires specific but unspecified preconditions to be met - yet successful exploitation yields complete compromise of confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the Oracle CPU August 2026 advisory confirms the vulnerability is vendor-acknowledged.
Local File Inclusion in the Theme Test Drive WordPress plugin (versions <= 2.9.1) enables unauthenticated network-based attackers to supply arbitrary file paths to the theme preview mechanism, potentially exposing sensitive server files such as wp-config.php and - under certain server configurations - escalating to remote code execution via log poisoning or similar chaining techniques. The vulnerability is classified under CWE-98 (PHP File Inclusion) with a CVSS 8.1 score reflecting no authentication requirement but elevated attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis.
Remote Local File Inclusion in Vavo Core WordPress plugin versions 2.3.0 and earlier enables unauthenticated network-based attackers to include arbitrary local files from the server filesystem. Affecting WordPress installations running the spabrice-developed plugin, exploitation can expose highly sensitive files such as wp-config.php, leading to database credential theft and potential full site compromise. No public exploit has been identified at time of analysis, though the CVSS 8.1 score with High impact across all three dimensions signals significant severity if the preconditions for exploitation are met.