Unauthorized data disclosure in Oracle MES for Process Manufacturing (versions 12.2.3-12.2.15) allows a low-privileged attacker with network HTTP access to bypass internal authorization controls and gain complete access to all data accessible by the MES component. The scope change (S:C in CVSS) means successful exploitation can cascade into other Oracle E-Business Suite products, amplifying the confidentiality impact beyond the MES module itself. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; however, the 'Authentication Bypass' tag, low attack complexity, and no required user interaction make this a credible risk in exposed enterprise EBS deployments.
Unauthorized data disclosure in Oracle Warehouse Management (Oracle E-Business Suite component: Internal Operations) allows a low-privileged authenticated attacker with HTTPS network access to bypass authorization controls and obtain critical or complete WMS data across versions 12.2.3 through 12.2.15. The CVSS scope change (S:C) is confirmed by Oracle's advisory, meaning successful exploitation can propagate to additional Oracle EBS products deployed in the same instance - amplifying the data exposure beyond WMS itself. No public exploit code and no CISA KEV listing are identified at time of analysis; the 'Authentication Bypass' tag combined with a PR:L vector indicates this is an authorization bypass for credentialed users rather than a fully unauthenticated flaw.
Unauthorized data disclosure in Oracle Siebel CRM Integration (versions 25.12 through 26.6) allows a low-privileged authenticated attacker to access critical or complete CRM data via HTTP by exploiting an authentication bypass in the Open Integration component. The scope change (S:C) in the CVSS vector means successful exploitation can extend data exposure beyond Siebel CRM Integration to additional integrated Oracle products. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and no user-interaction requirement make this readily actionable for any attacker holding even minimal valid credentials.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a security bypass flaw in its Security component that allows low-privileged, authenticated network attackers to obtain unauthorized read access to critical or complete application data over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) confirms a scope change, meaning successful exploitation can propagate beyond Calculation Manager to compromise other Oracle Hyperion products in the same environment. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the vendor-tagged 'Authentication Bypass' classification and low attack complexity make this a credible risk for any enterprise running this EPM release.
Unauthorized data disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to exfiltrate critical or all accessible Hyperion data via crafted HTTP requests to the Common Events component. The CVSS scope change (S:C) indicates exploitation can cascade beyond the directly targeted component to impact additional Oracle Hyperion products sharing the infrastructure. No public exploit or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag suggests the flaw enables privilege escalation beyond the attacker's initial access level.
Unauthorized data disclosure in Oracle Business Intelligence Enterprise Edition's BI Search component allows a low-privileged, network-authenticated attacker to gain complete read access to all data accessible within the platform, with a confirmed scope change that may expose data in additional Oracle products. Affected versions span 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0, covering both legacy and current release lines. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the low attack complexity and scope change elevate real-world concern for organizations running internet-accessible OBIEE deployments.
Unauthorized data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes complete confidentiality of application-accessible data to low-privileged, network-authenticated attackers via HTTP. The vulnerability resides in the Content Acquisition System component and carries a scope-change classification, meaning successful exploitation can extend impact beyond the directly targeted system to affect additional Oracle Commerce components. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad network accessibility make this a credible priority for organizations running the affected version.
Unauthorized data disclosure in Oracle Hyperion Financial Management 11.2.25.0.000 allows low-privileged network attackers to bypass security controls and gain complete access to sensitive financial data via HTTP. Tagged as an Authentication Bypass in EUVD-2026-61889, the flaw carries a CVSS scope change indicator meaning successful exploitation can extend confidentiality impacts to additional Oracle Hyperion products sharing the same environment. No public exploit code or CISA KEV listing has been identified at time of analysis, though Oracle's own designation of this as 'easily exploitable' and the low attack complexity are meaningful risk signals for organizations running this financial consolidation platform.
Unauthorized data exposure in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to gain complete read access to all data accessible by the application, with scope change enabling lateral data exposure across additional Oracle Hyperion ecosystem products. The vulnerability resides in the Deployment component and is exploitable over HTTP without user interaction. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the Authentication Bypass tag from ENISA EUVD signals a likely authorization control weakness that warrants priority patching in enterprise environments.
