A low-privileged, authenticated attacker with HTTP access to Oracle Hyperion Data Relationship Management 11.2.26.0.000 can abuse the Access and security component to gain unauthorized read of critical data and make unauthorized updates or deletions, provided a separate user is induced to interact with attacker-supplied content. The CVSS 3.1 score of 7.6 includes a scope change, meaning a successful attack can significantly impact other Oracle Hyperion components that consume DRM data. No public exploit code or confirmed active exploitation has been identified at time of analysis, and no CWE, CPE, EPSS, or KEV data was supplied with this report.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an easily exploitable flaw in its Access and Security component that lets a low-privileged, network-positioned attacker compromise the application via HTTP. Successful exploitation requires a victim user to interact with attacker-supplied content, but yields high confidentiality impact (unauthorized read of critical DRM data) plus limited integrity impact, and the scope change means other Oracle Hyperion components or integrated products may also be affected. No public exploit code, EPSS score, or CISA KEV listing was provided in the intelligence feed, so active exploitation is unconfirmed; severity is driven by the CVSS 3.1 base score of 7.6.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 exposes critical master-data through a flaw in its Access and Security component that lets a low-privileged, network-connected attacker read and partially modify data after inducing another user to interact. The CVSS 3.1 vector (7.6, AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) indicates the compromise can spill into other connected Hyperion products because of the scope change, with confidentiality impact rated high. No public exploit code or CISA KEV entry is present in the supplied intelligence, so this is currently a patch-now compliance issue rather than a confirmed active-exploitation emergency.
Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 expose an Administration component flaw that lets a low-privileged, network-connected user leverage another person's interaction to read or modify report data — including data belonging to products outside BI Publisher itself, per the CVSS scope-change metric. Oracle rates the issue 7.6 with high confidentiality impact and low integrity impact, and no availability impact. No EPSS score, CISA KEV listing or public proof-of-concept was included in the provided intelligence, so no public exploit is identified at time of analysis; remediation is via Oracle's September 2026 Critical Security Patch Update advisory.
Low-privileged attackers with network access over HTTP can compromise Oracle Sales Online in Oracle E-Business Suite releases 12.2.3 through 12.2.15, exposing critical sales data and allowing limited modification of records. Exploitation requires that a low-privileged account already be held and that a second person (not the attacker) be induced to interact with the application, yet the flaw's scope change means a successful attack can ripple into other E-Business Suite components beyond Sales Online itself. It carries a CVSS 3.1 base score of 7.6, but there is no CISA KEV listing, no public exploit code identified at time of analysis, and no EPSS score supplied in the intelligence feed.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that allows a low-privileged, authenticated attacker with HTTP network access to read critical financial data and to update, insert, or delete some of the data the application exposes, with the impact spilling over into other products (scope change). Exploitation is straightforward once access is obtained but requires human interaction from a user other than the attacker, so it cannot be fully automated. There is no public exploit identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV); EPSS data was not supplied.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Runtime Tools component that allows an attacker who already controls a high-privileged account to reach past that account's authorization boundary over HTTP, gaining unauthorized read access to critical portal data and limited ability to modify it, with a documented scope change that can affect connected products. Oracle rates it CVSS 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N) — network-reachable but gated behind strong privileges. No public exploit code and no CISA KEV listing were identified at time of analysis, so this reads as a post-compromise privilege escalation and data-exposure issue rather than a remotely exploitable pre-auth break.
Improper access control in the OIM Legacy UI component of Oracle Identity Manager (12.2.1.4.0 and 14.1.2.1.0) lets a network-positioned attacker who already holds a highly privileged account read and alter identity and provisioning data, with a scope change that can cascade into other connected Oracle products. Oracle rates it 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N), so exploitation is trivial once administrative access is obtained but is gated by that high-privilege requirement. No CISA KEV listing, public exploit code, or EPSS score was supplied with this record, so active exploitation is not confirmed (no public exploit identified at time of analysis).
Oracle Field Service, a component of Oracle E-Business Suite (Internal Operations module), is affected by an easily exploitable flaw in versions 12.2.3 through 12.2.15 that lets a low-privileged attacker with HTTP network access read critical data, modify or delete records, and partially disrupt service availability. The vulnerability carries a CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L), indicating high confidentiality impact with limited integrity and availability effects, and it does not require user interaction. No public exploit code or CISA KEV entry was present in the supplied intelligence, and there is no confirmed evidence of active exploitation at time of analysis.
