Oracle Product Hub within Oracle E-Business Suite 12.2.3 through 12.2.15 exposes an authorization weakness in the Internal Operations component that lets a low-privileged attacker with network access over HTTP read, create, modify, or delete critical Product Hub data beyond their intended privileges. The flaw carries a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning no user interaction is required but a valid low-privileged account is. No public exploit code and no CISA KEV listing were identified at time of analysis; the only authoritative source is Oracle's Critical Security Patch Update advisory (cspusep2026).
Oracle E-Business Suite's Installed Base module (Create Item Instance component) in supported versions 12.2.3 through 12.2.15 allows an authenticated but low-privileged user with HTTP access to the application to read, create, modify, or delete critical Installed Base records, yielding high confidentiality and integrity impact with no availability impact. Oracle rates this 8.1 on CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) and describes it as easily exploitable, meaning the attack path is straightforward once a valid low-privilege account and network reachability exist. There is no public exploit identified at time of analysis, and no EPSS score, CISA KEV listing, or proof-of-concept reference was supplied in the intelligence feed.
Oracle Demand Signal Repository, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, contains a flaw in its Internal Operations component that lets a low-privileged, authenticated user reach network-exposed HTTP functionality and read or alter data well beyond their intended authorization level. Successful exploitation yields high confidentiality and integrity impact - unauthorized creation, deletion, modification of, and full read access to, critical Demand Signal Repository data. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the low privileges required and network attack vector make it attractive for insider or compromised-account abuse.
Oracle Bills of Material, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an Internal Operations component that fails to properly restrict what a low-privileged authenticated user can do over HTTP. An attacker holding any valid low-privilege E-Business Suite account can send crafted HTTP requests that read all Bills of Material data and create, delete, or modify it, giving full confidentiality and integrity compromise of the module's records without any user interaction. At the time of analysis there is no CISA KEV listing, no public exploit code identified, and no EPSS score supplied, so the practical near-term risk is driven by whether the target EBS instance is internet-facing or reachable from a compromised low-privilege account.
Low-privileged users of Oracle E-Business Suite 12.2.3 through 12.2.15 can read and modify critical Financials Common Modules data by sending crafted HTTP requests to a vulnerable Common Components endpoint, with no user interaction required. Oracle scores the flaw 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact. No public exploit code or CISA KEV entry has been identified at time of analysis, although the low attack complexity and the fact that only a normal authenticated session is needed make weaponization plausible and patch urgency high.
An authentication/authorization bypass in Oracle Helidon's helidon-security-providers-idcs-mapper component (versions 3.0.0–3.2.20 and 4.0.0–4.5.4) lets a low-privileged attacker with network access over HTTP impersonate or over-privilege an identity mapped from Oracle Identity Cloud Service, gaining unauthorized read and modification access to critical application data. Oracle's advisory rates it CVSS 8.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, no availability impact). No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, but the flaw is trivially automatable against any Helidon service that enables the IDCS mapper, so internet-facing deployments should be treated as high priority.
Oracle Depot Repair, a module of Oracle E-Business Suite, exposes the Estimate and Actual Charges component to a low-privileged, authenticated attacker who can reach the application over HTTP. Because the component fails to enforce proper authorization on its data operations, a successful attack grants full read and write access to charge records that the user should never be able to see or change, giving a broad confidentiality and integrity impact across all Depot Repair data. Oracle rates this 8.1 against versions 12.2.3 through 12.2.15; no public exploit code or CISA KEV entry is associated with the issue at the time of analysis, and no EPSS score was supplied with the intelligence feed.
Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contain a flaw in the Core component that allows a low-privileged attacker with TCP network access to create, delete, or modify critical clustered data and to read all data accessible to Coherence. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) yields a base score of 8.1, reflecting complete confidentiality and integrity loss with no availability impact and no user interaction. No public exploit code and no CISA KEV entry were present in the supplied intelligence at time of analysis, so exploitation status remains unconfirmed rather than actively exploited.
Oracle BI Publisher (Oracle Analytics, BI Platform Security component) in versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 permits a low-privileged attacker with network reach to the LDAP-facing interface to read, create, delete or modify critical BI Publisher data, effectively breaking the authorization boundary between a basic account and the full reporting repository. Oracle scores this 8.1 with high confidentiality and integrity impact, low attack complexity and no user interaction, making it trivially automatable once a low-privileged credential is held. No public exploit code and no CISA KEV listing were present at time of analysis, and no EPSS score was supplied, so real-world exploitation is currently unmeasured rather than confirmed.
