Unauthenticated remote denial of service in Oracle Helidon's helidon-webserver component (versions 4.0.0 through 4.5.4) allows any network-reachable attacker to drive the server into a hang or a repeatable crash, fully denying service. The flaw is rated CVSS 7.5 with a network vector and no authentication or user interaction required, and Oracle lists it in its Fusion Middleware security advisory, making exposure a direct function of whether the Helidon HTTP listener is reachable. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation, but the trivial attack prerequisites mean it should be treated as remotely exploitable by unsophisticated actors.
Unauthenticated HTTP/2 traffic can hang or repeatedly crash the Oracle Helidon webserver, allowing a remote attacker to take a Helidon-hosted application offline. Oracle rates it 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), so the only impact is availability, but it requires no credentials and no user interaction. Affected releases are Helidon 4.0.0 through 4.5.4; no public exploit code or CISA KEV entry is present in the available data, and no EPSS score was supplied, so the current exploitation status is unconfirmed.
Unauthenticated remote denial of service in the Siebel CRM Deployment component (Server Infrastructure) of Oracle Siebel CRM affects supported releases 17.0 through 26.7, allowing any attacker with TCP network access to drive the Deployment service into a hang or frequently repeatable crash. Oracle rates the flaw CVSS 7.5 with a fully remote, low-complexity, no-privilege, no-interaction vector (AV:N/AC:L/PR:N/UI:N) but availability-only impact (C:N/I:N/A:H), meaning confidentiality and integrity of CRM data are not directly at risk. No public exploit code has been identified and the issue does not appear in CISA KEV, though Oracle's own advisory language describes it as 'easily exploitable', so exposure should be treated as urgent for internet- or WAN-reachable deployment instances.
Unauthenticated denial of service in Oracle Siebel CRM Deployment (Server Infrastructure component) affecting release levels 17.0 through 26.7. An attacker who can reach the deployment infrastructure over HTTP can send crafted requests that hang or repeatedly crash the service, producing a complete denial of service with no confidentiality or integrity impact. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied; the risk is driven by the low attack complexity and lack of required credentials rather than by observed exploitation.
Heap exhaustion in the http4s Ember backend (0.23.x before 0.23.35 and 1.0.0 milestones before 1.0.0-M47) allows a single unauthenticated HTTP/2 connection to open an unbounded number of peer-created streams because SETTINGS_MAX_CONCURRENT_STREAMS is never enforced, and each stream retains per-stream state until the JVM heap is exhausted. The same unchecked allocation is reachable on the client side through server-initiated PUSH_PROMISE frames, since enablePush is likewise not honored. Rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact) and fixed in 0.23.35 and 1.0.0-M47 via a Semaphore-gated stream handler; no active exploitation is confirmed (not in CISA KEV) and no public exploit code was identified at time of analysis.
Authenticated IBM MQ users can trigger arbitrary code execution on the application server through the Resource Adapter Installation Verification Test (IVT) application, which fails to properly validate JNDI names. The flaw affects a broad swath of IBM MQ releases: 9.1.0.0–9.1.0.37 LTS, 9.2.0.0–9.2.0.43 LTS, 9.3.0.0–9.3.0.41 LTS, 9.3.0.0–9.3.5.1 CD, 9.4.0.0–9.4.0.25 LTS, 9.4.0.0–9.4.5.1 CD, and 10.0.0.0. No public exploit code or CISA KEV entry has been identified at time of analysis, but a vendor patch is available and the CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating full confidentiality, integrity, and availability impact once the attack conditions are met.
Unauthenticated remote attackers with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can send crafted HTTP requests through the Security component to trigger a hang or repeatable crash, producing a complete denial of service of the application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact) and is rated 'easily exploitable' by Oracle. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so current risk is driven by exposure of the application rather than observed exploitation.
Unauthenticated denial of service in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 allows a remote attacker to hang or repeatedly crash the application server through crafted HTTP traffic, with no confidentiality or integrity impact. The vulnerability sits in the Ren (Real-time Event Notification) Server component, is rated CVSS 7.5 with an all-network, no-privileges, no-user-interaction vector, and is fixed in Oracle's Critical Security Patch Update (cspusep2026). No public exploit code and no CISA KEV entry were identified in the supplied intelligence at time of analysis.
Unbounded heap growth in http4s Ember's HTTP/2 read path allows a hostile peer to exhaust server or client memory and crash the JVM with an OutOfMemoryError. Any Ember server built with withHttp2 that exposes a slow-draining or non-draining route is affected, as is any Ember client consuming a response body from an untrusted server; versions before 0.23.35 and before 1.0.0-M47 are vulnerable. No public exploit code or CISA KEV listing was identified at time of analysis, but the flaw requires no authentication or user interaction and the public fix commit makes the root cause straightforward to study, so EPSS-style near-term exploitation pressure should not be dismissed.
