A hard-to-exploit local vulnerability in Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 (Oracle Analytics, Platform Security component) lets a low-privileged user who can already log on to the host running the platform take full control of the BI service, with knock-on impact to connected products because the vulnerable component operates with changed scope. The attacker must additionally induce a separate legitimate user to perform an action (UI:R) and clear a high attack-complexity bar (AC:H), so exploitation is neither trivial nor remote. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis; Oracle shipped the fix in its Critical Security Patch Update advisory (cspusep2026).
Broken access control in the tts-be timetable backend (all versions prior to 2.1.0) lets unauthenticated remote attackers chain several public API endpoints - including /api/student/{id}/photo and /api/course_unit/{id}/exchange/metadata - and abuse the server as an open proxy against upstream university systems. The result is enumeration and extraction of student PII such as full names, student IDs, class schedules and photographs, with no authentication or user interaction required. The flaw is rated CVSS 7.5 with high confidentiality impact only; the vendor advisory confirms a fix in 2.1.0, and no public exploit code or CISA KEV listing was identified at time of analysis.
Unbounded memory consumption in the web_url_read tool of mcp-searxng before 1.7.1 lets a remote unauthenticated client exhaust the MCP server process by pointing it at an HTTP endpoint that omits (or understates) the Content-Length header. The 5 MiB URL_READ_MAX_CONTENT_LENGTH_BYTES guard is implemented as a HEAD preflight only, so when the header is absent the check short-circuits to false and the full response body is loaded via response.text() and then converted to Markdown, driving both memory and CPU usage toward exhaustion. Exploit code and a Docker-based proof of concept are published in the vendor's GHSA advisory, and the flaw is fixed in 1.7.1; CISA KEV listing and EPSS scoring are not present in the supplied data.
Prolink's 13A Smart Plug (model DS-3202M-UKv3) paired with the mEzee 2.6.7 mobile app mishandles packets received during the Wi-Fi provisioning phase, letting an attacker within radio range crash the plug or redirect it to connect to an attacker-controlled device instead of the legitimate access point. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only per the published vector), while the practical attack surface is narrower because it exists only while the plug is actively being set up. Exploitation status at time of analysis: no public exploit identified at time of analysis, though a public GitHub repository ('crossprobe') is linked in the CVE record and appears to be proof-of-concept research tooling; the CVE is not listed in CISA KEV and no EPSS score was supplied.
Oracle Hyperion Data Relationship Management (DRM) version 11.2.26.0.000 contains a hard-to-exploit flaw in the product's Access and Security component that lets an unauthenticated attacker reachable over TCP create, delete or modify critical master data and read the full contents of the application. CVSS 3.1 scores it 7.4 with Confidentiality and Integrity both High, but only because no public exploit code and no CISA KEV entry exist does this remain an integrity-focused patching priority rather than an emergency. There is no public exploit identified at time of analysis and no EPSS score was supplied.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a flaw in the Core component of the Application Object Library that allows a remote, unauthenticated attacker with HTTP access to bypass authentication and gain unauthorized read and write access to critical application data. Oracle rates the issue 7.4 with a high attack complexity, reflecting that exploitation is possible over the network without credentials but requires conditions an attacker must engineer or discover. No public exploit code has been identified and the issue is not listed in CISA KEV, so at time of analysis this is a patch-now, high-impact confidentiality and integrity risk rather than a confirmed active campaign.
Unauthenticated network attackers can reach Oracle Forms Services (including the C/S and Charmode components) over HTTP and achieve unauthorized access to, or modification and deletion of, critical data held in the application, in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0. Oracle rates the issue 7.4 with high confidentiality and integrity impact but explicitly characterizes it as difficult to exploit (AC:H), meaning a favorable timing or state condition is required rather than simple request replay. At the time of analysis there is no confirmed CISA KEV listing and no public exploit code identified; exploitability details remain largely undisclosed by the vendor.
Hyperion Financial Management 11.2.26.0.000 can be compromised by an unauthenticated attacker who can reach the product's SSH service, resulting in unauthorized reading, creation, deletion, or modification of the financial data the application manages. Oracle scores this CVSS 7.4 (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:N), pairing high confidentiality and integrity impact with a stated difficulty of exploitation. No public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so exposure should be judged from network reachability of SSH rather than from confirmed in-the-wild activity.
