Unauthenticated attackers positioned on the same network segment as an Oracle Hyperion Financial Management 11.2.26.0.000 deployment can defeat security controls in the product's Security component, obtaining full read and write access to financial consolidation data while also partially degrading service availability. The flaw rates CVSS 8.3 (AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:L), meaning no credentials or user interaction are needed, but the attack surface is limited to the adjacent network path rather than the public internet. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated MCP tool invocation in PraisonAI (praisonaiagents 0.6.0–1.6.58 and praisonai 3.10.0–4.6.58) lets a malicious website use DNS rebinding to reach a local or internal ToolsMCPServer SSE endpoint on /sse and /messages/, enumerate registered tools, and invoke them with the server user's privileges. The legacy SSE wrapper performs no Host, Origin, or authentication enforcement, while the newer Streamable HTTP transport rejects the same hostile Origin with HTTP 403, isolating the flaw to the legacy SSE path. An initial remediation ships in praisonaiagents
A limited buffer overflow in the network security monitoring component of HPE EdgeConnect SD-WAN Gateways allows an unauthenticated remote attacker to crash the appliance and potentially execute code by driving crafted traffic into the monitoring parser. ENISA EUVD lists four affected release trains: 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0. No CISA KEV entry and no public exploit code were identified at time of analysis, and no EPSS data was supplied with the record.
Let me analyze this CVE and produce the JSON. CVE-2026-63443: Coder workspace agent API insecure redirect handling. Affected: Coder (coder/coder) versions < 2.29.19, < 2.32.9, < 2.33.10, < 2.34.4. CVSS 8.3, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. CWE-863 (Incorrect Authorization). Attacker: authenticated user with running workspace and control over modified workspace agent; knows victim agent UUID → derives tailnet IP. Redirects control-plane requests to victim agent. File read/write as victim, and process API command execution. Tags: Authentication Bypass, Hashicorp, Coder. Hashicorp tag is mislabeled — Coder is not HashiCorp (though it uses Terraform, which is HashiCorp). Actually description mentions Terraform "allows organizations to provision remote development environments via Terraform". The tag "Hashicorp" is arguably wrong — Coder Inc. is the vendor. Hmm, but they do build on Terraform. I'd flag "Hashicorp" as wrong_vendor with suggested "coder". Confidence high? The CPE is coder:coder. Yes, flag it. Also "Authentication Bypass" tag — this is more of a broken access control / cross-tenant redirection, not really auth bypass. But I'm less confident; the guidance says only flag mislabeled tags I can verify. "Authentication Bypass" is arguably a mislabel since exploitation requires authenticated user (PR:L). Hmm. I could flag it as mislabeled_tag with suggested "authorization bypass" or something. But suggesting a tag slug... maybe "broken-access-control". It's borderline. I'll consider including it with medium confidence. Actually the instructions say only emit when highly confident and verifiable. The tag "Authentication Bypass" conflicts with PR:L authenticated. I think it's reasonably confident this is not an authentication bypass — it's an authorization/redirect flaw. I'll include it with medium confidence. Hmm, risk of noise. Let me include both: wrong_vendor for "Hashicorp" (high) and mislabeled_tag for "Authentication Bypass" (medium). Maybe also miss
KubeSphere 4.1.3 and earlier ship a git credential verification endpoint that fetches caller-supplied URLs without any allowlist validation, letting an authenticated user point the server at internal services and capture the basic-auth credentials returned in the endpoint's error handling. The flaw is a classic CWE-918 SSRF that escalates into cross-namespace Secret disclosure because the leaked responses can expose credentials stored in any namespace. No public exploit code or CISA KEV entry has been identified at time of analysis, but the source-level references confirm the vulnerable code paths, and the CVSS 4.0 score of 8.3 reflects high confidentiality impact on both the vulnerable component and subsequent systems.