Denial of service in the tftp-hpa in.tftpd remap engine allows a remote, unauthenticated attacker to crash the TFTP daemon with a single crafted request: when an inverse remap rule also aborts with a non-empty custom error message, invalid regex match offsets are passed into genmatchstring(), producing out-of-bounds reads and writes. The flaw affects tftp-hpa as shipped in Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, but is only reachable when the daemon is launched with a remap (map-file) configuration containing such a rule, so default installations with no remap file do not exercise the vulnerable code path. At time of analysis there was no public exploit identified and no CISA KEV listing; CVSS rates the issue 7.5 with availability-only impact.
An unauthenticated remote attacker with HTTP access to the Oracle Applications Manager component of Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical configuration and management data without supplying credentials. The flaw lives in the Command Line - RapidClone component and carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact). No public exploit code, EPSS score, or CISA KEV listing was supplied in the input, so active exploitation is unconfirmed, but the zero-privilege, zero-interaction network vector makes this a high-value target for opportunistic scanning of internet-facing EBS deployments.
Unauthenticated attackers with network access can read critical data from the Open Integration component of Oracle Siebel CRM Integration in versions 25.12 through 26.7 by sending crafted HTTP requests, because the component fails to enforce authentication on its integration interfaces. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), making it trivially automatable against any reachable deployment. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle has published a Critical Security Patch Update covering the affected releases.
Oracle Business Intelligence Enterprise Edition versions 8.2.0.0.0 and 26.01.0.0.0 contain an unauthenticated, network-reachable weakness in the BI Platform Security component that lets an attacker read critical business data, potentially everything the BI platform itself can access. Oracle scores it 7.5 with a vector of AV:N/AC:L/PR:N/UI:N and confidentiality-only impact, and the vendor's own tagging classifies it as an authentication bypass. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the source data.
Unauthenticated remote attackers can read any data reachable through the Audience component of Oracle Marketing in Oracle E-Business Suite versions 12.2.3 through 12.2.15 by sending crafted HTTP requests, with no user interaction required. The flaw is scored 7.5 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:N) and is confidentiality-only - integrity and availability of the affected module are unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS probability was supplied with the source data.
Unauthenticated attackers with HTTP network access can read critical data from Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 by exploiting an authentication bypass in the Siebel Cloud Manager component. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) with high confidentiality impact only - integrity and availability are unaffected - meaning a successful hit exposes all data reachable through the affected component. No public exploit code, EPSS score, or CISA KEV entry was supplied in the intelligence feed, so active exploitation is currently unconfirmed.
Unauthenticated attackers with HTTP network access to Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 can read data they should not be able to reach, including critical application data, via a flaw in the Runtime Tools component. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), making it trivially automatable against any internet- or intranet-exposed instance that has not applied the referenced Oracle Critical Security Patch Update. There is no public exploit code identified at time of analysis and no CISA KEV listing, so exploitation appears opportunistic rather than confirmed in the wild.
Unauthenticated attackers with HTTP network access to Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 can read data they should not be able to reach, including potentially all content and data the application can access. Oracle rates it 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N), meaning no credentials, no user interaction and no special complexity are needed - only reachability to the web interface. There is no public exploit code and no CISA KEV listing at time of analysis, but the low attack requirements and high confidentiality impact make it a strong patch-now candidate for any internet-facing deployment.
Privilege escalation to full administrator equivalence in the Eventin event management plugin for WordPress allows any authenticated user who controls the user ID 1 account - regardless of their currently assigned role - to bypass every WordPress capability check and achieve remote code execution via the built-in plugin and theme editors. The flaw is rooted in PermissionManager::manage_permissions() unconditionally returning the always-true 'exist' capability primitive for all capability evaluations when the requesting user ID equals 1, granting blanket access to manage_options, edit_plugins, edit_themes, promote_users, and update_core. Exploitation is conditional on user ID 1 having been demoted to a lower-privilege role as a hardening measure; default installations where user ID 1 retains administrator rights are not impacted. No public exploit has been identified at time of analysis.
Heap-exhaustion denial of service in the http4s DigestAuth server middleware: an inverted stale-nonce comparison in NonceKeeper causes fresh nonces to be discarded while eviction halts at the first stale entry, so the nonce map grows without bound. Any application that protects at least one route with DigestAuth and runs a version prior to 0.23.35 or 1.0.0-M47 is affected, and an unauthenticated remote attacker can drive repeated 401 authentication challenges until the JVM throws OutOfMemoryError and the service collapses. CVSS 7.5 (network, no privileges, no user interaction, availability-only) makes this a straightforward resource-exhaustion attack; no public exploit code or CISA KEV entry was identified at time of analysis, but exploitation requires nothing more than a loop of unauthenticated HTTP requests.