Unauthenticated attackers who can reach the Oracle Hyperion Financial Management 11.2.26.0.000 web interface over HTTP can bypass the product's security controls and gain unauthorized read and write access to financial consolidation data, although Oracle rates the attack as difficult to execute (AC:H). The vendor addressed the flaw in its Critical Security Patch Update advisory, and no public exploit code or CISA KEV entry was identified at time of analysis. EPSS data was not supplied in the available intelligence, so real-world exploitation likelihood cannot be quantified from these sources.
Oracle Hyperion Financial Management 11.2.26.0.000 (component: Security) can be compromised by an unauthenticated attacker who reaches the product over the network via TLS, resulting in unauthorized read, creation, modification and deletion of critical consolidation data. The vendor rates this 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), with the high attack-complexity metric reflecting a flaw that is difficult to trigger reliably rather than a trivial path. Security tagging points to an authentication-bypass condition in the Security component; no public exploit code or CISA KEV entry was available at time of analysis, and no EPSS data was supplied.
Unauthenticated network attackers can exploit a hard-to-trigger flaw in the Web Services Security component of Oracle Web Services Manager 12.2.1.4.0 and 14.1.2.0.0 to read all data the service can access and to repeatedly hang or crash it. Oracle rates the issue 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H), reflecting high confidentiality and availability impact offset by high attack complexity and no integrity impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and no CWE classification was supplied.
Oracle Hyperion Data Relationship Management 11.2.26.0.000 contains an authentication bypass in the Access and Security component that can be reached over the network through SMTP, allowing an unauthenticated attacker to create, delete, or modify critical data and to read the entirety of the application's accessible data. Oracle's security alert rates it 7.4 with high confidentiality and integrity impact but high attack complexity, indicating the exploit path is non-trivial even though no credentials or user interaction are required. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the vendor-published advisory and the absence of any availability impact make this a targeted-tampering risk for finance and master-data teams rather than a broad worm-style threat.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 contain an authentication-related flaw that lets a remote, unauthenticated attacker over HTTP read, create, delete, or modify critical deployment data - CVSS 3.1 base 7.4 with high confidentiality and integrity impact. Exploitation is rated difficult (AC:H), presumably because the attacker must meet a hard-to-satisfy protocol or timing condition, but no privileges or user interaction are required if that condition is met. Oracle has published a fix via its Critical Security Patch Update advisory; active exploitation is not confirmed and no public exploit code was identified in the supplied intelligence.
Unauthenticated attackers able to reach the HTTPS interface of Oracle E-Business Suite 12.2.3 through 12.2.15 can exploit a difficult-to-trigger flaw in the Oracle Application Object Library (Core component) to create, delete, or modify critical data and to read data they should never see. The CVSS 3.1 base score is 7.4 (AV:N/AC:H/PR:N/UI:N, high confidentiality and integrity impact, no availability impact), meaning no credentials or user interaction are needed but successful exploitation depends on conditions the attacker must satisfy. No public exploit code has been identified and the flaw is not listed in CISA KEV, so it should be treated as a high-severity patch obligation rather than an actively exploited emergency.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a hard-to-trigger but unauthenticated network flaw in its Security component that lets an attacker reaching the TLS-exposed service read, create, modify or delete any financial consolidation data the application can access. CVSS 3.1 scores it 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting complete confidentiality and integrity loss with no availability impact, and Oracle explicitly characterises exploitation as difficult. No public exploit code, EPSS score, or CISA KEV entry was provided at time of analysis, so this should be treated as a patch-now integrity risk to financial reporting data rather than an actively exploited incident.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a hard-to-exploit but unauthenticated security flaw reachable over HTTP through the product's Security component, allowing an attacker to read and tamper with financial consolidation data. The CVSS 3.1 score is 7.4 (AV:N/AC:H/PR:N/UI:N, high confidentiality and integrity impact, no availability impact), and Oracle's tag for the issue points to an authentication bypass. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so it is a patching priority rather than a confirmed active threat.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes a Security-component flaw that lets an unauthenticated remote attacker with network access create, delete, or modify critical financial consolidation data and read the full contents of the application's accessible data set. Exploitation is rated difficult (CVSS 3.1 7.4, AV:N/AC:H/PR:N/UI:N), implying a timing-, state-, or query-construction dependency rather than a one-shot request. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV, but the confidentiality and integrity impact is total for exposed deployments, so the Oracle Critical Security Patch Update referenced by the vendor should be treated as mandatory.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a security flaw in its Security component that lets an unauthenticated attacker reachable over HTTP bypass access controls and gain both read and write access to the application's critical financial data. Oracle rates it 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), with the high attack-complexity metric indicating that some non-trivial precondition must be met before the bypass succeeds. There is no public exploit code or CISA KEV listing in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at time of analysis.