Low-privileged users of Oracle One-to-One Fulfillment (the Documents component of Oracle E-Business Suite 12.2.3 through 12.2.15) can read, create, delete, or modify critical fulfillment and document data over HTTP without any user interaction. Oracle assigns it a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning the attacker only needs network reachability plus a low-privileged account, not administrative rights. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the source data.
Improper authorization in the Application Framework component of Oracle CRM Technical Foundation (Oracle E-Business Suite 12.2.3–12.2.15) lets a low-privileged user with ordinary HTTP access to the instance read and alter critical CRM data that should be restricted to higher-privileged roles — integrity and confidentiality are both rated High, availability is unaffected. Oracle scores it 8.1 (AV:N/AC:L/PR:L/UI:N), meaning exploitation is straightforward but requires a valid low-privilege account rather than anonymous access. No public exploit code or active exploitation has been reported in the supplied intelligence, and no EPSS value was provided, so it should be treated as a patch-priority issue rather than an emergency.
Authenticated, low-privileged attackers with HTTP access to Oracle iStore in Oracle E-Business Suite 12.2.3 through 12.2.15 can read, create, modify, or delete critical shopping-cart, order, and customer data, giving them full read and write reach into all iStore-accessible records. The flaw sits in the Shopping Cart component and is rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning it is remotely reachable over HTTP with no user interaction and only a low-privilege account. No CISA KEV listing and no public exploit code were identified at time of analysis, so exploitation is currently presumed opportunistic rather than confirmed in the wild.
Oracle Alert, a component of Oracle E-Business Suite (12.2.3 through 12.2.15), exposes an authorization weakness in its Internal Operations component that lets a low-privileged, network-positioned attacker read and manipulate critical Alert data over HTTP. The flaw carries a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:N), reflecting high confidentiality and integrity impact with no user interaction required. No public exploit code has been identified at time of analysis, and the issue has not been confirmed as actively exploited (CISA KEV); remediation is available through Oracle's Critical Security Patch Update cycle, so patching should be prioritized for internet- or partner-facing EBS deployments.
Authenticated low-privileged users of Oracle E-Business Suite 12.2.3 through 12.2.15 can abuse the Applications Framework 'Search Bean' component to read, create, delete, or modify critical data they should not be able to touch, giving an attacker with a basic application account broad confidentiality and integrity impact across the framework. The vulnerability is remotely reachable over HTTP with low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1), so any valid low-privilege credential is effectively a stepping stone to full data compromise. There is no public exploit code and no CISA KEV listing at time of analysis, but the Oracle quarterly patch referenced in the advisory is the only reliable fix.
Unauthenticated remote attackers can obtain complete read and write access to Oracle Identity Manager's OIM Legacy UI component in supported versions 12.2.1.4.0 and 14.1.2.1.0, enabling unauthorized creation, deletion and modification of critical identity data as well as full disclosure of OIM-accessible data (CVSS 3.1 base score 8.1, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). The decisive limiting factor is the UI:R requirement: a legitimate OIM user or administrator must be induced to interact with attacker-supplied content over HTTP, which makes this a targeted social-engineering vector rather than a fully automated one, and there is no availability impact. No public exploit has been identified at time of analysis, and Oracle published the issue as part of its September 2026 Critical Patch Update, which is the authoritative remediation source; the issue is tracked in the EU as EUVD-2026-79722.
Unauthenticated network attackers can bypass authentication in the eDetailing component of the Siebel Apps - Life Sciences module shipped with Oracle Siebel CRM, affecting versions 17.0 through 26.7, and gain both read and write access to critical CRM data — provided a human other than the attacker is induced to interact with a crafted HTTP request. Oracle scores this 8.1 (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:N), reflecting full confidentiality and integrity compromise but no availability impact and only the Life Sciences vertical exposed. No public exploit code or active exploitation has been identified at time of analysis, and the vendor advisory is Oracle's September 2026 Critical Security Patch Update (cspusep2026.html).
IBM MQ versions 9.1.0.0 through 9.4.5.1 across LTS and CD streams and 10.0.0.0 are affected by a JNDI injection flaw that can lead to information disclosure or remote code execution. The issue arises from insufficient input validation before JNDI lookup (CWE-74), and according to the supplied CVSS vector it is remotely reachable without authentication (AV:N/AC:H/PR:N/UI:N), though exploitation requires the attacker to also control a network-reachable directory service and successfully resolve malicious object references in the MQ JVM. No public exploit identified at time of analysis, and CISA SSVC records exploitation as none with automatable set to no; IBM has released patches per its advisory.
