Local, low-privileged compromise of the SQR component in Oracle PeopleSoft Enterprise PeopleTools 8.61–8.63 lets an attacker who already holds a logon to the host where PeopleTools runs take full control of the PeopleTools instance, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.8). The flaw is rated easily exploitable once host access exists (AC:L, PR:L, UI:N), but the AV:L vector means it is not remotely reachable from the network without some foothold on the target infrastructure. The provided intelligence contains no EPSS score, no CISA KEV listing and no public exploit reference, so no public exploit was identified at time of analysis, though the code-execution outcome makes this a high-value post-compromise escalation path.
Oracle Platform Security for Java (component: Centralized Thirdparty Jars) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with logon access to the host to fully compromise the component, resulting in high confidentiality, integrity, and availability impact. The flaw is locally exploitable (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) and requires only a valid low-privileged account on the infrastructure where the component executes. No public exploit code or CISA KEV listing is identified at time of analysis, and the vendor advisory is available via Oracle's Critical Patch Update.
Local privilege escalation in the Installation component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7) lets any low-privileged user who can log on to the host running Siebel CRM Deployment to fully compromise that deployment. Because the flaw is reachable through the local attack surface with no user interaction and yields complete loss of confidentiality, integrity and availability, an attacker with an otherwise ordinary account can effectively take over the CRM environment. No public exploit code or in-the-wild exploitation is identified in the available intelligence at time of analysis, and the vendor advisory from Oracle is the sole reference for affected versions and fixes.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged attacker who can log on to the host running the application take full control of the product. Successful exploitation results in complete loss of confidentiality, integrity and availability of the financial consolidation environment (CVSS 3.1 base 7.8, AV:L/PR:L). No public exploit code or CISA KEV listing was identified in the supplied intelligence, and the only reference is Oracle's Critical Security Patch Update advisory, so patch status should be confirmed against that document.
Heap memory corruption in FreeRDP's server-side static virtual channel handling (all versions before 3.31.0) allows an authenticated RDP client to send channel messages larger than the expected chunk size, triggering an integer underflow that corrupts heap memory and can overwrite live pointers, potentially yielding code execution on the RDP server. Reachability is gated on the server enabling CHANNEL_OPTION_SHOW_PROTOCOL for the channel, and on the attacker already holding a valid session, so this is a post-authentication, configuration-dependent flaw rather than a pre-auth RCE. A vendor fix is available in 3.31.0 via upstream commit 40d9202, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in pdfforge PDF Architect allows an attacker who already holds low-privileged code execution on a Windows host to hijack a library loaded by the product's activation-service (Update Service) process and run code as SYSTEM. The flaw is an uncontrolled search path element (CWE-427) in which the service resolves a DLL from a location an unprivileged user can write to, so no remote vector or user interaction is required once the foothold exists. It was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-29536 / ZDI-26-615; no public exploit code, EPSS telemetry, or CISA KEV entry is present in the supplied data.
Local attackers who already hold a logon on the host running Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can
Oracle E-Business Suite's Applications DBA component (ADPatch) contains a flaw in versions 12.2.3 through 12.2.15 that allows an attacker who already holds a logon on the host infrastructure to take over Applications DBA without presenting Oracle application credentials. Exploitation requires the attacker to persuade another person to perform some interaction (UI:R) and is scored 7.8 with full confidentiality, integrity and availability impact. No public exploit code, EPSS score, or CISA KEV entry was provided in the available intelligence, so active exploitation is unconfirmed at time of analysis.
Local privilege escalation in Oracle VM VirtualBox 7.2.16 on Windows hosts allows a low-privileged user who can log on to the machine to take full control of the hypervisor, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). Oracle's advisory rates the flaw as easily exploitable, but no public exploit code has been identified at time of analysis. The vulnerability applies only to Windows hosts, so Linux and macOS installations of the same release are not in scope according to the vendor.
A local attacker who already holds a low-privileged logon on a Windows host running Oracle VM VirtualBox 7.2.16 can fully take over the VirtualBox product through a flaw in its Core component, achieving high confidentiality, integrity and availability impact within the VirtualBox context (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). Only Windows hosts are affected per Oracle, and the vendor characterises the issue as easily exploitable with no user interaction required. No KEV listing, EPSS score or public exploit code was present in the supplied intelligence, so no public exploit is identified at time of analysis.
Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 can be taken over by a low-privileged local attacker with logon access to the host infrastructure, allowing complete compromise of the Content Server component's confidentiality, integrity, and availability. The flaw is easily exploitable given local access and a valid account, but no public exploit or active exploitation has been identified at time of analysis. This is a locally-scoped critical-impact issue, not a remote-drive-by vulnerability.
Local privilege escalation in Oracle Utilities Network Management System (NMS) allows any attacker holding a low-privileged logon on the host where the product executes to take over the affected application, with full loss of confidentiality, integrity and availability. The flaw spans the entire supported release line, from 2.4.0.1.0 through 2.4.0.1.33, 2.5.0.1.0-2.5.0.1.19, 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A and 25.12.0.0.0-25.12.0.0.3, so virtually every deployed version is affected until the Vendor-released patch per the Oracle Critical Security Patch Update is applied. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and absence of user interaction make the flaw attractive once an attacker already has a foothold on the utility server.
A local privilege-escalation flaw in the Siebel CRM Deployment component (Server Infrastructure) lets a low-privileged user who can log on to the host where Siebel CRM Deployment runs take full control of that deployment. All supported releases from 17.0 through 26.7 are affected, with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact). Oracle published the fix in its Critical Security Patch Update advisory; no public exploit code or CISA KEV entry was identified at time of analysis, so the practical threat is currently insider- or foothold-driven rather than mass-exploited.
Local privilege escalation in Oracle Siebel CRM Deployment (Server Infrastructure component) lets any low-privileged user who can log on to the host running the Deployment service take full control of that deployment. All supported releases from 17.0 through 26.7 are affected, and successful exploitation yields complete loss of confidentiality, integrity and availability of the Siebel environment (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and absence of user interaction mean any compromised service or operator account on a Siebel host is a viable stepping stone.
Privilege escalation in the Android Bootloader allows a local attacker who already holds System execution privileges to bypass an intended permission check and obtain higher-privileged code execution on affected devices. The root cause is a logic error in bootloader permission enforcement (CWE-693, protection mechanism failure) that requires no user interaction and is reachable only through local access, making it a privilege-escalation link inside a larger exploit chain rather than a standalone remote threat; the affected scope appears limited to Google Pixel devices addressed by the 2026-09-01 Pixel security bulletin. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data accompanied the available reporting.
Local privilege escalation in Google Android/Pixel devices allows an already-running non-privileged app to bypass permission checks and gain elevated privileges through a logic error in the code. Exploitation requires the attacker to have existing local code execution at User level on an unpatched device, with no user interaction needed once the malicious or compromised app is running. No public exploit code or active exploitation is identified at time of analysis, and EPSS is low at 0.13% (percentile 3%).
Local privilege escalation in the Android VPU (Video Processing Unit) component lets an attacker who already holds low-privilege code execution - such as a malicious or compromised app running on the device - bypass a missing permission check and elevate to System-level execution privileges, with no user interaction required. The flaw is assessed at CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) and was reported by Google Devices against the Pixel security bulletin, so real-world exposure centers on Pixel hardware that exposes the affected VPU subsystem rather than all devices matching the broad google:android CPE. EPSS is only 0.12% (2nd percentile) and no public exploit identified at time of analysis; impact is bounded to System privileges, not full kernel or root.
Local privilege escalation in the Pixel-specific kernel PHY power driver, specifically the gmc_phy_lp3_exit_restore_registers routine in phy_power.c, where a missing bounds check permits an out-of-bounds memory write (CWE-120). Reaching the vulnerable code path requires code already executing at Android System privilege level on an affected Pixel device, and no user interaction is needed once that context is held; per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) this is an authenticated/high-privilege local issue rather than an unprivileged-app primitive, making it most useful as a later stage in an exploit chain. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; a vendor fix is available through the September 2026 Pixel security bulletin.
Local privilege escalation in the Forge component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 allows a low-privileged user who can log on to the underlying host to fully take over the platform, with the attack scope extending to additional products. Exploitation is rated difficult (high attack complexity) and requires prior local logon, so this is primarily an insider/co-tenancy and post-compromise escalation risk rather than a remotely reachable flaw. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis; EPSS data was not supplied. Oracle released the fix as part of its Critical Patch Update advisory (cspusep2026.html), though the input does not state an exact patched build number.
Local privilege escalation in the Android kernel's fingerprint (gf) driver allows a process with access to the fingerprint device interface to corrupt kernel heap memory and gain root-level code execution. The flaw is a heap-based out-of-bounds write in gf_base_update_finger_base() within gf_base.c, exploitable with a low-privileged local context and no user interaction, consistent with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N). Fixes are delivered through the Android/Pixel Security Bulletin dated 2026-09-01; no public exploit code or CISA KEV listing was identified at time of analysis.