Account takeover of non-superuser accounts is possible in Concrete CMS 9.2.0 through 9.5.2 because the REST API user write endpoints (PUT /ccm/api/1.0/users/{uID} and POST /ccm/api/1.0/users/{uID}/change_password) fail to enforce per-field edit_user_properties permissions. An attacker holding an OAuth token scoped for updates and permission to edit only one non-sensitive field on another user can rewrite that user's password, username, email, and attributes, fully seizing the account; superuser accounts are explicitly out of reach. There is no public exploit identified and no CISA KEV listing at time of analysis, so this currently represents a targeted, credential-gated authorization defect rather than a mass-exploitation event. Concrete CMS rated it CVSS v4.0 7.4 (CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N).
Incorrect authorization in Chrome's Core component on Windows (versions prior to 153.0.8010.47) lets a local attacker who can run a program on the machine break out of the browser sandbox and execute arbitrary code at the user's privilege level outside it. The flaw is rated High by the Chromium security team and carries CVSS 7.4 (AV:L/AC:H/PR:N/UI:N, C/I/A all High), reflecting a local-only but complete confidentiality, integrity and availability impact once the sandbox boundary is crossed. No public exploit code or CISA KEV listing was provided in the input, and Google has released a fixed stable-channel build, so this is best treated as a high-value chaining primitive rather than a currently mass-exploited issue.
Authenticated attackers holding administrative access to the management plane of HPE Networking EdgeConnect SD-WAN Gateways can supply crafted input to an affected component and achieve arbitrary command execution as root. The flaw affects multiple released trains — 9.4.x up to 9.4.8.2, 9.5.x up to 9.5.8.1, 9.6.x up to 9.6.3.1, and 9.7.0.0 — with a CVSS base score of 7.2 reflecting the high privilege prerequisite against total loss of confidentiality, integrity, and availability. There is no CISA KEV entry, no EPSS score, and no public exploit code identified at time of analysis, so this is currently a high-impact but credential-gated risk rather than an actively exploited one.
Authenticated attackers who already hold administrative privileges on HPE Aruba EdgeConnect SD-WAN Gateways can supply specially crafted configuration data that overflows a stack buffer in the configuration processing logic, potentially yielding remote code execution as root or crashing the gateway into a denial of service. The flaw affects gateway releases in the 9.4.x (≤9.4.8.2), 9.5.x (≤9.5.8.1), 9.6.x (≤9.6.3.1) and 9.7.0.0 branches per the ENISA EUVD affected-version list, and carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). No public exploit code, CISA KEV listing or EPSS score was included in the supplied intelligence, so the observed exploitation status is unconfirmed at time of analysis.
Authenticated users with access to the same physical communication segment as the server can abuse the Engineering Communication Interface in Oracle Agile Engineering Data Management 6.2.1 to bypass intended access controls and read or alter application data, producing high confidentiality and integrity impact. The vulnerability is rated CVSS 3.1 7.3 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning an attacker must already hold low-privileged credentials and be positioned on the adjacent network segment rather than reaching the service over the internet, and no user interaction is required on the victim's part. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so this is a moderate, tightly constrained risk that becomes serious only for organizations exposing the Engineering Communication Interface to shared or untrusted local segments.
Stored cross-site scripting in Concrete CMS 9.0.0 through 9.5.2 lets an authenticated user who holds the Add Group Folder permission save a JavaScript payload as a group folder name, which the Members > Groups dashboard then renders as live markup without output encoding. When an administrator opens that dashboard page, the injected script executes in the administrator's session, enabling session and token theft plus any action the administrator can perform. The vendor assigned CVSS v4.0 7.3 (AV:N/AC:L/AT:P/PR:H/UI:P); no CISA KEV listing or public exploit code was identified in the provided data, and no EPSS score was supplied.