Unauthorized data disclosure in Oracle Marketing 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to fully compromise confidentiality of all Oracle Marketing-accessible data via the Audience component over HTTP. The vulnerability carries a scope change, meaning successful exploitation can ripple into additional Oracle E-Business Suite products beyond Marketing itself. Tagged as an Authentication Bypass by the reporting source, no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data exposure in Oracle WebCenter Content's Content Server allows authenticated low-privileged users to access critical or complete enterprise content data over HTTP, with a CVSS 3.1 scope change (S:C) signaling collateral impact on additional Oracle Fusion Middleware components in the same environment. Affecting supported versions 14.1.2.0.0 and 12.2.1.4.0, the vulnerability is tagged as an authentication bypass and carries a CVSS 3.1 score of 7.7, reflecting low attack complexity and no user interaction once a valid account is held. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the straightforward exploitation conditions make patching urgent for environments with broadly distributed low-privileged accounts.
Credential exfiltration via SSRF in AWX's GitHub webhook status callback affects Red Hat Ansible Automation Platform 2: an attacker holding admin role on a webhook-enabled job template can forge a signed GitHub pull request webhook with an arbitrary statuses_url, causing AWX to POST authenticated status updates - including the configured Git Personal Access Token in the Authorization header - to an attacker-controlled or internal endpoint. The Changed scope (S:C) in the CVSS 7.7 vector reflects that the leaked PAT extends attacker reach beyond AWX to connected Git repositories and any internal services reachable via SSRF. No public exploit identified at time of analysis, and no CISA KEV listing exists.
Unauthorized data access and manipulation in Oracle Payments (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 is achievable by a network-adjacent, high-privileged attacker exploiting a flaw in the File Transmission component via HTTP. Successful exploitation produces a scope change, meaning compromise extends beyond Oracle Payments to additional E-Business Suite products, enabling complete confidentiality and integrity compromise of critical payment data. No public exploit or active KEV listing is identified at time of analysis; however, the 'Authentication Bypass' tag supplied by the reporter suggests internal authorization controls within the File Transmission component can be subverted despite the high-privilege initial access requirement.
Oracle Payments versions 12.2.3 through 12.2.15, within Oracle E-Business Suite, expose a flaw in the File Transmission component that permits a high-privileged HTTP attacker to bypass internal access controls and achieve full confidentiality and integrity compromise of payment data, with confirmed scope change cascading impact to additional integrated EBS modules. The vendor-assigned 'Authentication Bypass' tag creates a notable tension with the PR:H CVSS metric, suggesting the bypass operates within Oracle EBS's internal authorization layer - circumventing role-based data access controls - rather than defeating the perimeter authentication mechanism. No public exploit code or active exploitation has been identified at time of analysis; remediation is available via Oracle's August 2026 Critical Security Patch Update.
Compromise of Oracle WebCenter Portal's Composer component - versions 12.2.1.4.0 and 14.1.2.0.0 - allows an authenticated low-privilege attacker over HTTP to achieve high-integrity impact, including unauthorized creation, deletion, and modification of critical portal data, limited confidentiality exposure, and partial denial of service. The CVSS scope change (S:C) indicates exploitation can cascade to additional Oracle Fusion Middleware products beyond WebCenter Portal itself. Disclosed in Oracle's August 2026 Critical Security Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data disclosure in Oracle Marketing Encyclopedia System (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to gain complete read access to all data accessible by the application component. The vulnerability carries a scope change, meaning successful exploitation can impact resources beyond the immediately compromised component. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the tags attribute 'Authentication Bypass' suggesting the low-privilege barrier may be weaker in practice than the PR:L CVSS metric implies.
Integrity and availability compromise in Oracle Siebel CRM Integration's Open Integration component (versions 25.12 through 26.6) allows a high-privileged remote attacker over HTTP to corrupt or destroy critical data and trigger a complete denial of service, with confirmed scope change meaning successful exploitation may cascade into additional integrated downstream products. The attack requires high complexity and pre-existing administrative privileges, limiting opportunistic exploitation, but the cross-system blast radius elevates overall business risk. No public exploit code has been identified and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data exposure in Oracle Payroll (E-Business Suite component: Internal Operations) allows a low-privileged, network-authenticated attacker to gain complete read access to all Oracle Payroll-accessible data via HTTP, with confirmed scope change that may cascade into impact on additional EBS components. Affected versions span 12.2.3 through 12.2.15, covering a broad range of the currently supported 12.2.x release line. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability is tagged as an authentication bypass and rated easily exploitable with low attack complexity.