An out-of-bounds write in the NXP NFC hardware abstraction layer (phNxpNciHal_ext_process_nfc_init_rsp in phNxpNciHal_ext.cc) lets a local attacker corrupt memory beyond the intended buffer while the HAL processes an NFC initialization response. Affected are Android devices that ship the NXP NFC HAL, which the Android CPE lists without a version bound; the flaw requires no user interaction and, per Google's bulletin wording, no additional execution privileges, so a typical app-level foothold is enough to attempt escalation. There is no CISA KEV listing and no public exploit code reported in the supplied intelligence, so exploitation is assessed as feasible but not yet observed.
An integer overflow in the Android VPU (video processing unit) driver's size handling leads to an out-of-bounds write in kernel memory, allowing a locally installed application to escalate privileges to kernel/system level on affected Pixel devices. Exploitation requires only local low-privileged access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and no user interaction, making it attractive for a malicious or trojanized app. No public exploit code or CISA KEV listing was identified at time of analysis, and the EPSS signal is not provided; the vulnerability is addressed in the September 2026 Android/Pixel security bulletin.
An out-of-bounds write in the Goodix fingerprint trusted-application test handler (gf_ta_test_set_config in gf_ta_test.c) on Android allows a locally installed application holding low privileges to corrupt memory and escalate to kernel-level privileges without any user interaction. The flaw stems from improper validation of caller-supplied input reaching a memory-write path inside the fingerprint TA interface. Google addressed it in the Pixel security bulletin dated 2026-09-01; no public exploit code or CISA KEV entry was identified at time of analysis.
Local privilege escalation in the Android kernel's Arm SMMUv3 driver (arm-smmu-v3.c) allows an attacker holding a low-privileged local context to subvert the IOMMU's protection mechanism and reach kernel-level access on a vulnerable device. The flaw is a logic error affecting multiple functions of the driver, rated CVSS 7.8 with a local attack vector, low privileges, and no user interaction required. Google ships the fix in the September 2026 Pixel/Android security bulletin; no CISA KEV listing and no public exploit code were identified at the time of analysis.
Improper input validation in multiple locations of the Android kernel allows a locally installed application to escalate privileges on affected Pixel and Android devices, with no additional execution privileges or user interaction required. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a local attacker who already holds low-privileged code execution but can reach high-integrity kernel operations. It is addressed in the September 2026 Android/Pixel security bulletin; at time of analysis there is no CISA KEV listing, no confirmed public exploit code, and no EPSS signal was supplied with the source data.
Local privilege escalation in Google Android's VPU (Video Processing Unit) driver lets an unprivileged app trigger an out-of-bounds write through a confused-deputy path, corrupting kernel memory and gaining root-level code execution on the device. Per the CVSS vector, the attacker must already hold local code execution (PR:L) but needs no user interaction, and the September 2026 Pixel/Android Security Bulletin confirms a vendor fix. No public exploit code or CISA KEV activity has been identified at time of analysis.
Let me parse the data. CVE-2026-19407: Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1. Allows RCE and tenant-project token theft. CVSS 7.7, CVSS 4.0 vector: AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L. CWE-330 (Use of Insufficiently Random Entropy — actually CWE-330 is "Use of Insufficiently Random Values"). Bucket squatting: attacker registers a cloud storage bucket name that the SDK attempts to use (predictable/guessable name), and the SDK downloads code/artifacts from that bucket, leading to RCE. Related to insufficient randomness in bucket naming. EPSS: not provided. KEV: not provided (no). POC: not provided. Note discrepancy: Description says versions prior to 1.166.1; EUVD says "1.16.0 <1.165.1". That's a data conflict — flag in confidence_notes. Patch: Available from vendor — release notes from March 31, 2026. Affected products: Google Cloud Gemini Enterprise Agent Platform SDK for Python, versions prior to 1.166.1 (fix version 1.166.1). Prevalence: This is a specific SDK — medium/low. It's a Google Cloud SDK for an agent platform — niche enterprise. I'd say "low". Hmm. Gemini Enterprise Agent Platform SDK for Python — AI agent dev kit. Deployment footprint probably low-medium. I'll say "low" with basis "specialized Google Cloud AI agent SDK, limited deployment footprint". Actually maybe "medium" since Google Cloud + Gemini is popular. But the specific SDK for agent platform — low. I'll go with "low". Assessed CVSS vector: AT:P means attack requirements are present (attacker must pre-register the bucket name — that's an attack requirement). PR:N, UI:P (victim must run the SDK / user interaction). So my 3.1 vector: AV:N/AC:H/PR:N/UI:R/S:C? Hmm. Scope — subsequent system impact SC:L/SI:L/SA:L, so scope changed in 3.1 terms. Let's do: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. Hmm, but scope change with C:H/I:H/A:H might be too high. Actually the vulnerable system impact is H/H/H.