Oracle Common Applications, a shared framework component of Oracle E-Business Suite (CRM User Management Framework), fails to properly restrict actions for low-privileged users in versions 12.2.3 through 12.2.15, allowing them to create, delete, or modify critical CRM data and read data they should not access. Exploitation is network-based over HTTP with low complexity, but requires the attacker to already hold a valid low-privileged account and to persuade another user to interact with a crafted request (CVSS 7.3, AV:N/AC:L/PR:L/UI:R). No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score was provided in the source data.
A buffer overflow in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways allows an attacker who already holds high-privilege API credentials to execute arbitrary commands as a privileged operating-system user on the gateway appliance. Affected releases span the 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 branches, per ENISA EUVD version ranges. The CVSS 3.1 vector requires PR:H, meaning exploitation is not unauthenticated; no public exploit was identified at time of analysis, and the issue is not listed in CISA KEV.
Improper handling of chart content in the Charting component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a low-privileged, authenticated attacker read and modify critical application data after inducing another user to interact with a crafted HTTP request. Successful exploitation yields high confidentiality and integrity impact across all data the victim's session can reach, though availability is unaffected. No public exploit code has been identified at time of analysis, no CISA KEV listing is present in the supplied data, and no EPSS score was provided.
Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 is vulnerable to an unauthenticated, network-reachable flaw in its Access and Security component that lets an attacker read sensitive data, modify or delete records, and partially disrupt service availability via crafted HTTP requests. The CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N) indicates trivially exploitable remote access with no credentials or user interaction, though the confidentiality, integrity and availability impacts are each rated Low rather than total compromise. No public exploit code or CISA KEV listing was present in the provided intelligence at time of analysis, so exploitation status is best characterized as no public exploit identified at time of analysis.
Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 exposes an unauthenticated, network-reachable HTTP flaw that lets an attacker read and modify a subset of application data and degrade service availability, rated CVSS 7.3. Because the vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed - only reachability to the affected Experience Manager component. No public exploit code or CISA KEV entry was identified at time of analysis, so this should be treated as a high-severity patch-now item rather than a confirmed active campaign.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 contains an easily exploitable flaw that lets a low-privileged attacker positioned on the physical communication segment adjacent to the Siebel Deployment host read critical data and repeatedly crash the service. Successful exploitation yields complete confidentiality loss of all data accessible to Siebel CRM Deployment plus a repeatable denial-of-service condition, per the Oracle CPU advisory. No public exploit code or CISA KEV listing was identified at time of analysis, and EPSS data was not supplied for this CVE.
Low-privileged attackers who already hold a logon to the infrastructure hosting Oracle Siebel CRM's Life Sciences module (versions 17.0 through 26.7) can achieve full takeover of that module, with high confidentiality, integrity, and availability impact. Exploitation is not remote: it requires local interactive access plus a separate human user to perform some action (CVSS:3.1/AV:L/AC:L/PR:L/UI:R, base 7.3). No public exploit code or CISA KEV listing was present in the supplied intelligence, so this is assessed as a patch-now enterprise hardening issue rather than an actively exploited threat.
Full takeover of the Siebel CRM Deployment component (Oracle Siebel CRM Server Infrastructure, supported versions 17.0 through 26.7) is possible for a low-privileged user who can log on to the host where the deployment service runs, provided a person other than the attacker can be induced to perform an interaction. Oracle rates it 7.3 under CVSS 3.1 (AV:L/AC:L/PR:L/
A local privilege-escalation and data-tampering flaw in the CAX Client component of Oracle Agile PLM MCAD Connector 3.6 lets a low-privileged user who can already log on to the host running the connector create, modify, or delete critical PLM data, while also exposing a limited subset of that data to unauthorized reads. Because the vulnerability sits in the connector but the resulting actions reach other integrated products, Oracle assigns a scope change (S:C) and a CVSS 3.1 base score of 7.3. There is no CISA KEV listing, no public exploit code, and no EPSS data in the supplied intelligence, so the issue is currently patch-driven rather than evidence of active exploitation.