Unauthenticated remote denial of service in http4s Ember's HTTP/2 stack lets any peer force the read loop to buffer up to 16 MiB per connection by declaring a frame payload far larger than the 16 KiB SETTINGS_MAX_FRAME_SIZE Ember advertises, because the declared length is only checked after the entire payload has been assembled into a contiguous buffer. With HTTP/2 enabled via .withHttp2 (not the default) and the default maxConnections of 1024, roughly 16 GiB of JVM heap is in reach, and a peer that declares the maximum 24-bit length and dribbles without ever completing the frame is buffered indefinitely with no reaction since incomplete frames never reach the validation path. The flaw is fixed in http4s 0.23.37 and 1.0.0-M48; no public exploit code or CISA KEV-listed active exploitation was identified at time of analysis, although the GHSA and the patch commit disclose the exact trigger, lowering the bar for a copy-paste DoS.
Unauthenticated remote denial-of-service in HPE Networking EdgeConnect SD-WAN Gateways, where a flaw in the appliance's underlying operating system lets a network-reachable attacker crash or stall an affected service. All four maintained branches are impacted — 9.4.0.0 through 9.4.8.2, 9.5.0.0 through 9.5.8.1, 9.6.0.0 through 9.6.3.1, and 9.7.0.0 — with CVSS 7.5 reflecting a high availability impact and no confidentiality or integrity loss. No public exploit code and no CISA KEV listing were present in the source data at time of analysis, so this is currently a patch-now availability risk rather than a confirmed active campaign.
Privilege escalation in the HPE Networking EdgeConnect SD-WAN Orchestrator API lets an attacker who already holds a low-privilege account elevate to root and run arbitrary operating-system commands on the appliance. The flaw is remotely reachable (AV:N) but requires authentication plus a high-complexity exploitation path per the assigned CVSS vector (7.5, AC:H, PR:L). No public exploit code or CISA KEV entry was present in the supplied intelligence, so this is currently a post-authentication hardening priority rather than an actively exploited zero-day.
Predictable web session tokens in Digital Watchdog VMAX A1 G4 DVR, VMAX A1 PLUS, VA1G4/VG4 Recorders and VMAX IP G4 NVR devices allow an attacker positioned on the same network segment to derive valid session identifiers and impersonate authenticated users of the device web interface. The underlying weakness (CWE-337) is a PRNG seeded with insufficient entropy, which bounds the token space to the seed space rather than to a cryptographically large keyspace. CISA's ICS-CERT published the finding as ICSA-26-258-01; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no fixed firmware version is named in the available advisory data.
Cross-tenant authorization bypass in Flowise Enterprise endpoints (all versions before 3.1.4) allows an authenticated Enterprise user to operate on resources owned by other organizations — deleting arbitrary workspaces, inviting themselves into other tenants, modifying cross-organization roles, and reading or abusing stored SSO secrets. The root cause is CWE-862 (missing authorization): affected endpoints act on caller-supplied resource identifiers without verifying tenant ownership. Rated CVSS 7.6 (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L), reachable over the network but requiring low-privileged Enterprise access; a vendor patch is available in 3.1.4, and no public exploit has been identified at time of analysis.
A crafted WebSocket frame can pin a worker thread and exhaust memory in the http4s Scala HTTP library, causing denial of service on servers built with the Ember backend. The flaw lies in WebSocket FrameTranscoder.bodyLength, which rejects extended payload lengths above Integer.MAX_VALUE but accepts negative 64-bit lengths; a remote client that completes a WebSocket handshake can send such a frame, and the decoder then returns an empty frame without advancing its input, so the decode loop spins forever while an ArrayBuffer grows without bound. Versions prior to 0.23.35 and 1.0.0-M47 are affected, and both fix releases are available; no public exploit tooling was identified at time of analysis, though the trigger frame is easily reconstructed from the public regression test added in the fix commit.
Unauthenticated remote denial of service in Oracle Helidon versions 4.0.0 through 4.5.4, specifically the helidon-webserver-static-content component, allows a network attacker to hang or repeatedly crash the server via HTTP and render the application unavailable (CVSS 3.1 base 7.5, A:H only). Oracle characterizes the flaw as easily exploitable (AV:N/AC:L/PR:N/UI:N/S:U), but no public exploit code, EPSS score, or CISA KEV listing was provided at time of analysis, so active exploitation is unconfirmed. Impact is availability-only: there is no reported confidentiality or integrity loss.