Heap-based buffer overflow in Ashlar-Vellum Cobalt during parsing of VS drawing files allows an attacker to execute arbitrary code in the context of the victim's process. Exploitation requires the target to open a crafted VS file (user interaction), and no authentication or server-side access is needed because the flaw sits in the file parser. No public exploit code has been identified and the issue is not listed in CISA KEV; the vendor advisory is ZDI-26-587.
A denial-of-service flaw in the RDBMS component of Oracle Database Server (versions 23.4.0 through 23.26.3) lets a low-privileged, authenticated user reach the database over Oracle Net and force a hang or repeatable crash of the instance. The CVSS 3.1 base score of 7.7 reflects network reachability, low attack complexity and a Scope Change because the outage can ripple into dependent applications layered on the database. No public exploit code or CISA KEV entry has been identified at time of analysis, so current risk is driven by the ease of the attack for anyone holding a valid database account rather than by observed exploitation.
Oracle Agile PLM 9.3.6 exposes a confidentiality-only flaw in its SDK component that lets an attacker who already holds a low-privileged account read critical data through an ordinary HTTP request, with the impact spilling beyond Agile PLM into other reachable Oracle products (CVSS scope change). Oracle rates the issue 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), noting no integrity or availability impact. No CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Authenticated, low-privileged users with network HTTP access to the Oracle Bills of Material Setup Workbench in Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Bills of Material data they are not authorized to see, including data belonging to other integrated Oracle products because the vulnerability crosses a security scope boundary (CVSS 3.1 base score 7.7, High). The weakness is confidentiality-only - there is no integrity or availability impact - and exploitation requires a valid low-privileged application account (PR:L) plus reachable HTTP access to the affected component, with no user interaction needed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied; the limiting factors are the authentication prerequisite and the read-only nature of the impact.
Let me produce the JSON. Key details: Oracle iRecruitment in Oracle E-Business Suite, versions 12.2.3-12.2.15. CVSS 7.7, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. CWE N/A. Tags: Authentication Bypass, Oracle. Reference: Oracle security alert cspusep2026.html. No EPSS, no KEV, no POC info. Note: CVSS says PR:L — low privileged authenticated. But the tag says "Authentication Bypass". Slight conflict — should note in confidence_notes/risk_assessment. Actually PR:L means attacker needs low-privileged credentials (authenticated user). The tag "Authentication Bypass" is possibly mislabeled; hmm, should I flag it? The tag "Authentication Bypass" conflicts with PR:L. But data_quality_flags should only be used for concrete verifiable issues — mislabeled tags. Hmm, "Authentication Bypass" vs PR:L... The CVSS vector is authoritative from NVD. It's arguably a conflicting tag. But the guidance says don't flag severity/CVSS disagreements... it says "Do NOT flag severity/CVSS/version disagreements here". A tag mislabel is different. Still, I'd be moderately confident. I think I'll leave the array empty, or maybe flag it? Let me think: type "mislabeled_tag" for "Authentication Bypass" — target is exact wrong value as it appears in Tags. Reason: CVSS vector indicates PR:L requiring credentials, not an auth bypass. Confidence medium. Hmm, but the tag could reflect something else (e.g., unauthorized access to data via a bypass within the app). Risky. I'll emit empty array to be safe... Actually the instruction says only emit when high confidence and clearly verifiable. I'm not high confidence. Empty array. Also "Oracle" tag is correct vendor. Missing tags? Could suggest "oracle-ebs" or "e-business-suite"? Not a standard platform tag necessarily. I'll leave empty. Prevalence: Oracle E-Business Suite is enterprise ERP widely deployed in large enterprises. "high" or "medium". EBS is widely deployed in large enterprises/government. I'd say "high" — but it's not everywhere. I'd say "medium"
Oracle Product Hub, a module of Oracle E-Business Suite (Item Catalog component), versions 12.2.3 through 12.2.15, allows an authenticated low-privileged attacker with HTTP network access to retrieve data beyond their authorized scope, including critical item and catalog data, with the compromise potentially spilling into other E-Business Suite products (scope change). Oracle rates this CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — confidentiality-only impact with no integrity or availability effect. There is no public exploit identified at time of analysis and the issue does not appear in CISA KEV, though the low attack complexity and required low privilege level keep it attractive for an insider or a compromised low-privilege ERP account.