Session fixation in the Secomea GateManager webserver module lets an attacker who can plant a known session identifier on a victim's browser inherit that victim's authenticated session once they log in, yielding full control of the appliance's administrative web interface. Affected builds are GateManager 11.5 and 11.4.625515072; the vendor has released fixes in 11.6 and 11.4.626194074 and above. The flaw is remote and requires no prior authentication (CVSS 8.3, AV:N/PR:N), but does require victim interaction (UI:R) and there is no CISA KEV listing or public exploit code identified at time of analysis.
Remote, unauthenticated attackers can crash any FreeRDP-based RDP server running a version prior to 3.31.0 by sending crafted RDP connection packets that supply zero or oversized DesktopWidth and DesktopHeight values during GCC capability negotiation. The malformed dimensions are used unchecked in multifragment update capability calculations, producing a division-by-zero (CWE-369) or assertion failure that terminates the server process. This is a pure availability impact (CVSS 4.0 base 8.2, VC:N/VI:N/VA:H); no publicly available exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis.
Let me synthesize. Key facts: - CVE-2026-57134, PraisonAI (npm package "praisonai", TypeScript MCP security helper). - MCPSecurity.evaluatePolicy() only validates credentials for api-key/bearer; basic/oauth accept any non-empty Authorization header, skipping validate() callback, returning authenticated: true. - Affected: npm praisonai >= 1.5.1, <= 1.7.1; fixed in 1.7.2. CPE cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:* - CVSS 8.2 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. But logically, exploitation requires the deployment to use basic or oauth auth policy — that's a configuration prerequisite. Hmm. CVSS PR:N given. My assessed vector: I'd argue PR:N is defensible from the attacker's perspective (attacker sends an arbitrary Authorization header without valid credentials). But the configuration requirement: the target must use basic/oauth policy. AV:N is fine. AC:L? Arguably AC:H because it requires non-default config (basic/oauth policy configured). Let me think: the guidance says choose PR honestly — if exploitation requires control over configuration files, admin access, or authentication, use PR:H or PR:L. Here the attacker doesn't need config access; they need the target to have configured basic or oauth. That's a configuration precondition, not attacker privilege. I'd keep PR:N and use AC:H? Hmm. Many would keep AC:L. Actually the exploit is trivially automatable once the target uses basic/oauth. I'll go AC:L, PR:N, but note the pre-condition. Hmm, but the rubric's example: "Requires write access to the httpd configuration, so PR:H and AC:H". That's different. Here attacker just sends header. I'll use AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N — matching but I should express independent judgment. Maybe I could argue I:L and A:N as given. Let me consider C:H — access to MCP tools and resources protected by policies → confidentiality high, integrity low. That's reasonable. I'll go with AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N — but then it's a copy. The instruction says "NOT
Unauthenticated remote attackers with HTTP access to the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can trigger a hang or repeatedly crash the service while also reading a limited subset of its accessible data. The flaw carries a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N, with low confidentiality and high availability impact), reflecting a trivially reachable, low-complexity attack against a supported but legacy enterprise search platform. No public exploit code or CISA KEV entry was identified at time of analysis, so the immediate driver is service availability rather than confirmed active exploitation.
Unauthenticated remote attackers with HTTP access to Oracle JDeveloper's Resource Catalog Services component can read critical data and cause partial denial of service, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates the issue 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L), reflecting high confidentiality impact combined with limited availability impact and no integrity impact. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied in the source data, so exploitation appears opportunistic rather than confirmed in the wild.
Unauthenticated remote attackers who can reach the Oracle Agile PLM 9.3.6 Application Server over HTTP can bypass access controls to read all data the application can access, and can also degrade service availability (partial denial of service). Oracle rates this 8.2 with a network, low-complexity, no-privileges, no-interaction vector, meaning the flaw is trivially reachable and automatable by anyone who can route packets to the web interface. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthenticated remote attackers can reach the System Wide component of Oracle Utilities Network Management System over HTTP and obtain high-impact read access to critical data, plus limited ability to modify records, across supported releases 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A and 25.12.0.0.0-25.12.0.0.3. Oracle rates the issue 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), meaning no credentials, no user interaction and no unusual conditions are needed to attempt exploitation. It is tagged as an authentication bypass, but no public exploit code, EPSS score or CISA KEV entry was supplied with this report, so active exploitation is unconfirmed at time of analysis.