Oracle VM VirtualBox 7.2.16 can be crashed — repeatedly and remotely — by an unauthenticated attacker who can reach the product's RDP (VRDP) listener over the network, producing a complete denial of service of the virtualization platform (CVSS 3.1 base 7.5, availability-only impact). Only hosts that have the Remote Display / Extension Pack path enabled and reachable are realistically exposed, since VRDP is an optional, non-default feature. No CISA KEV listing or public exploit code was identified in the supplied intelligence at time of analysis; EPSS data was not provided, so real-world exploitation likelihood is unquantified.
Unauthenticated denial of service in Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 lets any attacker who can reach the product's SOAP interface send crafted requests that hang or repeatedly crash the service, wiping out availability of the master-data hub. Oracle rates it 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) in the Access and Security component, with no confidentiality or integrity impact. No public exploit code and no CISA KEV listing were present in the supplied intelligence, so exploitation status is unknown; the flaw is trivially automatable once patch details are reverse-engineered.
Unauthenticated attackers with network reachability to the Oracle Net listener can hang or repeatedly crash Oracle Net Services on Oracle Database Server, cutting off client connectivity to the database. The affected releases are 21.3 through 21.23 and 23.4.0 through 23.26.3, and the flaw affects availability only — confidentiality and integrity are untouched. Oracle scores it 7.5; no public exploit code, EPSS value, or CISA KEV entry was supplied with this record, so active exploitation is unconfirmed.
Unauthenticated denial of service in Oracle Net Services, the networking component bundled with Oracle Database Server, allows a remote attacker who can reach the Oracle Net listener to hang or repeatedly crash the service. Affected releases are Oracle Database 19c (19.3-19.32), 21c (21.3-21.23) and 23ai (23.4.0-23.26.3), with a CVSS 3.1 base score of 7.5 driven purely by availability impact. There is no CISA KEV listing and no public exploit code identified at time of analysis, but the attack is network-reachable, low-complexity and requires no credentials, so any database listener exposed to untrusted networks is at risk.
Unauthenticated remote attackers can repeatedly hang or crash Oracle Net Services — the TNS-based networking layer of Oracle Database Server versions 23.4.0 through 23.26.3 — by sending crafted traffic over Oracle Net, producing a complete denial of service for database connectivity. The flaw carries a CVSS 3.1 base score of 7.5 with a network, low-complexity, no-privileges, no-user-interaction vector, so it is trivially automatable once the listener is reachable. No public exploit code or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at the time of analysis.
Denial of service in Oracle Helidon versions 4.0.0 through 4.5.4 allows an unauthenticated remote attacker to hang or repeatedly crash the server by sending crafted traffic to the WebSocket component over HTTP. The flaw is rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N, availability impact only) and Oracle's own advisory text describes it as easily exploitable. No public exploit code and no CISA KEV listing appear in the supplied intelligence at time of analysis, but the zero-authentication, zero-complexity attack path and availability-only impact make this a low-skill, repeatable disruption vector for any internet-exposed Helidon deployment.
Unauthenticated remote denial of service in Oracle Helidon's helidon-webserver component (versions 4.0.0 through 4.5.4) allows any network-reachable attacker to drive the server into a hang or a repeatable crash, fully denying service. The flaw is rated CVSS 7.5 with a network vector and no authentication or user interaction required, and Oracle lists it in its Fusion Middleware security advisory, making exposure a direct function of whether the Helidon HTTP listener is reachable. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation, but the trivial attack prerequisites mean it should be treated as remotely exploitable by unsophisticated actors.
Unauthenticated HTTP/2 traffic can hang or repeatedly crash the Oracle Helidon webserver, allowing a remote attacker to take a Helidon-hosted application offline. Oracle rates it 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so the only impact is availability, but it requires no credentials and no user interaction. Affected releases are Helidon 4.0.0 through 4.5.4; no public exploit code or CISA KEV entry is present in the available data, and no EPSS score was supplied, so the current exploitation status is unconfirmed.