Oracle Product Hub, the product information management component of Oracle E-Business Suite (Item Catalog module), exposes critical item data to any low-privileged authenticated user who can reach the application over HTTP in versions 12.2.3 through 12.2.15. An attacker with a valid but minimal account can send crafted requests that return data far outside their assigned responsibilities, and Oracle notes the compromise can extend into other, interconnected E-Business Suite products (scope change). Oracle rates this 7.7 with a confidentiality-only impact; no public exploit code or CISA KEV entry is available at time of analysis, so exploitation would currently require an attacker who already holds or can obtain a low-privilege account.
Oracle E-Business Suite's Product Hub module (Item Catalog component) in versions 12.2.3 through 12.2.15 exposes critical item data to any authenticated low-privileged user who can reach the application over HTTP. A successful attack grants unauthorized read access to Product Hub data and, per Oracle's scope-change assessment, can also affect other EBS products sharing the same data and session context. Only confidentiality is impacted (no integrity or availability effect), and no public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
Unauthorized access to critical data in Oracle BI Publisher 12.2.1.4.0 allows a low-privileged attacker with network reachability to the SOAP-based Web Service API to read data that should be outside their authorization. Because the flaw carries a scope change (S:C), compromised BI Publisher data can extend to other Oracle Analytics components that trust the service. No public exploit code and no CISA KEV listing were identified at time of analysis; the issue is addressed only through Oracle's Critical Patch Update cycle.
Authenticated low-privileged users of Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 can read sensitive report data they should not be able to access by sending crafted HTTP requests to the BI Platform Security component. The flaw is network-reachable, low complexity, and can pivot beyond BI Publisher itself (CVSS scope change), though it affects confidentiality only — no data modification or denial of service. No CISA KEV listing, EPSS score or public exploit code was supplied at time of analysis, and Oracle has published a Critical Security Patch Update advisory covering the fix.
Oracle Business Intelligence Enterprise Edition (Presentation Services component) fails to properly enforce access controls on its SOAP interface, allowing a user holding only a low-privileged account to read data they should never be able to reach — up to and including all BI data accessible through the platform, with a claimed spillover effect on additional products. Affected releases are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0; Oracle rates it CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), meaning confidentiality-only impact, no integrity or availability loss, and no user interaction. No public exploit code has been identified and the flaw is not listed in CISA KEV, but the barrier to entry is low once any valid BI account is obtained, so the exposure is meaningful for internet- or partner-reachable deployments.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a broken-authorization flaw in the Customer Interaction History module (Outcome-Result component) that allows a low-privileged user with HTTP access to read data well outside their intended privileges. Exploitation is trivial once an attacker holds any valid low-privileged EBS account, and Oracle's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) marks it as an easily exploitable, confidentiality-only issue whose scope change means other EBS modules can be affected. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the practical risk is driven by the enormous blast radius of an ERP holding financial, HR and customer records rather than by confirmed active exploitation.
Low-privileged users of Oracle iStore in Oracle E-Business Suite 12.2.3 through 12.2.15 can reach data they should not be able to read through the Shopping Cart component over HTTP. Successful exploitation results in unauthorized access to critical data or complete read access to everything the iStore application can reach, and because the flaw carries a scope change it can also significantly affect other E-Business Suite products. Oracle rates it CVSS 3.1 7.7 (confidentiality only, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no public exploit code and no CISA KEV entry were identified at time of analysis.
Oracle E-Business Suite Order Management (versions 12.2.5 through 12.2.15) exposes order data through its Product Diagnostic Tools component to any low-privileged user who can reach the HTTP interface. The flaw is easily exploitable — network vector, low complexity, no user interaction — and Oracle notes the impact can spread beyond Order Management into interconnected products, resulting in unauthorized access to critical data or complete access to all Order Management data. No public exploit code or CISA KEV listing was provided at time of analysis; no patch version is specified in the available references beyond the linked Oracle advisory.
Oracle E-Business Suite's Marketing module (Audience component) in versions 12.2.3 through 12.2.15 exposes critical data to any attacker holding a low-privileged, authenticated account, who can reach the vulnerable component over HTTP and read information well beyond their intended authorization boundary. Oracle scores it 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — a scope-changing, confidentiality-only flaw with no integrity or availability impact. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the immediate driver is the breadth of affected enterprise deployments rather than confirmed in-the-wild activity.