Unauthorized data disclosure in Oracle Financials Common Modules (Oracle E-Business Suite 12.2.3-12.2.15) allows a low-privileged authenticated attacker with HTTP network access to bypass access controls in the Common Components layer, gaining unauthorized read access to critical or complete financial data. The scope change (S:C) confirmed in the CVSS vector means successful exploitation can cascade into data exposure across additional Oracle EBS products beyond the directly vulnerable module. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this a straightforward exploitation path for any authenticated EBS user.
Oracle WebCenter Portal 14.1.2.0.0 exposes critical confidential data through an authentication bypass in its Runtime Tools component, reachable by any low-privileged user over HTTP. Oracle explicitly classifies this as 'easily exploitable' and assigns a scope-change designation (S:C), meaning successful exploitation can spill over into additional Oracle Fusion Middleware products integrated with the portal. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and broad network accessibility make this straightforward to trigger once the bypass mechanism is understood.
Oracle Unified Directory (OUD) versions 12.2.1.4.0 and 14.1.2.1.0 expose a network-accessible LDAP authorization bypass that enables a low-privileged authenticated attacker to gain unauthorized access to critical or complete directory data. Intelligence sources tag this as an authentication bypass in the OUD Core component, with confirmed scope change impact on additional Oracle Fusion Middleware products consuming OUD identity data. No active exploitation confirmed at time of analysis and no public exploit code has been identified; however, the low attack complexity and network accessibility make this a credible priority for Oracle Fusion Middleware environments.
Unauthorized data access and modification in Oracle Public Sector Human Resources (E-Business Suite versions 12.2.3-12.2.15) is achievable by a high-privileged remote attacker via HTTP, with exploitation triggering a scope change that can affect systems beyond the directly targeted component. The flaw resides in the Regression Testing component and carries CVSS 3.1 Base Score 7.7, reflecting high confidentiality and integrity impacts. No public exploit or CISA KEV active-exploitation listing has been identified at time of analysis.
Oracle Siebel CRM End User versions 17.0 through 26.6 expose a network-exploitable flaw in the Open UI component that, when triggered via a crafted HTTPS interaction, grants a low-privileged attacker full read and write access to critical CRM data - including complete confidentiality and integrity compromise with a documented scope change to additional products. The 'Authentication Bypass' tag reported by Oracle's security team suggests the Open UI layer can be manipulated to circumvent access controls in the context of an authenticated victim's session. No exploit code is publicly available and the vulnerability is not listed in the CISA KEV catalog at the time of analysis.
Session cookie forgery in Zabbix 7.4 is possible because the cryptographic key used to sign Frontend sessions is erroneously written to the database seed, making it readable by anyone with adjacent database access. The vendor-confirmed exploitation path is narrowly scoped: only deployments running both SAML authentication and guest users simultaneously are at known risk, where the extracted key can be used to forge valid session cookies and achieve unauthorized frontend access. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the vendor explicitly states no known impact for deployments outside the SAML-plus-guest-user configuration.
Oracle VM VirtualBox 7.2.14 Core component exposes a scope-changing integrity vulnerability that allows a local unauthenticated attacker - with logon access to the infrastructure hosting the hypervisor - to critically compromise VirtualBox data when a legitimate third party interacts with the product. The attack vector is local and requires human interaction, but the CVSS scope change (S:C) indicates that a successful exploit can break VM containment and significantly impact the host system or co-resident components beyond VirtualBox itself. No public exploit is identified at time of analysis, and the vulnerability is addressed via Oracle's August 2026 Critical Security Patch Update.
Device identity replay in UNITRONIX BetterDesk through version 2.3.0 permits unauthenticated clients to resurrect soft-deleted peer registrations by presenting a known deleted device ID, bypassing administrator-enforced device exclusion controls. The root cause is an implicit SQL upsert that cleared soft-deletion flags on any conflicting registration insert, meaning deletion was not enforced at the database layer. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, CVSS AC:H reflects the non-trivial but realistic prerequisite of possessing a previously issued device identifier.