Unauthenticated remote denial of service in the Siebel CRM Deployment component (Server Infrastructure) of Oracle Siebel CRM affects supported releases 17.0 through 26.7, allowing any attacker with TCP network access to drive the Deployment service into a hang or frequently repeatable crash. Oracle rates the flaw CVSS 7.5 with a fully remote, low-complexity, no-privilege, no-interaction vector (AV:N/AC:L/PR:N/UI:N) but availability-only impact (C:N/I:N/A:H), meaning confidentiality and integrity of CRM data are not directly at risk. No public exploit code has been identified and the issue does not appear in CISA KEV, though Oracle's own advisory language describes it as 'easily exploitable', so exposure should be treated as urgent for internet- or WAN-reachable deployment instances.
Unauthenticated denial of service in Oracle Siebel CRM Deployment (Server Infrastructure component) affecting release levels 17.0 through 26.7. An attacker who can reach the deployment infrastructure over HTTP can send crafted requests that hang or repeatedly crash the service, producing a complete denial of service with no confidentiality or integrity impact. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied; the risk is driven by the low attack complexity and lack of required credentials rather than by observed exploitation.
Heap exhaustion in the http4s Ember backend (0.23.x before 0.23.35 and 1.0.0 milestones before 1.0.0-M47) allows a single unauthenticated HTTP/2 connection to open an unbounded number of peer-created streams because SETTINGS_MAX_CONCURRENT_STREAMS is never enforced, and each stream retains per-stream state until the JVM heap is exhausted. The same unchecked allocation is reachable on the client side through server-initiated PUSH_PROMISE frames, since enablePush is likewise not honored. Rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact) and fixed in 0.23.35 and 1.0.0-M47 via a Semaphore-gated stream handler; no active exploitation is confirmed (not in CISA KEV) and no public exploit code was identified at time of analysis.
Authenticated IBM MQ users can trigger arbitrary code execution on the application server through the Resource Adapter Installation Verification Test (IVT) application, which fails to properly validate JNDI names. The flaw affects a broad swath of IBM MQ releases: 9.1.0.0–9.1.0.37 LTS, 9.2.0.0–9.2.0.43 LTS, 9.3.0.0–9.3.0.41 LTS, 9.3.0.0–9.3.5.1 CD, 9.4.0.0–9.4.0.25 LTS, 9.4.0.0–9.4.5.1 CD, and 10.0.0.0. No public exploit code or CISA KEV entry has been identified at time of analysis, but a vendor patch is available and the CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating full confidentiality, integrity, and availability impact once the attack conditions are met.
Unauthenticated remote attackers with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can send crafted HTTP requests through the Security component to trigger a hang or repeatable crash, producing a complete denial of service of the application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact) and is rated 'easily exploitable' by Oracle. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so current risk is driven by exposure of the application rather than observed exploitation.
Unauthenticated denial of service in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 allows a remote attacker to hang or repeatedly crash the application server through crafted HTTP traffic, with no confidentiality or integrity impact. The vulnerability sits in the Ren (Real-time Event Notification) Server component, is rated CVSS 7.5 with an all-network, no-privileges, no-user-interaction vector, and is fixed in Oracle's Critical Security Patch Update (cspusep2026). No public exploit code and no CISA KEV entry were identified in the supplied intelligence at time of analysis.
Unbounded heap growth in http4s Ember's HTTP/2 read path allows a hostile peer to exhaust server or client memory and crash the JVM with an OutOfMemoryError. Any Ember server built with withHttp2 that exposes a slow-draining or non-draining route is affected, as is any Ember client consuming a response body from an untrusted server; versions before 0.23.35 and before 1.0.0-M47 are vulnerable. No public exploit code or CISA KEV listing was identified at time of analysis, but the flaw requires no authentication or user interaction and the public fix commit makes the root cause straightforward to study, so EPSS-style near-term exploitation pressure should not be dismissed.
Denial of service in the tftp-hpa in.tftpd remap engine allows a remote, unauthenticated attacker to crash the TFTP daemon with a single crafted request: when an inverse remap rule also aborts with a non-empty custom error message, invalid regex match offsets are passed into genmatchstring(), producing out-of-bounds reads and writes. The flaw affects tftp-hpa as shipped in Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, but is only reachable when the daemon is launched with a remap (map-file) configuration containing such a rule, so default installations with no remap file do not exercise the vulnerable code path. At time of analysis there was no public exploit identified and no CISA KEV listing; CVSS rates the issue 7.5 with availability-only impact.