Unauthenticated remote attackers can bypass authentication in Oracle Web Services Manager (Web Services Agent component) and gain unauthorized read access to critical data plus limited write access to some of the product's data. Affected are versions 12.2.1.4.0 and 14.1.2.0.0 of the Fusion Middleware product. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis, but the network-only, no-privilege, no-interaction attack profile (CVSS 8.2) makes exposed WSM deployments a high-value target for credential/assertion theft and configuration tampering.
Unauthenticated attackers with HTTP network reachability to the Siebel CRM Deployment component of Oracle Siebel CRM can bypass authentication and gain unauthorized access to critical data, plus limited ability to update, insert, or delete records. The flaw affects supported Siebel CRM versions 17.0 through 26.7 and carries a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N). No public exploit code or active exploitation has been identified from the available intelligence at time of analysis.
Unauthenticated attackers who can reach the HTTP interface of Oracle Siebel CRM Cloud Applications, specifically the Siebel Cloud Manager component, can bypass authentication and gain full read access to critical CRM data plus limited ability to insert, update or delete records. The flaw affects supported releases 22.3 through 26.7 and carries a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N), meaning it is remotely reachable, low complexity and requires no credentials or user interaction. No public exploit code or CISA KEV listing was present in the supplied intelligence, so exploitation status is unconfirmed at time of analysis.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 contain an authentication-bypass flaw in the Runtime Tools component that can be triggered by an unauthenticated attacker over HTTP, giving access to critical portal data as well as the ability to modify or delete some of it. Oracle rates the issue CVSS 8.2 (C:H/I:L, no availability impact) with network vector, low complexity, and no privileges or user interaction required, making it trivially automatable against any internet- or intranet-reachable deployment that has not applied the referenced Critical Patch Update. No public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis, so exploitation is assessed as possible but not confirmed in the wild.
Unauthenticated remote attackers can bypass security controls in Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP, gaining access to and limited modification of financial consolidation data managed by the application. Oracle rates it 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), with high confidentiality impact and low integrity impact and no availability impact. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is not confirmed as active, but the flaw is trivial to attempt from any network position with HTTP reachability and is addressed only through the Oracle Critical Patch Update.
Oracle Hyperion Financial Management 11.2.26.0.000 can be compromised by an unauthenticated attacker who reaches its HTTP interface, allowing a full read of critical financial-consolidation data plus partial modification of that data. Oracle's advisory rates this 8.2 with a fully remote, no-privilege, no-interaction vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), which is unusual and places it among the more severe entries in the 2026 Hyperion security alert. There is no public exploit code and no CISA KEV listing in the supplied data, so the immediate risk is exposure-driven rather than evidence of active exploitation.
Unauthenticated TCP network access to the Oracle Mobile Application Server component (MWA Terminal Server) in Oracle E-Business Suite 12.2.3 through 12.2.15 lets an attacker bypass authentication details and gain unrestricted read access to data reachable by that service while also degrading its availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:L, base 8.2) confirms no credentials or victim interaction are needed, making exploitation trivially automatable once the middle-tier service is reachable. No public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at time of analysis.
Unauthenticated remote attackers can reach the Workspaces component of Oracle Siebel CRM Development over HTTP and obtain unauthorized read access to critical application data while also degrading service availability (CVSS 3.1 base 8.2, AV:N/AC:L/PR:N/UI:N). Affected are all Siebel CRM Development releases from 17.0 through 26.7. There is no public exploit code or CISA KEV listing confirmed in the supplied intelligence, so the practical priority depends on whether the Workspaces HTTP interface is exposed beyond trusted internal networks.