Use-after-free in Valkey's TLS connection handler allows an authenticated remote attacker to crash the server or potentially achieve remote code execution on TLS-enabled deployments. The flaw exists across all Valkey branches prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, confirmed via GitHub security advisory GHSA-53mc-f3m3-99vh and EUVD-2026-60822. No active exploitation has been confirmed (not in CISA KEV), but the full C:H/I:H/A:H CVSS impact and the RCE/Memory Corruption tags warrant prompt patching for any TLS-configured Valkey instance.
Server-side template injection in GBIF Integrated Publishing Toolkit (IPT) versions before 3.3.4 permits remote low-privileged authenticated attackers to read arbitrary server-side files and access internal application state by injecting template directives into unsanitized user-controlled input. Disclosed by Mandiant (MNDT-2026-0016), the flaw maps to CWE-1336 and carries a CVSS 4.0 score of 7.6 with high confidentiality and integrity impact on the vulnerable system. No confirmed active exploitation or CISA KEV listing exists at time of analysis, but the potential for credential and configuration file exposure makes this a meaningful risk for biodiversity data publishing deployments.
Unauthorized data manipulation in Oracle General Ledger (E-Business Suite versions 12.2.3-12.2.15) allows a low-privileged, network-authenticated attacker to create, delete, or modify critical financial records via HTTP, with secondary read and partial availability impacts. The vulnerability resides in the Internal Operations component and requires only a valid low-privilege account - no elevated rights or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high integrity impact make this a significant risk for any organization running Oracle EBS financials.
Improper authorization in Atlassian Bamboo Data Center across six affected release lines (10.0.x through 12.1.x) enables authenticated low-privilege users to bypass access controls and reach restricted resources or functionality, with Atlassian tagging the flaw as carrying arbitrary code execution risk. The vulnerability was discovered through Atlassian's own penetration testing program and affects Data Center deployments only - not Bamboo Cloud. No public exploit code or CISA KEV listing exists at time of analysis, but the high confidentiality and integrity impact ratings (VC:H/VI:H in CVSS 4.0) and the RCE tag make this a credible escalation risk in any environment where untrusted or lightly-privileged users hold Bamboo accounts.
Unauthorized data access and partial denial of service affect Oracle General Ledger versions 12.2.3 through 12.2.15, a core financial management component of Oracle E-Business Suite. A low-privileged, network-authenticated attacker can exploit the Internal Operations component via HTTP to gain complete read access to all Oracle General Ledger data, perform unauthorized insert/update/delete operations on a subset of that data, and cause a partial availability disruption. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Oracle Advanced Inbound Telephony versions 12.2.3 through 12.2.15 exposes its Internal Operations component to low-privileged HTTP attackers who can achieve full read access to sensitive telephony data, limited data manipulation, and partial denial of service. The 'Authentication Bypass' tag suggests that while a valid low-privilege account is required to initiate the attack, the Internal Operations component fails to enforce additional authorization controls, allowing privilege escalation within the application. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the vulnerability was disclosed by Oracle's own security team via the August 2026 Critical Patch Update.
Oracle General Ledger within E-Business Suite versions 12.2.3 through 12.2.15 exposes critical financial data to high-privileged network attackers through a flaw in the Internal Operations component accessible over HTTP. Successful exploitation grants complete read access to all General Ledger data and partial write capability, with a confirmed scope change meaning compromise can cascade to additional Oracle EBS products. Disclosed through Oracle's August 2026 Critical Patch Update, no public exploit code has been identified at time of analysis.
Oracle Product Lifecycle Analytics 3.6.1 exposes a network-accessible vulnerability in its installation component that allows low-privileged authenticated attackers to fully read all application data, perform limited data modification, and cause partial service disruption via HTTP. The CVSS 3.1 score of 7.6 reflects meaningful real-world impact, particularly the high confidentiality impact against a supply chain analytics platform that may contain sensitive product and operational data. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 expose a high-severity flaw in the Runtime Tools component that allows a low-privileged, network-accessible attacker to gain complete read access to all portal-accessible data and perform limited data manipulation and partial denial of service via HTTP. The vulnerability is rated CVSS 7.6 and disclosed as part of Oracle's Critical Patch Update for August 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag in the intelligence metadata suggests potential elevation from low-privilege access that warrants close attention.