An unauthenticated remote attacker with HTTP access to the Oracle Applications Manager component of Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical configuration and management data without supplying credentials. The flaw lives in the Command Line - RapidClone component and carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact). No public exploit code, EPSS score, or CISA KEV listing was supplied in the input, so active exploitation is unconfirmed, but the zero-privilege, zero-interaction network vector makes this a high-value target for opportunistic scanning of internet-facing EBS deployments.
Unauthenticated attackers with network access can read critical data from the Open Integration component of Oracle Siebel CRM Integration in versions 25.12 through 26.7 by sending crafted HTTP requests, because the component fails to enforce authentication on its integration interfaces. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), making it trivially automatable against any reachable deployment. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle has published a Critical Security Patch Update covering the affected releases.
Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0 contain an unauthenticated, network-reachable weakness in the BI Platform Security component that lets an attacker read critical business data, potentially everything the BI platform itself can access. Oracle scores it 7.5 with a vector of AV:N/AC:L/PR:N/UI:N and confidentiality-only impact, and the vendor's own tagging classifies it as an authentication bypass. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the source data.
Unauthenticated remote attackers can read any data reachable through the Audience component of Oracle Marketing in Oracle E-Business Suite versions 12.2.3 through 12.2.15 by sending crafted HTTP requests, with no user interaction required. The flaw is scored 7.5 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:N) and is confidentiality-only - integrity and availability of the affected module are unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS probability was supplied with the source data.
Unauthenticated attackers with HTTP network access can read critical data from Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 by exploiting an authentication bypass in the Siebel Cloud Manager component. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) with high confidentiality impact only - integrity and availability are unaffected - meaning a successful hit exposes all data reachable through the affected component. No public exploit code, EPSS score, or CISA KEV entry was supplied in the intelligence feed, so active exploitation is currently unconfirmed.
Unauthenticated attackers with HTTP network access to Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 can read data they should not be able to reach, including critical application data, via a flaw in the Runtime Tools component. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), making it trivially automatable against any internet- or intranet-exposed instance that has not applied the referenced Oracle Critical Security Patch Update. There is no public exploit code identified at time of analysis and no CISA KEV listing, so exploitation appears opportunistic rather than confirmed in the wild.
Unauthenticated attackers with HTTP network access to Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 can read data they should not be able to reach, including potentially all content and data the application can access. Oracle rates it 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), meaning no credentials, no user interaction and no special complexity are needed - only reachability to the web interface. There is no public exploit code and no CISA KEV listing at time of analysis, but the low attack requirements and high confidentiality impact make it a strong patch-now candidate for any internet-facing deployment.
Privilege escalation to full administrator equivalence in the Eventin event management plugin for WordPress allows any authenticated user who controls the user ID 1 account - regardless of their currently assigned role - to bypass every WordPress capability check and achieve remote code execution via the built-in plugin and theme editors. The flaw is rooted in PermissionManager::manage_permissions() unconditionally returning the always-true 'exist' capability primitive for all capability evaluations when the requesting user ID equals 1, granting blanket access to manage_options, edit_plugins, edit_themes, promote_users, and update_core. Exploitation is conditional on user ID 1 having been demoted to a lower-privilege role as a hardening measure; default installations where user ID 1 retains administrator rights are not impacted. No public exploit has been identified at time of analysis.
Heap-exhaustion denial of service in the http4s DigestAuth server middleware: an inverted stale-nonce comparison in NonceKeeper causes fresh nonces to be discarded while eviction halts at the first stale entry, so the nonce map grows without bound. Any application that protects at least one route with DigestAuth and runs a version prior to 0.23.35 or 1.0.0-M47 is affected, and an unauthenticated remote attacker can drive repeated 401 authentication challenges until the JVM throws OutOfMemoryError and the service collapses. CVSS 7.5 (network, no privileges, no user interaction, availability-only) makes this a straightforward resource-exhaustion attack; no public exploit code or CISA KEV entry was identified at time of analysis, but exploitation requires nothing more than a loop of unauthenticated HTTP requests.
Unauthenticated attackers with HTTP network access can bypass the security controls of Oracle Hyperion Financial Management 11.2.26.0.000, gaining unauthorized read access to critical financial consolidation data. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact) and is tagged as an authentication bypass in the product's Security component. No KEV listing, public exploit code, or EPSS score was provided in the available intelligence, so the current exploitation status is unknown and the issue should be treated as a patch-now information-disclosure risk for internet- or partner-reachable HFM deployments.