Authentication bypass in Oracle Communications Cloud Native Core Security Edge Protection Proxy (SEPP) versions 26.1.200 and 25.2.201 lets a low-privileged attacker with network access over HTTP read and modify critical SEPP data, with the flaw's scope change (S:C) extending impact to interconnected network functions. The attacker must already hold some valid, low-privileged identity and overcome non-trivial exploitation conditions (CVSS 8.2, AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N), so this is not an anonymous drive-by. No public exploit code and no CISA KEV listing were provided in the intelligence feed at time of analysis.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 contain a flaw in the Siebel Cloud Manager component that lets a low-privileged, network-positioned user read and modify critical CRM data, with impact extending beyond the vulnerable component (scope change). The CVSS 3.1 base score is 8.2 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N), reflecting high attack complexity and the need for a valid low-privileged account rather than anonymity. No public exploit code and no CISA KEV entry were identified at time of analysis, so exploitation is confirmed only as theoretically practical, not known to be active.
Unauthenticated attackers with network reachability to Oracle Hyperion Financial Management 11.2.26.0.000 can reach an exposed HTTP interface and tamper with or delete critical financial consolidation data, while also degrading service availability. Oracle rates the flaw 8.2 with full integrity impact and partial availability impact, but no privilege or interaction requirements. No public exploit code or CISA KEV listing was provided in the source data, and the input includes no EPSS score, so real-world exploitation volume is unquantified.
Improper access control in the Internal Operations component of Oracle Engineering within Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated but low-privileged attacker reaching the application over HTTP to create, delete, modify, and read critical Engineering data, with the impact extending beyond the vulnerable component (CVSS scope change). Oracle rates it 8.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N), noting the attack is difficult to execute, so it is a targeted-risk issue rather than an opportunistic mass-exploitation one. No public exploit code is identified in the supplied intelligence, and the product is not listed in CISA KEV.
Oracle E-Business Suite's Bills of Material module (versions 12.2.13 through 12.2.15) contains a difficult-to-exploit flaw in the Internal Operations component that lets a low-privileged, authenticated attacker with HTTP network access read and tamper with critical manufacturing data. Successful exploitation yields high confidentiality and integrity impact and, per Oracle, can spill over into other EBS modules because of a scope change, though availability is unaffected. There is no CISA KEV listing and no public exploit code identified at time of analysis; the vendor advisory is the primary source of truth.
Unauthenticated remote attackers can bypass authentication in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000, obtaining complete read access to the financial consolidation and reporting data the application can reach, plus limited unauthorized modification. Oracle's own advisory rates it 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N), placing it in the most dangerous class of EPM flaws because no credentials or user interaction are needed. The supplied intelligence contains no EPSS score, no CISA KEV entry and no public exploit code, so active exploitation is not confirmed.
Unauthenticated attackers with HTTP network access to the Experience Manager component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can bypass authentication and reach data and functions that should require a login. Successful exploitation yields high confidentiality impact - full read access to data the affected component can reach - plus limited integrity impact allowing unauthorized inserts, updates, or deletions of some records. Oracle rates this 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N); there is no public exploit code and no CISA KEV listing at time of analysis, but the unauthenticated, low-complexity attack path makes rapid patching the priority.