Product review management in Vvveb CMS prior to 1.0.8.4 exposes a broken object-level authorization flaw (CWE-639) allowing any authenticated low-privileged Vendor to read, modify, and delete product reviews belonging to other Vendors. The backend SQL queries for all supported database drivers (mysqli, pgsql, sqlite) accept a caller-controlled product_review_id without validating ownership against the requesting admin_id, enabling cross-Vendor review manipulation. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS 7.6 High score reflects significant integrity impact in multi-vendor marketplace deployments.
Authorization bypass in Vvveb CMS prior to version 1.0.8.4 allows authenticated low-privileged Vendor accounts to perform unauthorized read, edit, status-change, and delete operations on product Q&A entries belonging to other Vendors. The backend SQL query files for all three supported database engines (MySQL, PostgreSQL, SQLite) accepted a caller-controlled product_question_id without joining the product table to verify that the question belongs to a product owned by the current admin_id. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the fix is confirmed in the released version 1.0.8.4 via GitHub advisory GHSA-cjhq-xqq3-6xv8.
Insecure Direct Object Reference (IDOR) in Vvveb CMS prior to 1.0.8.4 allows authenticated low-privileged Authors to perform unauthorized comment operations across author boundaries in the admin backend. The admin/controller/content/comment.php and comments.php controllers accept caller-controlled comment_id values without validating that the referenced comment's parent post belongs to the requesting author, enabling cross-author comment enumeration, content manipulation, status changes, and deletion. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network-accessible attack surface make this straightforward for any authenticated low-privilege user to abuse.
Multiple broken object-level authorization flaws in Hoppscotch's GraphQL backend allow any authenticated workspace member to read co-members' private API request history, active session data, authorization headers, stored credentials in environment variables, and application settings - and to mutate or delete victims' history entries without ownership validation. All self-hosted and applicable SaaS deployments running versions prior to 2026.6.0 are affected. No public exploit code or CISA KEV listing has been identified, but the low attack complexity combined with high confidentiality impact makes this a material risk in any multi-user workspace deployment.
Cross-context data exposure in Oracle WebCenter Portal's Runtime Tools component allows a low-privileged, network-authenticated attacker to compromise confidentiality at high severity and integrity at limited scope, with a scope change that can impact additional Oracle Fusion Middleware products. Affected versions are 12.2.1.4.0 and 14.1.2.0.0, and Oracle classifies this as 'easily exploitable' despite the user-interaction requirement. No public exploit or CISA KEV listing has been identified at time of analysis, but the Oracle-tagged 'Authentication Bypass' descriptor suggests privilege escalation beyond the attacker's granted access level is central to the vulnerability's mechanism.
Oracle WebCenter Content's Content Server component in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 is exploitable by a low-privileged authenticated attacker over HTTP who can lure a higher-privileged victim into interacting with malicious content, resulting in unauthorized access to critical data and partial data manipulation with confirmed scope impact beyond WebCenter Content itself. Tagged as an authentication bypass by Oracle, this vulnerability carries a CVSS 3.1 base score of 7.6 and is classified as easily exploitable in Oracle's August 2026 Critical Patch Update. No public exploit code or CISA KEV listing has been identified at time of analysis.
Authentication bypass in @neo4j/graphql exposes admin-restricted custom-resolver fields to any authenticated user holding a legitimately issued, non-admin JWT. When both a type-level @authentication directive and a stricter field-level @authentication directive are declared on the same Query or Mutation type, the library silently discards the field-level rule and evaluates only the coarser type-level check - meaning a roles: ["user"] token is sufficient to invoke a field that requires roles_INCLUDES: "admin". Affected across three major branches (5.2.0-5.12.14, 6.0.0-6.6.4, 7.0.0-7.5.x); no public exploit or CISA KEV listing identified at time of analysis.