Unauthenticated attackers with network access to the HTTP interface of Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to fully compromise the application, with high impact to confidentiality, integrity and availability (CVSS 8.1). Oracle rates the flaw as difficult to exploit (AC:H), meaning success depends on conditions outside the attacker's control rather than on a trivially repeatable request. No CISA KEV listing, EPSS score or public exploit code was provided in the source data, so active exploitation and weaponization are not confirmed.
Unauthenticated attackers with network reachability to the Analytics Web component of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 can exploit a hard-to-trigger flaw to fully compromise the platform, achieving high confidentiality, integrity and availability impact consistent with a complete takeover. Oracle rates this CVSS 3.1 base 8.1 with attack complexity High, meaning exploitation depends on conditions outside the attacker's direct control rather than simply sending a request. No public exploit code has been identified and the issue is not listed in CISA KEV, so measured risk is driven by exposure of the Analytics Web HTTP interface rather than by observed in-the-wild activity.
Unauthenticated network attackers can achieve complete takeover of Oracle Business Intelligence Enterprise Edition (Analytics) by exploiting a flaw in the Platform Security component of versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Oracle describes the flaw as 'difficult to exploit' but rates it 8.1 with full confidentiality, integrity and availability impact, so a successful attack means total loss of control over the BI platform and the analytical data it exposes. No EPSS score, KEV listing or public exploit code is present in the input, so there is no public exploit identified at time of analysis, though the unauthenticated network vector makes patching urgent for internet- or intranet-exposed deployments.
Unauthenticated remote attackers with HTTP access to Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware can achieve full takeover of the service by exploiting a flaw in the bundled Centralized Thirdparty Jars component. Only versions 12.2.1.4.0 and 14.1.2.0.0 are listed as affected by Oracle's advisory. The flaw carries a CVSS 3.1 base score of 8.1 with a High attack complexity rating, and no public exploit code or CISA KEV entry has been identified at time of analysis, so real-world exploitation appears opportunistic rather than widespread.
Low-privileged users with network access to Oracle E-Business Suite's Product Workbench component (Internal Operations) can read, create, modify, and delete critical business data across the full 12.2.3–12.2.15 release range. Oracle rates this 8.1 with a network-accessible, low-complexity, no-user-interaction vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning a valid but unprivileged account is enough to reach full confidentiality and integrity impact on Product Workbench data, with no availability impact. No CISA KEV listing, no public exploit code, and no EPSS score were provided in the source data, so current exploitation activity is unconfirmed — though Oracle CPU-class issues in EBS are historically targeted by attackers who already hold a foothold account.
Oracle Demand Signal Repository, a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, can be compromised by a low-privileged attacker with network access over HTTP, leading to unauthorized read, creation, deletion, or modification of the module's critical data. Oracle rates the flaw CVSS 3.1 8.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, no availability impact), meaning exploitation is straightforward but requires some level of authenticated access. There is no public exploit code identified and no CISA KEV listing at time of analysis; the vulnerability is addressed through Oracle's Critical Security Patch Update process referenced in the advisory.
Oracle E-Business Suite 12.2.3 through 12.2.15 ships a Demand Signal Repository module whose Internal Operations component fails to enforce proper authorization, letting any holder of a low-privileged account read, create, modify, or delete critical records through ordinary HTTP requests. Oracle's CVSS 8.1 rating reflects full confidentiality and integrity impact with no availability impact, and the flaw is rated easily exploitable because it needs only network reachability, no user interaction, and a low-privileged login. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so exploitation is currently a patch-window problem rather than a confirmed active campaign.
Improper authorization control in the Oracle Project Intelligence module of Oracle E-Business Suite allows a low-privileged authenticated user with network access to read, create, modify, or delete data across the module, including records the account should never reach. Affected releases are 12.2.3 through 12.2.15; the vendor's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N, base 8.1) indicates the flaw is trivially automatable once credentials exist, because no user interaction is needed. No public exploit code, KEV listing, or EPSS estimate was supplied with the available intelligence, so active exploitation should be treated as unconfirmed rather than assumed.