Unauthenticated HTTP requests against Oracle Hyperion Financial Management 11.2.26.0.000 can bypass the application's authentication controls, exposing critical financial consolidation data and permitting limited insert, update or delete operations. Oracle scores it 8.2 on a network, no-privileges, no-interaction vector, so any instance whose web tier is reachable from an untrusted network is exposed. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 expose a flaw in the Siebel Cloud Manager component that lets an attacker already holding a low-privileged account on the platform, and positioned on the same physical/adjacent network segment as the hosting hardware, read essentially all CRM data, modify or delete some of it, and partially disrupt service. The CVSS 3.1 base score is 8.2 (AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L), and the scope-change metric indicates the compromise can spill over into additional products beyond Siebel itself. No public exploit code has been identified and the issue is not listed in CISA KEV, but it should not be ignored: the confidentiality impact is total, Oracle rates exploitability as 'easily exploitable', and no EPSS score or CWE mapping was supplied to further refine the risk picture.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can be compromised over HTTP by an unauthenticated attacker who persuades another user to interact with attacker-supplied content, yielding high-impact confidentiality loss and partial data tampering that can cross component boundaries (CVSS 3.1 S:C). The published vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N with a base score of 8.2, and no CWE is assigned. No KEV listing, EPSS score, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Unauthenticated remote attackers can compromise Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP, gaining the ability to create, delete, or modify critical financial consolidation data and to read a subset of application data. Oracle rates the flaw 8.2 with high integrity impact and low confidentiality impact, and classifies it as easily exploitable (network vector, no privileges, no user interaction). No public exploit code or CISA KEV entry is present in the supplied intelligence, so active exploitation is unconfirmed at time of analysis.
Unauthenticated denial of service combined with unauthorized data modification in the Oracle Mobile Application Server (MWA Terminal Server) component of Oracle E-Business Suite 12.2.3 through 12.2.15. A remote attacker with HTTP access can send crafted requests that hang or repeatedly crash the MWA service while also inserting, updating, or deleting some MWA-accessible data, but the attack requires a victim — not the attacker — to perform some interaction (UI:R), and Oracle's scope-change rating indicates effects can spill over to related products. Oracle rates this 8.2 High; no public exploit code and no CISA KEV listing were identified in the supplied intelligence, and no EPSS score was provided.
Unauthenticated remote code execution and denial-of-service in HPE Aruba Networking EdgeConnect SD-WAN Gateways (versions 9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1, and 9.7.0.0) arise from flawed parsing of malformed or truncated packets in the proxy packet-processing path, where incorrect length arithmetic triggers an integer overflow that can become a memory-corruption (buffer overflow) condition. Successful exploitation can let a network-positioned attacker execute code or crash the gateway, taking down the SD-WAN overlay. The HPE advisory at support.hpe.com confirms affected version ranges, but there is no CISA KEV listing, no EPSS score, and no public exploit code identified at time of analysis, so this is currently a patch-now, watch-for-exploitation item rather than a confirmed active campaign.
A buffer overflow in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways allows an unauthenticated remote attacker to execute arbitrary commands on the underlying host, resulting in full operating-system compromise of the appliance. Multiple maintenance trains are affected — 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and the 9.7.0.0 release. The vendor's own CVSS rating is 8.1 (AV:N/AC:H/PR:N/UI:N), reflecting that exploitation is unauthenticated but gated by preconditions outside the attacker's control; no public exploit code or CISA KEV listing was identified at time of analysis.
A heap buffer overflow in the IBM MQ client (CWE-787) can be triggered when the client processes crafted messages delivered by a malicious or compromised queue manager, or by an attacker positioned to man-in-the-middle the client-to-manager channel. Successful exploitation can crash the client for a denial-of-service condition or, more seriously, allow arbitrary code execution in the context of the client process. IBM has released a vendor fix via support bulletin 7284943; there is no public exploit code or CISA KEV entry identified at time of analysis, and the elevated complexity (the attacker must control the server side of the connection) keeps real-world risk below its 8.1 CVSS base score for most deployments.
Remote unauthenticated denial of service in the libp2p-quic transport crate (Rust implementation of libp2p) prior to 0.13.1: a peer that completes a valid-looking QUIC/TLS handshake with a deliberately short-lived libp2p TLS certificate and then withholds the final TLS 1.3 handshake fragment until that certificate expires triggers a wall-clock validity re-check in the post-handshake upgrade path, where an `expect()` call panics and tears down the application hosting the QUIC listener. Only a single inbound connection from a network peer is needed, no malformed packets are required, and the attack is fully automatable against any service exposing an affected libp2p-quic listener. The flaw is an uncaught exception (CWE-248) and is fixed in 0.13.1; no public exploit code and no CISA KEV listing were identified at time of analysis, though the GHSA advisory publishes a precise reproduction recipe.