SSO account takeover in 4gaBoards prior to version 3.3.9 allows any authenticated user to overwrite backend-managed OAuth identity fields on their own account via the PATCH /api/users/:id endpoint, redirecting a victim's SSO login to the attacker's account. The root cause is a mass-assignment flaw in server/api/controllers/users/update.js that incorrectly exposed SSO provider identifiers - including Google, GitHub, Microsoft, and OIDC subject IDs and emails - to user-controlled input. No public exploit is identified at time of analysis, but the attack mechanism is mechanically straightforward given the confirmed source code diff, and exploitation fully transfers the victim's project and board access to the attacker.
Unauthorized data access and partial data manipulation in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by a low-privileged authenticated attacker over HTTP when a victim user interacts with attacker-influenced content. The Endeca Application Controller component is the attack surface, and successful exploitation triggers a scope change that can significantly impact additional Oracle Commerce products beyond the directly targeted instance. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability is rated High (CVSS 7.6) with low attack complexity, making it a realistic threat in environments where low-privilege accounts are broadly granted.
Oracle Hyperion Financial Management version 11.2.25.0.000 exposes a Security component flaw - tagged as an authentication bypass - that enables low-privileged authenticated attackers to gain complete read access to all data within the application and limited write access, with a confirmed scope change extending impact to additional Oracle Hyperion suite products. Exploitation requires human interaction from a victim but carries low attack complexity and is reachable over HTTP without elevated privileges. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this in the August 2026 Critical Patch Update.
Oracle Application Testing Suite 13.3.0.1 exposes a network-accessible vulnerability allowing low-privileged attackers holding the Load Testing for Web Apps role to achieve unauthorized complete read access to critical data and limited write access through HTTP-based exploitation that requires victim interaction. The attack carries a confirmed scope change, meaning successful exploitation can cascade to impact additional Oracle products beyond the testing suite itself. No public exploit code has been identified and CISA KEV listing is absent, though the low attack complexity and network accessibility make this a credible targeted threat for any environment running this specific version.
Unauthorized data access and partial integrity compromise in Oracle Service Fulfillment Manager (E-Business Suite Fulfillment Engine component) affects all releases from 12.2.3 through 12.2.15. A low-privileged network attacker can, after inducing a victim user to interact with a crafted payload delivered over HTTP, achieve complete confidentiality loss of all data accessible to the application and limited unauthorized write access - with confirmed scope change affecting additional EBS products. No public exploit code has been identified at time of analysis, and Oracle has addressed this vulnerability in the August 2026 Critical Patch Update. The Authentication Bypass tag warrants verification, as the provided CVSS vector assigns PR:L rather than PR:N, suggesting privilege escalation within the session rather than a full authentication bypass.
Oracle Transportation Execution (E-Business Suite versions 12.2.3 through 12.2.15) exposes a network-exploitable integrity flaw in its Internal Operations component that allows a low-privileged authenticated attacker to gain unauthorized create, delete, and modify access to critical data - including a partial confidentiality breach - with a scope change impacting additional Oracle EBS products. The attack requires human interaction from a victim other than the attacker, consistent with a client-side injection pattern (e.g., stored XSS or similar), amplified by the 'Authentication Bypass' tag suggesting privilege escalation from low to higher access tiers. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Oracle Reports Developer 14.1.2.0.0 is exposed to a full system takeover through an authentication bypass (CWE-284) in its Security and Authentication component, exploitable by unauthenticated attackers with access to the adjacent network segment hosting the software. Two conflicting CVSS vectors are present in the source data - the embedded description asserts AV:A (Adjacent Network, score 9.6) while the separately provided vector field records AV:P (Physical, score 7.6) - a material discrepancy that affects risk prioritization and requires vendor clarification. Scope change (S:C) is confirmed, meaning successful exploitation may extend impact to other Oracle Fusion Middleware components; no public exploit or CISA KEV listing has been identified, and EPSS probability is very low at 0.26%.
The Workbench component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes a network-exploitable flaw that allows a low-privileged authenticated attacker to compromise confidentiality across a changed scope, affecting additional Oracle Commerce products beyond the directly targeted component. Successful exploitation yields unauthorized access to critical or complete Commerce-accessible data and limited write capability, contingent on a victim user interacting with attacker-controlled content. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Oracle disclosed this via the August 2026 Critical Patch Update.