Oracle Agile Engineering Data Management 6.2.1 (Engineering Communication Interface component) allows an attacker who already holds a low-privileged logon on the host to reach critical application data and modify records, with a scope change that extends impact to interconnected products. The vendor rates this 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N), so the barrier is local access plus valid credentials rather than remote unauthenticated reach. There is no public exploit code identified and the issue is not listed in CISA KEV at time of analysis; exploitation would most plausibly be an insider or post-compromise privilege escalation within a PLM deployment.
Local privilege escalation in the scan_mysql actor of leapp-repository's leapp-upgrade-el9toel10 package allows code already running as the mysql OS account to obtain root on RHEL hosts during a RHEL 9 to RHEL 10 in-place upgrade. The actor invokes 'mysqld --validate-config' directly as root instead of via the packaged User=mysql systemd unit, so attacker-written persisted state (mysqld-auto.cnf pointing plugin_dir at the mysql-writable /var/lib/mysql) causes a malicious shared object to be dlopen()'d with UID 0 and full capabilities in the unconfined_t SELinux domain. Exploitation is not confirmed in the wild and no public exploit code was identified at time of analysis, but the upstream fix is public (leapp-repository PR 1343 / commit 3e4caff) and the CVSS score is 7.3 with all three impact metrics High.
Takeover of the Oracle Identity Manager Connector (component: Database Application Table) in Oracle Fusion Middleware is possible for a high-privileged attacker who can reach the affected HTTP interface, affecting versions 12.2.1.4.0 and 14.1.2.1.0. Oracle rates the flaw 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker who already holds elevated privileges can fully compromise confidentiality, integrity and availability of the connector with no user interaction and low attack complexity. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV), though it was published within Oracle's scheduled Critical Patch Update cycle.
Oracle BI Publisher 12.2.1.4.0 can be fully taken over by an attacker who already holds a high-privileged account and can reach the product's HTTP interface, with complete loss of confidentiality, integrity and availability (CVSS 3.1 base 7.2). The defect resides in the BI Platform Security component of Oracle Analytics and is rated low-complexity with no user interaction required, so a single crafted request from a privileged session is sufficient. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied with the source data.
Full takeover of Oracle Siebel CRM Deployment is achievable by attackers who already hold high-privileged accounts and can reach the deployment server's TCP interface, affecting Siebel CRM Deployment versions 17.0 through 26.7. Oracle rates the flaw CVSS 7.2 with complete loss of confidentiality, integrity and availability, but the PR:H metric means a valid privileged account is a prerequisite, keeping this out of the unauthenticated mass-exploitation class. No public exploit code or CISA KEV entry appears in the supplied intelligence, and no EPSS score was provided.
Full takeover of Oracle Depot Repair — the field-service and repair-management module of Oracle E-Business Suite — is possible in versions 12.2.3 through 12.2.15 for any attacker who already holds a high-privileged account and can reach the application over HTTP. The flaw sits in the module's Internal Operations component and permits complete loss of confidentiality, integrity and availability of Depot Repair data and functions. There is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is currently limited to actors who obtain or already possess elevated EBS credentials.
Oracle Lease and Finance Management, a finance module within Oracle E-Business Suite, can be fully taken over by a high-privileged user who sends crafted HTTP requests to its Internal Operations component in versions 12.2.7 through 12.2.15. Successful exploitation yields complete loss of confidentiality, integrity and availability for the module (CVSS 3.1 base 7.2), meaning an attacker could read and alter lease, financing and contract data and disrupt related business processes. The attack is rated easy to perform once the required privileged account and network path exist, but exploitation is gated behind high privileges, and no public exploit code or CISA KEV listing was identified at the time of analysis.
Full takeover of the Oracle Marketing module inside Oracle E-Business Suite 12.2.3 through 12.2.15 is possible through its Audience component, but only for an attacker who already holds high (administrative) privileges in the application - an anonymous remote user cannot reach it. The flaw is network-reachable over HTTP with low attack complexity and no user interaction, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base score 7.2) reflects complete loss of confidentiality, integrity, and availability for the affected module. No public exploit code has been identified and there is no confirmed active exploitation (the CVE is not in CISA KEV) at time of analysis, so the realistic threat is a malicious privileged insider or an attacker who has already compromised a high-privilege EBS account.
