Oracle Siebel CRM Integration versions 23.6 through 26.7 expose the Event Publish and Subscribe component to unauthenticated attackers who can reach the server from the same network segment, allowing them to read, create, delete, or modify critical CRM data (CVSS 3.1 base 8.1, AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:N). Because the attack vector is adjacent network rather than internet-facing, exposure is gated by network topology rather than by credentials, and no public exploit code or CISA KEV entry is associated with this CVE at time of analysis. Exploitation probability scoring (EPSS) was not supplied with the source data, so prioritization should rest on asset criticality and segment reachability.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 expose the Siebel Cloud Manager component to unauthenticated attackers who can reach the host over an adjacent network segment, allowing full read and write access to critical CRM data. The flaw is rated CVSS 8.1 (AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:N) and is tagged as an authentication bypass, meaning no credentials or user interaction are required once an attacker is positioned on the same physical or logical communication segment as the affected service. There is no CISA KEV listing and no public exploit identified at time of analysis, but the low attack complexity and lack of authentication make the vulnerability highly automatable for anyone who already holds a foothold inside the hosting network or cloud subnet.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes a flaw in its Security component that allows an unauthenticated attacker positioned on the same network segment as the HFM server to read and tamper with the application's critical data. Successful exploitation yields high confidentiality and integrity impact — financial consolidation records, metadata and user data can be viewed, created, deleted or modified — while availability is unaffected. Oracle has rated it 8.1 and issued a fix in the cspusep2026 Critical Patch Update; no public exploit code or CISA KEV listing is present in the available intelligence, so active exploitation is not confirmed.
Authentication bypass in Oracle Hyperion Financial Management 11.2.26.0.000 allows an unauthenticated attacker positioned on the adjacent network segment to read, create, modify, or delete critical financial consolidation data. Oracle rates it 8.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact. No public exploit code, EPSS score, or CISA KEV listing was included in the available intelligence, so active exploitation is unconfirmed at time of analysis.
Let me synthesize. CVE-2026-91727: Incorrect reference resolution in Extensions in Chrome on Mac prior to 153.0.8010.47. Local attacker who compromised renderer process could execute arbitrary code outside sandbox via a local program. CWE-706 (Use of Incorrectly-Resolved Name or Reference). CVSS 8.1 AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. Product: Google Chrome (macOS). Product name 1-3 words: "Google Chrome". Prevalence: ubiquitous. Now fields. Summary: must not copy description; start with impact verb and product. E.g. "Sandbox escape in Google Chrome on macOS (prior to 153.0.8010.47) lets an attacker who has already compromised the renderer process escalate to code execution outside the browser sandbox..." Technical context: CWE-706 incorrect reference resolution in Extensions — extension API resolves a reference (name/path/identifier) incorrectly, allowing a local program to be loaded/executed outside sandbox. macOS-specific. Renderer compromise prerequisite. Risk assessment: CVSS 8.1 with AV:L AC:H PR:N UI:N S:C. EPSS not provided, KEV not provided. Patch available. No POC known. Attack requires renderer compromise (two-stage). S:C indicates sandbox escape crossing security scope. Not KEV → no public exploit identified at time of analysis. Note missing EPSS/KEV data explicitly. Affected products: Google Chrome on macOS versions prior to 153.0.8010.47; EUVD lists "Chrome 153.0.8010.47 <153.0.8010.47" which is malformed/likely means before 153.0.8010.47. Reference: chromereleases blog, chromium issue 516893912. Remediation: upgrade to 153.0.8010.47 or later. Chrome auto-update. macOS-specific. Compensating controls: restrict extension installs via enterprise policy, disable extensions, etc. Trade-offs. Exploit scenario: attacker chains a renderer RCE (e.g. via malicious web content) then exploits the extension reference resolution flaw to break out of sandbox and run native code on macOS host. Exploitation conditions: requires (1) macOS platform, (2) att
Improper validation of the quantity parameter in Webkul Bagisto 2.4.9's add-to-cart path lets an authenticated storefront shopper submit a manipulated quantity so the cart and resulting order total fall below the legitimate price of shippable goods, allowing them to underpay for their own orders. The independent assessment rates this as a low-integrity impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), which is materially lower than the originally published 8.1 high score (C:H/I:H/A:N), because exploitation only affects the attacker's own cart pricing, exposes no other users' data, and causes no availability loss. There is no public exploit identified at time of analysis and the issue is not confirmed as actively exploited; the practical consequence is financial loss to the merchant rather than system compromise.