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware, Client Bundle component) can be abused by a high-privileged, network-positioned attacker who convinces a second user to interact with a crafted HTTP request, yielding read, creation, modification, and deletion access to critical capture data. Because the CVSS vector carries a scope change (S:C), the impact is not confined to Enterprise Capture itself and can extend to other Fusion Middleware components reachable from the affected deployment. There is no indication of public exploit code or confirmed active exploitation, and no EPSS score was supplied with the source data, so the practical urgency rests mainly on the 8.1 severity, the scope change, and the sensitivity of captured document data.
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 expose the ADF Shared Components to low-privileged attackers who can reach the product over HTTP, allowing unauthorized creation, deletion, or modification of critical data and repeatable crashes that produce a complete denial of service. Rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N, integrity and availability high, confidentiality none), it is trivially automatable once any valid low-privileged account exists, but no public exploit code and no CISA KEV entry have been identified at time of analysis and no EPSS score was supplied with the source data. Because JDeveloper is a developer IDE rather than an internet-facing production service, real-world exposure is largely confined to development and build environments where the integrated ADF/WebLogic runtime is reachable on the network.
Oracle E-Business Suite deployments running Oracle Purchasing 12.2.3 through 12.2.15 expose a flaw in which any authenticated low-privileged user can reach a Purchasing web endpoint over HTTP and read, create, modify, or delete critical procurement data they should not be able to touch. With a CVSS 3.1 base of 8.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, no availability impact), the issue is trivial to trigger once a valid EBS account exists, and Oracle treats it as critical in its September 2026 Critical Security Patch Update. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so this reads as a broadly-applicable, low-complexity authorization defect that requires an account rather than as an actively exploited campaign.
Unauthenticated attackers with network reach to the Mobile Application Server of Oracle E-Business Suite can fully take over the MWA Terminal Server component in supported 12.2.3 through 12.2.15 releases, gaining high impact across confidentiality, integrity and availability. Exploitation is rated high-complexity (AC:H) but requires no credentials and no user interaction, and Oracle scores it 8.1. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided, so the current real-world exploitation picture is unconfirmed.
Unauthenticated database takeover is possible in Oracle Database Server RDBMS releases 23.4.0 through 23.26.3 via crafted traffic sent to the Oracle Net listener. Per the Oracle-supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), an attacker with network reachability can fully compromise confidentiality, integrity and availability of the RDBMS without credentials or user interaction, though Oracle characterizes the flaw as 'difficult to exploit' (AC:H). There is no public exploit code and no CISA KEV listing at time of analysis, so this is a patch-now enterprise hygiene issue rather than a confirmed active campaign.
Unauthenticated remote takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is possible through the Forge component, which an attacker reachable over HTTP can abuse to gain full control of the platform (confidentiality, integrity and availability all rated High). Oracle scores it 8.1 with a High attack complexity, meaning the attack is feasible but requires favorable timing or a specific internal state rather than a trivial one-shot request. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is currently a patch-now risk rather than an observed campaign.
Unauthenticated network attackers can achieve full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 through the Forge component, causing complete loss of confidentiality, integrity and availability of the platform. Oracle's own rating (CVSS 8.1, AV:N/AC:H/PR:N/UI:N) concedes the flaw is 'difficult to exploit', meaning a non-trivial timing or state precondition must be satisfied before the crafted TCP traffic succeeds, which materially lowers real-world urgency versus a typical 8.1. Exploitation status at time of analysis: no public exploit identified — there is no CISA KEV listing and no POC reference in the supplied intelligence, and no EPSS score was provided to quantify likelihood.
Full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by an unauthenticated remote attacker who can reach the Forge component over TCP, with successful exploitation yielding complete confidentiality, integrity, and availability impact (C:H/I:H/A:H) per Oracle's advisory and the corroborating ENISA EUVD-2026-79606 record. Oracle explicitly characterises the flaw as 'Difficult to exploit' (CVSS AC:H), meaning a condition outside the attacker's direct control - such as a timing window, race condition, or a specific data-processing state - must be satisfied before exploitation becomes reliable, so mass opportunistic scanning is unlikely. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the source data; practical exposure is bounded to installations where Forge is network-reachable, which for most deployments is an internal data-pipeline interface rather than an internet-facing default service.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 contains a vulnerability in the Forge component that lets an unauthenticated attacker reachable over HTTP take over the affected instance, with full confidentiality, integrity, and availability impact. Oracle rates the flaw 8.1 but notes it is difficult to exploit (AC:H), which suggests a race condition, timing dependency, or narrow parsing precondition rather than a straightforward request-and-execute path. No public exploit code has been identified and the issue is not listed in CISA KEV, so current exposure is driven by the value of an internet-facing commerce platform rather than by observed mass exploitation.