Credential leakage in Tornado's CurlAsyncHTTPClient (all releases through 6.5.6) lets sensitive per-request state — client TLS certificates (SSLCERT/SSLKEY) and proxy basic-auth credentials (PROXYUSERPWD) — persist on pooled pycurl handles and be presented to a different, unintended host on a later request. The flaw affects applications that pass per-request credentials to the curl-backed client and reuse the same client instance across hosts; it is not reachable by an anonymous internet attacker against a default server deployment, and the vendor rates attack complexity as high with attack requirements present. No public exploit code has been identified at time of analysis and no active exploitation is reported; the vendor has fixed the issue in Tornado 6.5.7.
Unauthenticated remote attackers can circumvent the authentication controls exposed by the API of HPE Networking EdgeConnect SD-WAN Orchestrator, escalating to administrative privileges and achieving complete compromise of the orchestrator host. The vendor rates this 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), and EUVD maps the affected code lines to EdgeConnect SD-WAN releases 9.4.0 through 9.4.10, 9.5.0 through 9.5.8, 9.6.0 through 9.6.3, and 9.7.0. No CISA KEV listing or public exploit code was identified in the supplied intelligence, and EPSS data was not provided, so the practical exploitation risk rests on the high attack complexity (AC:H) noted in the vendor vector.
Oracle E-Business Suite's Demand Signal Repository component (versions 12.2.3 through 12.2.15) contains an access-control weakness that lets a low-privileged, network-positioned user reach Internal Operations functionality over HTTP and perform unauthorized creation, deletion, or modification of critical DSR data while also triggering a hang or repeated crashes for a complete denial of service. Rated CVSS 3.1 base 8.1 (AV:N/AC:L/PR:L/UI:N, Integrity and Availability High), the flaw requires a valid low-privileged account but no user interaction. There is no public exploit code identified and the issue is not listed in CISA KEV; no EPSS score was supplied with the intelligence feed.
Low-privileged remote attackers can compromise Oracle BI Publisher through its SOAP-based Web Service API, gaining unauthorized ability to create, delete or modify critical report data and to repeatedly crash the service for a complete denial of service. The affected versions are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, and the flaw carries a CVSS 3.1 base score of 8.1 (network vector, low complexity, low privileges required, no user interaction). No public exploit code has been identified and the vulnerability is not listed in CISA KEV, although enterprise reporting platforms of this kind are attractive targets once technical details become public.
Oracle BI Publisher (part of Oracle Analytics) is affected by a network-reachable flaw in its BI Platform Security component that lets a low-privileged, authenticated attacker via SOAP tamper with or delete critical reporting data and repeatedly crash the service, enabling a full denial of service. Versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 are listed as affected, and the vendor rates it 8.1 with high integrity and availability impact while confidentiality is untouched. No public exploit code or CISA KEV listing was present in the supplied intelligence, and EPSS data was not provided, so real-world exploitation status is unconfirmed.
Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 expose an exploitable flaw in the SQR component that lets a low-privileged, authenticated user reach the service over HTTP and read data well beyond their intended authorization while also crashing or repeatedly hanging the application. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) the attacker needs a valid account but no elevated role and no victim interaction, and the confidentiality impact is rated total for data accessible through PeopleTools, with a matching high availability impact from the resulting denial of service. Oracle rates this 8.1 and released it in its Critical Security Patch Update cycle; no EPSS score, CISA KEV listing, or public exploit code was supplied with the source data at time of analysis.