An authentication bypass in OpenBMC's phosphor-net-ipmid IPMI stack lets a network attacker with no credentials complete IPMI 2.0 RAKP session authentication and obtain full BMC control. A crafted RAKP Message 1 forces the handler to return before the authentication object's constructor defaults are overwritten, so the service accepts a RAKP Message 3 whose HMAC is keyed with the hard-coded 20-byte 'userKey' derived from the string '0penBmc' combined with an often-predictable 'bmcRandomNum'. The flaw affects downstream vendors that ship phosphor-net-ipmid as their IPMI implementation, including NVIDIA and H3C, and runZero published a public advisory; no CISA KEV entry or EPSS score was supplied, and no patched version was identified in the provided data.
Authenticated server-side request forgery in CRMEB v6.0.0 lets a logged-in user coerce the server into issuing arbitrary outbound HTTP requests through the /adminapi/file/online_upload endpoint, enabling internal network reconnaissance and access to resources that are otherwise unreachable from the internet. The flaw is trivially triggered with a crafted POST request (CVSS 8.1, AV:N/AC:L/PR:L/UI:N) and requires only a valid low-privileged session on the admin API. There is no CISA KEV listing and no confirmed public exploit code at time of analysis, though a third-party advisory was published alongside the CVE.
Scheduled-job management functionality in 1024-lab SmartAdmin v3.30.0 is exposed without method-level permission checks, so any user who already holds a valid low-privileged account can reach administrator-only endpoints in AdminSmartJobController. Successful exploitation yields high confidentiality and integrity impact — job definitions and their parameters can be read, created, modified, or deleted — while availability is not directly affected per the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1). There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied, so current risk is driven by exposure of the application to authenticated non-admin users rather than by observed mass exploitation.
Oracle Advanced Benefits, a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, can be fully taken over by a high-privileged attacker who reaches the Self-Service What-if Analysis component over HTTP. The vendor-assigned CVSS 3.1 score is 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting a hard-to-exploit but high-impact flaw that can also affect additional products beyond the vulnerable component (scope change). No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS probability was supplied with the source data.
High-privileged users who can already authenticate to Oracle E-Business Suite can trigger a hard-to-reach flaw in the Bills of Material Setup Workbench component of versions 12.2.3 through 12.2.15 and take full control of that module, with the potential to pivot into other connected EBS products because of the scope change. Oracle rates the issue CVSS 3.1 base 8.0 with high confidentiality, integrity and availability impact, but exploitation is described as difficult and requires an authenticated, privileged position plus network access over HTTP. No public exploit code or confirmed active exploitation has been identified at the time of analysis, and the only reference available is Oracle's Critical Security Patch Update advisory.
Authenticated high-privilege abuse in Oracle Application Object Library (AOL) Core, the shared foundation component of Oracle E-Business Suite 12.2.3 through 12.2.15, lets an attacker who already holds elevated EBS application privileges reach a vulnerable code path over HTTP and achieve full takeover of the AOL component itself. Exploitation is rated difficult (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H, base 8.0), so success depends on conditions outside the attacker's direct control, and the high-privilege prerequisite sharply limits who can mount the attack. The offsetting aggravator is the scope change: a successful compromise can significantly impact additional integrated EBS products beyond AOL, and no public exploit code has been identified at time of analysis, so this is a genuine but hard-to-reach post-authentication risk rather than an opportunistic remote flaw.
An adjacent-network attacker holding a low-privileged Oracle E-Business Suite account can fully take over the Oracle One-to-One Fulfillment module (Documents component) in EBS releases 12.2.3 through 12.2.15, with high confidentiality, integrity and availability impact. Exploitation requires the attacker to sit on the physical communication segment serving the host where One-to-One Fulfillment runs, but needs no user interaction and no elevated privileges once there, making a single craftable request sufficient for complete compromise of the module. No public exploit code and no CISA KEV listing were present in the available intelligence at time of analysis, and no EPSS score was supplied to quantify real-world exploitation likelihood.
Command-line processing in Oracle Applications Manager, a component of Oracle E-Business Suite 12.2.3 through 12.2.15, can be abused by a high-privileged attacker with network access over HTTP to take full control of the Applications Manager host and, because of a scope change, to significantly impact other linked EBS products. Oracle's own vector (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) indicates that exploitation is difficult and requires an already-elevated account (a privileged operator, administrator, or equivalent account with access to the RapidClone command-line functionality), and no public exploit code or CISA KEV listing has been identified at time of analysis. No EPSS score was supplied with the source data, so the probability of real-world exploitation cannot be quantified from the available intelligence.