Full takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an authenticated attacker holding high privileges, who can send crafted HTTP requests to the Security component and gain complete control of confidentiality, integrity, and availability. The vulnerability is rated CVSS 7.2, and no public exploit code or active exploitation has been identified at time of analysis; EPSS data is unavailable. The high-privilege requirement limits exposure to already-compromised or insider accounts, but successful exploitation yields total application compromise.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that allows a high-privileged attacker with HTTP network access to fully compromise the application, yielding high confidentiality, integrity and availability impact across a single security scope. Successful exploitation means takeover of the HFM platform rather than a narrow data leak — the attacker gains the ability to read, alter and disrupt the financial consolidation environment. The vulnerability is remotely reachable and low-complexity once the required privileged position is obtained, though no public exploit code and no CISA KEV entry have been reported at time of analysis; the fixed release is delivered through Oracle's Critical Security Patch Update channel.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an attacker who already holds a high-privileged account reach the application over HTTP and fully take over the HFM instance, with high impact to confidentiality, integrity, and availability. Exploitation is rated as easy (AC:L, no user interaction) once the privileged foothold exists, so the practical barrier is obtaining or abusing an administrative credential rather than defeating any exploit mitigation. There is no public exploit code or CISA KEV entry at time of analysis, and no EPSS score was supplied, so the real-world risk is driven by internal admin-account hygiene and network exposure of the HFM web tier.
Full compromise of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through a SQL-based attack against the product's Security component, with High confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N). The critical qualifier is privilege: exploitation requires an attacker who already holds a high-privileged account and network reachability to the affected component, so this is primarily an insider, credential-compromise, or laterally-moving-attacker risk rather than an unauthenticated perimeter threat. No EPSS score, CISA KEV listing, or public exploit code was supplied; the only reference is Oracle's Critical Patch Update advisory, and no exact patched build version is stated in the available data.
Oracle Product Hub, the product master-data module of Oracle E-Business Suite, fails to properly enforce authorization in its Internal Operations component across supported releases 12.2.3 through 12.2.15, allowing an attacker who already holds a high-privileged account to achieve full takeover of the module over HTTP. Successful exploitation yields complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning master data, configuration and administrative functions can be read and altered. Oracle did not publish a CWE identifier with this record, no public exploit code has been identified at time of analysis, and neither CISA KEV nor EPSS data was supplied, so active exploitation cannot be confirmed.
Takeover of Oracle Product Hub in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a highly privileged authenticated attacker with network HTTP access to the Internal Operations component, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). The flaw is rated easily exploitable (AC:L, UI:N) once the required credentials are held, and no public exploit has been identified at time of analysis. Because the CVSS vector specifies PR:H, anonymous or low-privileged internet attackers are ruled out, leaving the mandatory high-privilege account as the primary gating factor.
Authenticated high-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can fully take over the Oracle Applications Framework Personalization component, with high impact to confidentiality, integrity and availability. The flaw scores 7.2 on CVSS 3.1 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and low attack complexity once an attacker already holds a privileged EBS account. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so the practical risk is dominated by the credential-privilege precondition rather than by mass exploitation.
High-privileged users of Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0) can exploit a flaw in the Platform Security component over HTTP to take complete control of the BI platform. The vendor rates this CVSS 3.1 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a highly privileged account but needs no user interaction and faces low attack complexity, with full confidentiality, integrity and availability impact. No public exploit code or CISA KEV entry is identified in the available data, and EPSS scoring was not supplied, so real-world exploitation activity is unconfirmed at time of analysis.
Attackers who already hold an elevated account on Oracle Business Intelligence Enterprise Edition can fully take over the platform by sending crafted HTTP requests to its Platform Security component, impacting confidentiality, integrity and availability of the whole deployment. Supported versions 8.2.0.0.0 and 26.01.0.0.0 are affected, and Oracle delivered the fix through its out-of-band critical security patch update. No public exploit code or CISA KEV entry has been identified at time of analysis, so the practical risk is driven by the high-privilege prerequisite rather than by active exploitation.