Unauthenticated attackers with network access to the Forge indexing component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can achieve complete takeover of the platform, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.1). Oracle rates the flaw as difficult to exploit (AC:H), so it likely requires precise protocol knowledge, timing, or a race condition rather than a simple one-shot request. No public exploit code or CISA KEV listing is present in the available intelligence, and no EPSS score was supplied, so the practical exploitation likelihood remains unquantified.
Oracle Siebel CRM Deployment (Server Infrastructure component), versions 17.0 through 26.7, can be fully taken over by an unauthenticated network attacker who reaches the deployment's TCP service and successfully exploits a difficult-to-trigger flaw. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H, score 8.1) confirms no credentials or user interaction are required, but the high attack complexity means the attacker must satisfy a narrow, non-trivial condition to succeed. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and no EPSS score was supplied; Oracle published the fix in its Critical Security Patch Update advisory referenced below.
Unauthenticated attackers who can reach the One-to-One Fulfillment module of Oracle E-Business Suite 12.2.3 through 12.2.15 over HTTP can achieve complete takeover of that component, with high confidentiality, integrity, and availability impact (CVSS 8.1). Oracle characterizes the flaw as difficult to exploit (AC:H), which tempers the unauthenticated network attack vector, and the issue resides in the module's Java Server layer. No public exploit code and no CISA KEV listing were identified at time of analysis, and Oracle published the fix as part of its September 2026 Critical Security Patch Update.
A low-privileged, authenticated attacker with HTTP network access can exploit the Cube Manager component in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 to modify or delete critical data and to repeatedly crash or hang the application, producing a complete denial of service. Oracle rates the flaw 8.1 on the CVSS 3.1 scale with high integrity and availability impact but no confidentiality impact, and the vulnerability requires an existing valid account rather than being exploitable pre-authentication. No public proof-of-concept code or evidence of active exploitation was present in the supplied intelligence at the time of analysis.
Unauthenticated attackers with network access to the HTTP interface of Oracle WebCenter Portal's Portlet Services component can exploit a hard-to-trigger flaw to fully compromise the application, per Oracle's Critical Security Patch Update (cspusep2026). Impact spans confidentiality, integrity and availability (CVSS 8.1), with the stated outcome being complete takeover of WebCenter Portal. Only supported versions 12.2.1.4.0 and 14.1.2.0.0 are listed as affected; no public exploit code or CISA KEV entry was present in the supplied intelligence, and the high attack-complexity metric (AC:H) suggests exploitation requires specific, non-trivial conditions rather than a simple one-shot request.
Oracle Purchasing, the procurement module inside Oracle E-Business Suite 12.2.3 through 12.2.15, fails to properly enforce authorization on HTTP-reachable functionality, letting an authenticated low-privileged user read, create, modify, or delete purchasing data far beyond their intended role. The flaw is rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning no user interaction and only a basic valid account are needed, though the attacker must already be authenticated to the EBS instance. No public exploit code and no CISA KEV entry have been reported at time of analysis, so the immediate threat is assessed as targeted rather than mass-exploited.
Authenticated low-privileged users with network HTTP access can fully compromise Order Management data in Oracle E-Business Suite 12.2.4 through 12.2.15, gaining unauthorized read, creation, deletion, and modification of any Order Management data reachable through the Product Diagnostic Tools component. Rated CVSS 3.1 base 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the issue needs only a valid low-privileged account, no user interaction, and no elevated privileges, so any authenticated foothold on the instance is enough; there is no availability impact and no scope change. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), though no EPSS score was provided in the source data.
In Oracle Product Hub — the product information management module of Oracle E-Business Suite — the Internal Operations component mishandles authorization, letting a low-privileged user who can reach the application over HTTP create, delete or modify critical records and read all Product Hub data they should not see. Every supported release from 12.2.3 through 12.2.15 is affected; the flaw carries a CVSS 3.1 base score of 8.1 (C:H/I:H/A:N) with no user interaction required. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle rates it 'easily exploitable' and a routine authenticated HTTP request is the only delivery mechanism needed.