A high-severity flaw in the Internal Operations component of Oracle Spares Management, part of Oracle E-Business Suite, lets a high-privileged attacker who already holds a valid EBS account and HTTP network access take over the Spares Management module and pivot into connected products. All supported 12.2.3 through 12.2.15 releases are affected, and because the flaw is rated hard to exploit (AC:H) the window for a successful attack depends on satisfying a specific, currently undisclosed technical precondition. No CISA KEV listing, public exploit code, or EPSS score was provided, so the risk is driven by the CVSS 8.0 impact profile and the breadth of EBS deployments rather than by observed exploitation.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an attacker who already holds a low-privileged account and sits on the same adjacent network segment as the HFM server take full control of the application. Exploitation is rated AV:A/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact, and Oracle's January 2026 Security Alert (cspusep2026) is the authoritative advisory. No public exploit code has been identified and there is no CISA KEV listing at the time of analysis, so risk is concentrated in environments where untrusted parties can reach the HFM host's network segment.
Oracle Banking Branch versions 14.5.0.0.0 through 14.9.0.0.0 contain an exploitable weakness in the Reports component that lets a low-privileged, network-connected user achieve full takeover of the application, with potential knock-on impact to other connected products (scope change). Exploitation is rated 8.0 by Oracle's CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H), meaning the attacker must already hold a valid low-privilege account and must persuade a second person to perform an action, which raises attack complexity despite the high impact. No public exploit code and no CISA KEV listing were present in the supplied intelligence at time of analysis.
Oracle Banking Corporate Lending versions 14.5.0.0.0 through 14.9.0.0.0 contain an unauthenticated, hard-to-trigger flaw in the Core component that lets an attacker positioned on an adjacent network segment read and modify critical lending data, with a scope change that can extend impact to connected Oracle Financial Services products. The CVSS 3.1 base score is 8.0 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting high confidentiality and integrity impact on a non-internet-exposed attack surface. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so real-world exploitation is currently unconfirmed.
In decodeAmr of ImsMediaAudioPlayer.cpp, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.
Information tampering in Dell Wyse Management Suite (WMS) releases prior to 2605.0.3.683 is possible because the console omits a required cryptographic step (CWE-325), allowing an attacker who already holds a high-privileged WMS account to defeat integrity protections on data or artifacts the suite handles. The flaw is remotely reachable but constrained by PR:H and AC:H, making it a post-compromise or privileged-insider vector rather than an unauthenticated remote takeover. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the intelligence feed.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an unauthenticated attacker positioned on the same adjacent network segment read and tamper with critical financial consolidation data. The vendor rates it CVSS 8.0 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting a hard-to-execute but high-impact attack that can also affect connected EPM products through a scope change. No public exploit code or CISA KEV listing was identified at time of analysis, and no CWE or EPSS data accompanies the advisory.
A heap-based buffer overflow (out-of-bounds write) exists in the Android Cellular Modem component, allowing an attacker within adjacent/proximal radio range to corrupt heap memory and potentially execute code in the modem context without user interaction. The flaw carries a CVSS base score of 8.0 (AV:A/AC:L/PR:L/UI:N) and affects Google Android devices per the Android/Google Devices CPE. No public exploit code or CISA KEV listing was provided at time of analysis, so exploitation status is unconfirmed; the vendor fix is documented in the September 2026 Pixel/Android Security Bulletin.
Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 (Fusion Middleware, components Forms Services, C/S and Charmode) can be compromised by a low-privileged attacker with network access over HTTP, resulting in full read/write access to Forms-accessible data plus a partial denial of service. Exploitation is difficult (AC:H) and depends on a victim other than the attacker performing some action (UI:R), but the flaw carries a scope change, meaning a successful attack can significantly affect products beyond the vulnerable component itself. Oracle rates it CVSS 3.1 7.9; no public exploit code, KEV listing or EPSS score was present in the supplied intelligence at time of analysis.