Unauthenticated remote attackers can bypass security controls in Oracle Hyperion Financial Management 11.2.26.0.000, the financial consolidation and reporting module of the Oracle Hyperion EPM suite. Because the flaw is reachable over HTTP with no credentials or user interaction, an attacker with network access to the application can read consolidation data, metadata and reports that should be restricted, resulting in a full confidentiality loss (CVSS 7.5) with no integrity or availability impact. The issue was published in an Oracle Critical Patch Update advisory; no public exploit code and no CISA KEV listing were identified at time of analysis, so real-world exploitation is assessed as targeted rather than widespread until telemetry proves otherwise.
Unauthenticated HTTP requests against Oracle Hyperion Financial Management 11.2.26.0.000 can bypass the product's Security component and expose every record the application can reach, including sensitive financial consolidation data. Oracle scores it 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning any attacker who can reach the HFM web tier needs no credentials and no user interaction — only confidentiality is impacted, with no data modification or denial of service. The supplied intelligence contains no CISA KEV listing, no EPSS score, and no public exploit code, so the current status is 'no public exploit identified at time of analysis'; real priority therefore hinges on whether the instance is network-reachable beyond a trusted segment.
Unauthenticated remote attackers can bypass authentication in Oracle Hyperion Financial Management 11.2.26.0.000 to gain unauthorized access to critical data. The flaw resides in the Security component, allowing full read access to all application data over HTTP with no user interaction or privileges required. No public exploit code or active exploitation is currently confirmed, but the high confidentiality impact and low attack complexity make it a priority for patching.
Unauthenticated remote attackers with HTTP access to Oracle Sales Offline, a module of Oracle E-Business Suite, can read any data the application exposes on affected versions 12.2.3 through 12.2.15. The flaw sits in the Internal Operations component and requires no credentials, no user interaction and no non-default configuration, yielding a 7.5 confidentiality-only CVSS base score. Exploitation is highly automatable and attractive for bulk data theft, though at the time of analysis there is no public exploit code and no confirmed exploitation (no CISA KEV listing); EPSS is not available in the supplied intelligence.
Unauthenticated remote denial of service in IBM Verify Identity Access (the current name of IBM Security Verify Access) and its container editions, where crafted incoming requests reach a handler that fails to validate resource consumption, leading to uncontrolled recursion (CWE-674) and service exhaustion. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact) means any network-reachable instance can be knocked offline without credentials, but confidentiality and integrity are unaffected. IBM has published a vendor fix; no public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided.
Full takeover of Oracle Hyperion Financial Management is achievable by a low-privileged, authenticated attacker who can reach the product's Security component over HTTP, with successful exploitation yielding complete compromise of confidentiality, integrity and availability (C:H/I:H/A:H). Only version 11.2.26.0.000 is listed as affected, and the CVSS 3.1 base score of 7.5 is capped by two meaningful limiters rather than by reduced impact: AC:H, meaning the vendor itself rates the attack 'difficult' and dependent on timing, configuration or state conditions outside the attacker's full control, and PR:L, meaning a valid low-privileged account is a hard prerequisite. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied, so the practical near-term risk is driven by the severity of the post-exploitation outcome rather than by observed threat activity.
Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 contains a flaw in its Access and Security component that allows a low-privileged, authenticated user with HTTP network access to escalate privileges and take over the application, with high impact to confidentiality, integrity and availability. The vulnerability is rated 'difficult to exploit' by Oracle (AC:H), so successful abuse requires favorable conditions rather than a single trivial request, but the payoff is full compromise of the DRM instance. No public exploit code or CISA KEV listing has been identified at time of analysis, and Oracle has published a fix in its Critical Patch Update advisory.
Oracle Banking Origination versions 14.5.0.0.0 through 14.9.0.0.0 contain a high-complexity flaw in the Onboarding Batch Processes component that lets a low-privileged, authenticated attacker reach the application over HTTP and achieve full takeover (high confidentiality, integrity and availability impact, CVSS 3.1 base 7.5). The attack vector is network-based but the vendor rates exploitation as difficult (AC:H), implying a race condition, state dependency or timing condition must be satisfied rather than a straightforward request. No public exploit code or CISA KEV listing was present in the supplied intelligence at time of analysis, so the immediate risk is driven by the severity of impact in banking environments rather than confirmed active exploitation; EPSS data was not provided.