Unauthenticated remote attackers can achieve full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 by exploiting a difficult-to-trigger flaw in the Forge component that is reachable over HTTP. Oracle rates the issue CVSS 8.1 (AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity and availability impact) while explicitly describing it as hard to exploit. No public exploit code or CISA KEV entry has been identified, and no EPSS score was supplied with the advisory data, so active exploitation is not evidenced at time of analysis.
Oracle Siebel CRM End User (Open UI component) versions 17.0 through 26.7 can be taken over by an unauthenticated, network-positioned attacker who reaches the Open UI HTTP interface, and who manages to satisfy the high-complexity conditions of the flaw. Oracle's own CVSS 3.1 rating is 8.1 with high confidentiality, integrity and availability impact, reflecting full application compromise rather than a narrow data leak. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, so the practical urgency stems from the breadth of the affected version range and the criticality of CRM data rather than from observed attacks.
Unauthenticated remote attackers able to reach the Oracle Forms Services HTTP listener can fully compromise Oracle Forms deployments in Oracle Fusion Middleware 12.2.1.19.0 and 14.1.2.0.0, gaining complete control of confidentiality, integrity and availability of the affected service (CVSS 3.1 8.1, AV:N/AC:H/PR:N/UI:N). The flaw resides in the Forms Services, C/S and Charmode component set and is described by Oracle as difficult to exploit, meaning success depends on specific timing or state conditions rather than a trivial one-shot request. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the current exploitation signal is theoretical rather than confirmed in the wild.
Unauthenticated network attackers can achieve full takeover of Oracle Access Manager via a difficult-to-trigger flaw in the Authentication Engine component of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this CVSS 3.1 8.1 with High confidentiality, integrity, and availability impact from a network vector requiring no privileges or user interaction, meaning the identity service itself — and the applications it protects — can be fully compromised. No public exploit code and no CISA KEV entry were identified at time of analysis; the AC:H rating indicates the attack requires precise timing or a specific non-default state rather than a trivial repeatable request.
Unauthorized creation, deletion, modification, and disclosure of data in Oracle Purchasing (Oracle E-Business Suite 12.2.10 through 12.2.15) is possible for an attacker who holds a valid low-privilege EBS account and can reach the G-Invoicing component over HTTP; the CVSS 3.1 base score is 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting full loss of confidentiality and integrity with no availability impact. The assessment vector confirms the attacker must be authenticated with only low privileges (PR:L) and that no user interaction is required (UI:N), so the public 'Authentication Bypass' tag overstates reachability - this is not accessible to fully unauthenticated actors. There is no KEV listing and no public exploit identified at time of analysis, and the practical target population is narrowed by the requirement that the G-Invoicing module (a U.S. federal intragovernmental buy/sell invoicing feature) actually be in use, which skews exposure toward government and federal-contractor deployments.
Oracle E-Business Suite 12.2.11 through 12.2.15 ships a flaw in the G-Invoicing component of Oracle Purchasing that lets an authenticated, low-privileged user reach data and functions they should not control over plain HTTP. Successful exploitation gives full read and write reach into Purchasing data — creation, modification, and deletion of critical records plus complete disclosure of everything the module can access — with no user interaction required. Oracle rates it CVSS 8.1 (C:H/I:H/A:N, PR:L), but no EPSS score, CISA KEV entry, or public exploit code was present in the supplied intelligence, so active exploitation is unconfirmed and the practical risk is best judged against the wide enterprise footprint of EBS Purchasing.
Oracle HRMS (India), a localized module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an Internal Operations component that fails to properly enforce authorization, letting a low-privileged authenticated user reach data and functions they should not control. A successful attack gives the attacker the ability to create, delete, or modify critical HR data and to read the full set of HRMS (India) records, with CVSS 3.1 scoring it 8.1 (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N) — high confidentiality and integrity impact but no availability impact. There is no public exploit code or CISA KEV listing at time of analysis, so this is a patch-cycle priority rather than a confirmed in-the-wild emergency.