Adjacent-network attackers can fully compromise Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 through a flaw in the product's Client Bundle component, achieving high confidentiality, integrity and availability impact plus a scope change onto connected products. The attack is unauthenticated but difficult to pull off, requiring high attack complexity and a separate user's interaction, which means it is only reachable from the physical/L2 communication segment attached to the hardware running the capture service. No public exploit code and no CISA KEV listing were identified at time of analysis, so the practical risk is bounded by the constrained attack vector rather than by the severity score alone.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 contain a flaw in the Siebel Cloud Manager component that a high-privileged attacker with a logon to the underlying infrastructure can use to read and modify critical Siebel data and, through a scope change, impact additional products. The CVSS 3.1 base score is 7.9 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), so exploitation is rated easy once the attacker already holds elevated local access — this is an insider/privileged-tenant risk rather than a remotely reachable pre-auth bug. No public exploit code and no CISA KEV entry were present in the supplied intelligence, and no EPSS data was provided, so active exploitation is not confirmed.
Heap-based buffer overflow in GIMP's file-psd import plugin allows a crafted PSD file to corrupt adjacent heap memory, causing an application crash or potentially arbitrary code execution when the user opens the file or when a thumbnail preview is generated for it. The root cause is an integer overflow (CWE-190) in the multiplication of values taken from an embedded JPEG header, which yields an undersized heap allocation that is subsequently overrun during image decoding and can be turned into a controlled memory write. The assessed vector (CVSS 3.1, 7.8 High, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms this is a local, user-interaction-dependent flaw rather than a remotely reachable service bug, so exploitation requires delivering the malicious PSD to a machine where GIMP or an automatic PSD thumbnailer processes it; no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
OriginLab Origin Viewer fails to properly validate user-supplied data while parsing OGWU files, resulting in an out-of-bounds write past the end of an allocated buffer. An attacker who convinces a victim to open a crafted OGWU file (or visit a page that loads one) can corrupt memory and execute arbitrary code in the context of the current process, with CVSS 3.0 base score 7.8 (AV:L/AC:L/PR:N/UI:R). No public exploit code or CISA KEV listing was provided in the intelligence feed, so active exploitation is not confirmed, though the local attack vector and required user interaction mean the primary risk is targeted file-delivery attacks such as email attachments or malicious downloads.
Full takeover of Oracle Business Intelligence Enterprise Edition is achievable when an attacker who already holds logon access to the host running the platform induces a different user to perform one interaction, letting them compromise the Platform Security component and gain control over confidentiality, integrity and availability. Supported releases 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 are affected; Oracle scores the issue 7.8 with a local access vector and required user interaction. No public exploit code has been identified and the flaw is not listed in CISA KEV, so practical exploitation is currently limited to parties who already have host-level access; no EPSS data was supplied with the intelligence.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can be fully taken over through a flaw in its Forge component. The vulnerability requires an attacker to already have a logon on the infrastructure hosting the product (local attack vector) but needs no privileges, and it only triggers when a person other than the attacker performs some interactive action, making it a local-vector, user-assisted code-execution class issue rated 7.8 by Oracle. Per the reference, the fix ships in Oracle's Critical Security Patch Update cspusep2026; no public exploit code and no CISA KEV listing were identified at time of analysis.
An out-of-bounds read in the App object handling of pdfforge's PDF Architect allows an attacker to execute arbitrary code in the context of the current process when a victim opens a crafted PDF or visits a malicious page. The flaw is a user-interaction-dependent memory-safety bug (CWE-125) driven by missing validation of user-supplied data, reported through the Zero Day Initiative as ZDI-CAN-28570. No public exploit code and no CISA KEV listing are present in the available intelligence, and EPSS data was not supplied, so the current risk is driven mainly by the 7.8 CVSS base score and the file-parsing attack surface rather than by observed in-the-wild activity.
Opening a crafted PDF file in pdfforge PDF Architect can drive an out-of-bounds heap write inside the application's PDF parsing logic, allowing a remote attacker to run arbitrary code in the context of the current process. Exploitation is client-side: the victim must open a malicious document or visit a page that delivers one, so an attacker must first convince the user to interact with the file. The flaw carries a CVSS 3.0 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-787) and was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-28673 / ZDI-26-612; no KEV listing or public exploit indicator was present in the supplied intelligence, so no public exploit is identified at time of analysis.