Unauthenticated attackers with HTTP network access can bypass the security controls of Oracle Hyperion Financial Management 11.2.26.0.000, gaining unauthorized read access to critical financial consolidation data. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact) and is tagged as an authentication bypass in the product's Security component. No KEV listing, public exploit code, or EPSS score was provided in the available intelligence, so the current exploitation status is unknown and the issue should be treated as a patch-now information-disclosure risk for internet- or partner-reachable HFM deployments.
Unauthenticated remote attackers can bypass security controls in Oracle Hyperion Financial Management 11.2.26.0.000, the financial consolidation and reporting module of the Oracle Hyperion EPM suite. Because the flaw is reachable over HTTP with no credentials or user interaction, an attacker with network access to the application can read consolidation data, metadata and reports that should be restricted, resulting in a full confidentiality loss (CVSS 7.5) with no integrity or availability impact. The issue was published in an Oracle Critical Patch Update advisory; no public exploit code and no CISA KEV listing were identified at time of analysis, so real-world exploitation is assessed as targeted rather than widespread until telemetry proves otherwise.
Unauthenticated HTTP requests against Oracle Hyperion Financial Management 11.2.26.0.000 can bypass the product's Security component and expose every record the application can reach, including sensitive financial consolidation data. Oracle scores it 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning any attacker who can reach the HFM web tier needs no credentials and no user interaction — only confidentiality is impacted, with no data modification or denial of service. The supplied intelligence contains no CISA KEV listing, no EPSS score, and no public exploit code, so the current status is 'no public exploit identified at time of analysis'; real priority therefore hinges on whether the instance is network-reachable beyond a trusted segment.
Unauthenticated remote attackers can bypass authentication in Oracle Hyperion Financial Management 11.2.26.0.000 to gain unauthorized access to critical data. The flaw resides in the Security component, allowing full read access to all application data over HTTP with no user interaction or privileges required. No public exploit code or active exploitation is currently confirmed, but the high confidentiality impact and low attack complexity make it a priority for patching.
Unauthenticated remote attackers with HTTP access to Oracle Sales Offline, a module of Oracle E-Business Suite, can read any data the application exposes on affected versions 12.2.3 through 12.2.15. The flaw sits in the Internal Operations component and requires no credentials, no user interaction and no non-default configuration, yielding a 7.5 confidentiality-only CVSS base score. Exploitation is highly automatable and attractive for bulk data theft, though at the time of analysis there is no public exploit code and no confirmed exploitation (no CISA KEV listing); EPSS is not available in the supplied intelligence.
Unauthenticated remote denial of service in IBM Verify Identity Access (the current name of IBM Security Verify Access) and its container editions, where crafted incoming requests reach a handler that fails to validate resource consumption, leading to uncontrolled recursion (CWE-674) and service exhaustion. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact) means any network-reachable instance can be knocked offline without credentials, but confidentiality and integrity are unaffected. IBM has published a vendor fix; no public exploit code or CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided.
Full takeover of Oracle Hyperion Financial Management is achievable by a low-privileged, authenticated attacker who can reach the product's Security component over HTTP, with successful exploitation yielding complete compromise of confidentiality, integrity and availability (C:H/I:H/A:H). Only version 11.2.26.0.000 is listed as affected, and the CVSS 3.1 base score of 7.5 is capped by two meaningful limiters rather than by reduced impact: AC:H, meaning the vendor itself rates the attack 'difficult' and dependent on timing, configuration or state conditions outside the attacker's full control, and PR:L, meaning a valid low-privileged account is a hard prerequisite. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied, so the practical near-term risk is driven by the severity of the post-exploitation outcome rather than by observed threat activity.
Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 contains a flaw in its Access and Security component that allows a low-privileged, authenticated user with HTTP network access to escalate privileges and take over the application, with high impact to confidentiality, integrity and availability. The vulnerability is rated 'difficult to exploit' by Oracle (AC:H), so successful abuse requires favorable conditions rather than a single trivial request, but the payoff is full compromise of the DRM instance. No public exploit code or CISA KEV listing has been identified at time of analysis, and Oracle has published a fix in its Critical Patch Update advisory.
Oracle Banking Origination versions 14.5.0.0.0 through 14.9.0.0.0 contain a high-complexity flaw in the Onboarding Batch Processes component that lets a low-privileged, authenticated attacker reach the application over HTTP and achieve full takeover (high confidentiality, integrity and availability impact, CVSS 3.1 base 7.5). The attack vector is network-based but the vendor rates exploitation as difficult (AC:H), implying a race condition, state dependency or timing condition must be satisfied rather than a straightforward request. No public exploit code or CISA KEV listing was present in the supplied intelligence at time of analysis, so the immediate risk is driven by the severity of impact in banking environments rather than confirmed active exploitation; EPSS data was not provided.