Low-privileged Oracle E-Business Suite accounts can read and modify all Bills of Material data by reaching the Internal Operations component of Oracle Bills of Material over HTTP in versions 12.2.3 through 12.2.15 (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The flaw is rated easily exploitable, but it is not pre-authentication: an attacker must first hold a valid low-privileged EBS account, which is the primary limiting factor, and no user interaction or elevated privileges are needed. Impact is confined to confidentiality and integrity - creation, deletion, modification and disclosure of Bills of Material-accessible data - with availability unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged attacker with HTTP access to the application read, create, delete, or alter critical financial consolidation data. Oracle rates it 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning exploitation requires a valid but low-privileged account and no user interaction, but yields both high confidentiality and high integrity impact. No public exploit code or CISA KEV listing is identified in the supplied intelligence, so this is currently a patch-priority issue rather than a confirmed active campaign, though the affected data set is exactly the kind of high-value financial record attackers target.
Oracle Work in Process, a module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), exposes a flaw in its Workbenches component that lets an unauthenticated attacker on an adjacent network segment read and modify critical data without any credentials or user interaction. Per the vendor's advisory the issue is 'easily exploitable,' so anyone with a presence on the same physical communication segment as the Oracle WIP application server can tamper with or extract manufacturing/Work-in-Process records. No CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence, so confirmed active exploitation cannot be asserted at this time.
Oracle Product Workbench, a module within Oracle E-Business Suite, permits a low-privileged attacker who already holds a valid account and HTTP network access to read, create, delete, or modify critical business data across the module's Internal Operations component, affecting supported releases 12.2.3 through 12.2.15. With CVSS 8.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, no availability impact), exploitation requires only an authenticated session rather than user interaction or a race condition. No public exploit code, POC, or CISA KEV entry has been identified at time of analysis, and no EPSS score was supplied, so the current risk is driven by the low skill barrier and the sensitivity of ERP data rather than confirmed active exploitation.
IBM MQ message queueing middleware fails to properly restrict XML external entity resolution while processing MQRFH2 message headers, letting an authenticated queue user read server-side files or resources and drive the broker and its Java clients into a denial-of-service state. Affected releases span the 9.1.x, 9.2.x, 9.3.x and 9.4.x LTS/CD streams plus 10.0.0.0 Classes for Java, so any environment running the JMS/XMS or Java messaging client against a current broker is in scope. IBM has published a vendor fix and there is no public exploit code or CISA KEV entry identified at time of analysis, but the confidentiality and availability impact are both rated High (CVSS 8.1, AV:N/AC:L/PR:L/UI:N).
Unauthenticated attackers positioned on the same network segment as an Oracle Hyperion Financial Management 11.2.26.0.000 server can exploit a flaw in the product's Security component to modify or destroy critical financial data and to crash the application repeatedly. Oracle rates this at CVSS 3.1 base 8.1 with integrity and availability impact but no confidentiality impact, and the restricted AV:A vector means the attacker must already sit on the physical communication segment attached to the host rather than reaching it over the internet. No public exploit code has been identified and the issue is not listed in CISA KEV, so current risk is concentrated in environments where flat layer-2 networks expose EPM servers to semi-trusted users or adjacent compromised hosts.
Oracle GraalVM 25.0.4.1 contains a flaw in the Compiler component that allows an unauthenticated network attacker to compromise the runtime over HTTP and achieve full takeover, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.1, AV:N/AC:H/PR:N/UI:N). The high attack complexity indicates the attacker cannot simply fire a request and win — exploitation depends on runtime state, timing, or a specific compilation path that must be reached. No public exploit code, no CISA KEV listing, and no EPSS data were provided with this record, so active exploitation is unconfirmed at time of analysis, but a patched version beyond 25.0.4.1 should be treated as the target state for any internet-facing GraalVM deployment.
Oracle GraalVM 25.0.4.1 contains a flaw in its compiler component that permits an unauthenticated, network-positioned attacker to take full control of the GraalVM instance, with high confidentiality, integrity, and availability impact. Oracle rates it 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and explicitly calls it 'difficult to exploit', implying exploitation depends on precise
Full takeover of Oracle GraalVM 25.0.4.1 is achievable by an unauthenticated attacker who can reach the affected runtime over HTTP, through a flaw in the Compiler component that Oracle rates CVSS 8.1 with high confidentiality, integrity and availability impact. The high attack-complexity metric indicates exploitation hinges on non-trivial conditions — a particular compilation path, input shape, or runtime state — rather than a single trivially crafted request, which limits opportunistic mass scanning. No public exploit code and no CISA KEV listing are associated with this CVE at time of analysis, and no EPSS score was supplied with the source data.