Memory corruption in the PDF parsing routine of pdfforge PDF Architect lets an attacker execute arbitrary code in the context of the current process when a victim opens a crafted PDF or loads one from a malicious page. The vendor CPE (pdfforge:pdf_architect:*) gives no version boundaries, so all released builds are presumed affected until a fixed release appears. The flaw was reported through Trend Micro's Zero Day Initiative (ZDI-CAN-28916, advisory ZDI-26-613); at time of analysis there is no CISA KEV entry and no public exploit code identified, and exploitation is gated by the requirement that a user open the malicious document.
Remote attackers can achieve arbitrary code execution by luring a user into opening a maliciously crafted PDF document in pdfforge PDF Architect, where the PDF parser writes past the end of an allocated buffer (CWE-787). Exploitation requires user interaction - the victim must open the malicious PDF or visit a page that triggers PDF rendering - but needs no prior privileges, and any resulting code runs with the privileges of the PDF Architect process. The flaw was reported through Trend Micro's Zero Day Initiative (ZDI-CAN-29219 / ZDI-26-614); no public exploit code or CISA KEV listing was present in the supplied intelligence, and no vendor fix version is confirmed in the available data.
Memory corruption in the OGM file parser of OriginLab Origin Viewer (CWE-119) lets an attacker run arbitrary code in the context of the current process when a victim opens a crafted OGM file or is lured to a page that triggers the viewer. Exploitation requires user interaction and executes with the privileges of the logged-on user rather than escalating to SYSTEM, but all three impact metrics (confidentiality, integrity, availability) are rated high, giving a CVSS 3.0 base score of 7.8. Neither public exploit code nor a CISA KEV entry was identified at the time of analysis, so exploitation is currently treated as targeted rather than widespread.
Oracle VM VirtualBox 7.2.16 (Core component) can be fully compromised by a low-privileged attacker who already has an interactive logon on the host where VirtualBox executes, allowing takeover of the VirtualBox process and, by extension, the workload it manages. The flaw carries a CVSS 3.1 base score of 7.8 with complete loss of confidentiality, integrity and availability, and is rated by Oracle as 'easily exploitable' with no user interaction required. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation requires local access rather than a remote network vector.
Oracle VM VirtualBox 7.2.16 on Windows hosts contains a flaw in the Core component that lets an attacker who already holds low-privileged interactive logon on the host machine take full control of VirtualBox itself, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8). The vulnerability is local-only (AV:L) and applies exclusively to Windows hosts — Linux and macOS installations are reported as unaffected. No public exploit code or CISA KEV listing is present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Full takeover of Oracle VM VirtualBox 7.2.16 on Windows hosts is possible for a low-privileged user who already has an interactive logon on the machine, giving complete loss of confidentiality, integrity, and availability for the VirtualBox process and the guest VMs it manages. The flaw is reached locally (AV:L) with low complexity and no user interaction beyond that initial logon (PR:L, UI:N), so it is a local privilege-escalation/containment-escape class issue rather than a remote one. At time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV; no EPSS score was supplied in the source data.
Local low-privileged users who can log on to hosts running Oracle PeopleSoft Enterprise FIN Engineering Brazil 9.1 can fully take over the affected Engineering component, with high impact to confidentiality, integrity and availability. Oracle's advisory assigns a base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the flaw is trivially exploitable once any valid low-privilege logon on the infrastructure is obtained - no user interaction and no elevated privileges are required. There is no public exploit code or CISA KEV listing identified at time of analysis, so the immediate risk is concentrated in environments where untrusted or over-privileged users share the PeopleSoft application or database host.
A locally exploitable privilege-escalation vulnerability in the Remote Diagnostic Agent component of Oracle Middleware Common Libraries and Tools (Oracle Fusion Middleware) allows any low-privileged user with a logon on the host to fully compromise the affected middleware installation. Successful exploitation results in complete loss of confidentiality, integrity, and availability — effectively a full takeover — across versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit code has been identified and the issue is not listed in CISA KEV, so risk is concentrated in multi-tenant or shared-host deployments where untrusted users already have accounts.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition (Analytics Server component) lets any low-privileged user who can log on to the host where the service runs take full control of the BI platform. Both supported branches - 8.2.0.0.0 and 26.01.0.0.0.0 - are affected, with a CVSS 3.1 base score of 7.8 reflecting complete loss of confidentiality, integrity and availability. Oracle addressed it in its Critical Patch Update (cspusep2026); no public exploit code or CISA KEV entry was identified at time of analysis.