Authenticated but low-privileged users with HTTP access to Oracle WebCenter Portal can reach data well beyond their intended permissions through a flaw in the Runtime Tools component, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Oracle scores it CVSS 7.7 with a scope change, meaning the portal's compromise can ripple into additional products reachable from it, with the impact limited to confidentiality. Neither CISA KEV listing nor public exploit code has been identified at time of analysis, and no EPSS probability was supplied, though the low attack complexity and absence of user interaction make weaponization plausible.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged, authenticated attacker with HTTP network access to read data they should not be able to reach through the Portlet Services component, scoring 7.7 on CVSS 3.1 with a scope change that can extend the impact to interconnected products. Exploitation requires only a valid low-privilege account and no user interaction, but with no CISA KEV listing, no EPSS score, and no public exploit code identified in the supplied intelligence, there is currently no public exploit identified at time of analysis. The practical priority is for organizations running the two affected WebCenter Portal releases facing untrusted or multi-tenant user populations.
An authenticated, low-privileged user with HTTP access to the Oracle Agile PLM 9.3.6 Application Server can break out of their assigned access controls and read data they should never see, including records belonging to other tenants, projects, or business units — with vendor scoring putting confidentiality impact at High and noting the attack can also affect interconnected products (scope change). No integrity or availability impact is described, so this is a pure data-exposure bug rather than a code-execution or data-destruction issue. Oracle published the fix through its Critical Security Patch Update cycle referenced at oracle.com/security-alerts/cspusep2026.html; no EPSS score, CISA KEV listing, or public proof-of-concept was supplied in the available intelligence, so exploitation status is unconfirmed.
Improper access control in Oracle Proposals, a module of Oracle E-Business Suite (component: Internal Operations), lets a low-privileged, authenticated attacker reach data outside their authorization boundary over HTTP. Supported releases 12.2.3 through 12.2.15 are affected, and successful exploitation yields unauthorized read access to critical Oracle Proposals data with a scope change that can extend impact to other EBS-backed products. Oracle rates the issue 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no public exploit code or CISA KEV entry is present in the supplied intelligence, so it should be treated as an unpatched-window exposure rather than a confirmed in-the-wild campaign.
Low-privileged, network-reachable users of Oracle Field Service can read data far beyond their authorized scope in Oracle E-Business Suite releases 12.2.3 through 12.2.15, potentially reaching critical data across additional products because the flaw crosses a security scope boundary (CVSS 3.1 7.7, C:H only). The vulnerability is exploitable over HTTP with no user interaction once a low-privileged session exists, and no public exploit code or active exploitation is identified at time of analysis. Oracle has published a Critical Security Patch Update advisory covering this issue; there is no CISA KEV listing and no EPSS score was supplied in the source data.
Oracle Sales, the sales module of Oracle E-Business Suite (supported versions 12.2.3 through 12.2.15), exposes critical business data to any low-privileged authenticated user who can reach its HTTP interface. A crafted request against the Internal Operations component bypasses the intended access boundary, and because the CVSS vector carries a scope change (S:C), the exposure is not limited to Oracle Sales — data reachable through additional Oracle products can be read as well. Oracle classifies it as 'easily exploitable' (AV:N/AC:L/PR:L/UI:N, CVSS 3.1 base 7.7, confidentiality-only impact); no public exploit code, EPSS score, or CISA KEV entry was provided in the source data.
Oracle PeopleSoft Enterprise PRTL Interaction Hub 9.1 (Enterprise Portal component) permits a low-privileged user with HTTP access to the portal to read data well beyond their assigned role, exposing critical enterprise data and, because the flaw crosses a trust boundary, potentially data held in other PeopleSoft products reachable through the portal. Oracle scores it 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — confidentiality-only with a scope change — and fixed it in the 2026 Critical Patch Update. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the source data.
Missing authorization enforcement in the Core component of Oracle Enterprise Manager for Oracle Database 24.1 allows an authenticated, low-privileged attacker with HTTP access to read any data the management platform can reach, including data belonging to managed database targets, a confidentiality-only compromise that also changes scope (CVSS 3.1: 7.7). Oracle rates it easily exploitable because it needs only a valid low-privilege account and network reach to the console, and no public exploit identified at time of analysis. Oracle has published a fix in its Critical Security Patch Update advisory for the affected 24.1 release.