Local privilege escalation in the Installation component of Oracle Business Intelligence Enterprise Edition lets any low-privileged user who can log on to the host running the product take full control of the BI platform, affecting versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. With complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.8), the flaw is attractive as a post-compromise escalation step, but it is not network-reachable and requires an existing OS-level account on the infrastructure. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and no EPSS data was supplied to gauge mass-exploitation likelihood.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 lets any user who already holds a low-privileged logon to the infrastructure hosting the BI server take full control of the platform, with complete loss of confidentiality, integrity and availability. The flaw sits in the FNDN (foundation) component and is rated 7.8 by Oracle, but it is a local vector (AV:L/PR:L) rather than a network-reachable bug, so exploitation requires prior host access as an ordinary user. No public exploit code or active exploitation is identified in the available data, and no EPSS score, KEV entry or CWE classification was supplied.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition (Platform Security component) lets a low-privileged user who can log on to the host running the BI software take full control of the deployment. Affected releases are 8.2.0.0.0 and 26.01.0.0.0, which receive complete confidentiality, integrity and availability impact on successful exploitation. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the practical barrier is that the attacker must already hold some form of logon/execution capability on the infrastructure where OBIEE runs.
A locally exploitable privilege-escalation flaw in the Platform Security component of Oracle Business Intelligence Enterprise Edition (Oracle Analytics) lets any user who can log on to the operating-system host running the product take full control of the BI platform. Affected supported releases are 8.2.0.0.0 and 26.01.0.0.0. With CVSS 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), the exploit is trivial once host access exists, and no public exploit code or CISA KEV listing was identified at time of analysis, so risk is concentrated in environments where untrusted or over-privileged local accounts exist on BI servers.
Local privilege escalation to full instance takeover in Oracle Business Intelligence Enterprise Edition (component: BI Search) affects versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. An attacker who can log on to the host running the BI EE service with only low-privileged credentials can exploit the BI Search component to gain complete control of the platform, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 7.8). No public exploit code or CISA KEV entry is identified in the available data, so this is treated as a patch-now hardening issue rather than an observed campaign.
A privilege-escalation flaw in the Server Infrastructure component of Oracle Siebel CRM Deployment lets an attacker who already holds a low-privileged logon on the host where Siebel Deployment runs take full control of that deployment. Affected releases span Siebel CRM 17.0 through 26.7, and the CVSS 3.1 base score is 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact). Exploitation status is currently unconfirmed: no public exploit code and no CISA KEV listing were provided at time of analysis, and Oracle does not publish PoC details with its Critical Patch Update advisories.
Local privilege escalation and full takeover in Oracle PeopleSoft Enterprise FIN Inventory Brazil 9.1, where any attacker holding a valid low-privileged logon to the host running the application can compromise confidentiality, integrity and availability of the Inventory component entirely. Because the flaw is reached via local access (AV:L, PR:L, UI:N) with low attack complexity, it is most relevant to insider threat, shared-host environments and post-compromise lateral movement on PeopleSoft infrastructure rather than to internet-facing attackers. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied.
Local privilege escalation in Oracle E-Business Suite's Applications DBA (AD Utilities) lets any attacker holding a valid low-privileged logon on the tier where AD Utilities executes take complete control of the component, with full confidentiality, integrity and availability impact on the affected schemas and utilities. Only versions 12.2.3 through 12.2.15 are affected, and exploitation requires prior host access rather than reachability over the network, so the realistic threat is an insider, a compromised application-tier service account, or a post-exploitation escalation step. No public exploit code was identified and the flaw is not listed as confirmed actively exploited (CISA KEV), so risk is driven by the value of the EBS environment and who already holds a login on that infrastructure.
Local privilege escalation in Oracle Business Intelligence Enterprise Edition (component: Machine Learning) allows a user who already holds a low-privileged operating-system account on the host running the BI system to escalate to full takeover of the BI EE platform, with complete loss of confidentiality, integrity and availability. Only versions 8.2.0.0.0 and 26.01.0.0.0 are listed as affected in Oracle's critical security patch update. Exploitation requires logon access to the infrastructure where BI EE executes, so the flaw is primarily a post-authentication, same-host escalation risk rather than an internet-facing one; no public exploit code or CISA KEV entry was identified in the supplied intelligence.
Local privilege abuse in Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 lets an attacker who already holds a low-privileged logon on the host running the connector seize full control of the connector, with high confidentiality, integrity and availability impact (CVSS 7.8). The flaw sits in the Core component of the Fusion Middleware connector and requires local logon, not