A difficult-to-exploit flaw in the Administration component of Oracle BI Publisher lets a low-privileged, authenticated attacker who can reach the server over HTTP take complete control of the platform, with high confidentiality, integrity and availability impact. Affected releases are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, as listed in Oracle's Critical Security Patch Update (cspusep2026). There is no CISA KEV listing, no referenced public exploit code and no EPSS score in the supplied data, so this reads as a patch-on-cadence item rather than an emergency — though the outcome is full platform takeover.
Oracle Business Intelligence Enterprise Edition (Analytics) versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 contain a hard-to-exploit but high-impact flaw in the Presentation Services component that a low-privileged, network-positioned attacker can reach over SOAP to fully take over the BI platform. Successful exploitation yields high confidentiality, integrity and availability impact (CVSS 3.1 base 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker must already hold a valid low-privilege account and defeat the non-trivial attack complexity. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so this should be treated as a patch-priority issue for exposed BI deployments rather than a confirmed active campaign.
Oracle Business Intelligence Enterprise Edition (BI EE, part of Oracle Analytics) versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 can be fully taken over by a low-privileged attacker who already holds a valid account and can reach the product's SOAP interface over the network. Oracle rates the flaw 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity and availability of the Analytics platform, but the vendor also classifies it as 'difficult to exploit', so successful attacks likely require significant timing, sequencing or state knowledge rather than a simple request. No CISA KEV listing, EPSS score or public exploit code was included in the reporting data, and no CWE was assigned, so the precise root-cause class remains undocumented by the vendor.
Application takeover in Oracle Product Lifecycle Analytics 3.6.1 is reachable over HTTP by an attacker holding a low-privileged account, who can leverage a flaw in the installation-related component to seize full control of the application; Oracle rates it 7.5 with high confidentiality, integrity and availability impact. Exploitation is gated by high attack complexity and prior authentication, and no public exploit code or CISA KEV entry has been identified for this issue at time of analysis, leaving EPSS unquantified in the supplied data.
An attacker holding a low-privileged Oracle E-Business Suite account with network access to the Oracle Sourcing 'Internal Operations' component can take over Oracle Sourcing in supported releases 12.2.3 through 12.2.15, achieving full loss of confidentiality, integrity, and availability within that module (CVSS 3.1 base score 7.5, vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Oracle characterizes the issue as difficult to exploit (AC:H), meaning specific timing, state, or configuration preconditions must be satisfied rather than a single unauthenticated request; authentication is mandatory (PR:L) and no user interaction is required (UI:N). There is no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV), so the practical risk is a moderate-to-serious patching priority rather than an emergency pre-auth compromise scenario.
Authenticated low-privileged attackers with network reachability can fully take over Oracle Siebel CRM Development (versions 17.0 through 26.7) by exploiting the Configuration Tools component through SQL-based input, resulting in complete loss of confidentiality, integrity, and availability on the affected deployment. Oracle rates this 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a hard-to-execute but network-reachable flaw that requires only a low-privileged account and no user interaction. There is no public exploit identified at time of analysis, no EPSS score supplied, and no CISA KEV listing, so this is currently a patch-cycle priority rather than an observed active campaign.
Unbounded WebSocket message buffering in http4s lets any remote client that completes a WebSocket handshake against an http4s-blaze-server or http4s-ember-server endpoint exhaust server memory, causing a denial of service. The shared decoder accepts declared frame lengths up to Int.MaxValue and defragments continuation frames without any size limit, so oversized frames or a long stream of fragments are accumulated in memory until the JVM heap is exhausted. The flaw is addressed in http4s 0.23.35 and 1.0.0-M47, which enforce a configurable 64 MiB default cap on both individual frames and defragmented messages; no public exploit code or CISA KEV entry is present in the supplied intelligence, and no EPSS score was provided.
Oracle Agile PLM 9.3.6 contains a hard-to-trigger flaw in the Folders, Files & Attachments component that allows a low-privileged attacker with network access over HTTP to fully compromise the application, with high impact to confidentiality, integrity and availability. Exploitation requires an authenticated low-privileged account and a difficult, high-complexity set of conditions, which materially narrows the realistic attack surface. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied with the source data.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged, network-connected user take full control of the application, with high impact to confidentiality, integrity and availability. Exploitation is rated difficult (AC:H) because it depends on a narrow timing or state precondition, but once met it requires only an authenticated low-privilege session over HTTP and no user interaction. No public exploit code or CISA KEV entry was provided at time of analysis, and no CWE classification or EPSS score accompanied the vendor disclosure.
A low-privileged attacker who can reach the HTTP interface of Oracle Hyperion Financial Management 11.2.26.0.000 can take over the application by exploiting a flaw in its Security component. Although rated CVSS 3.1 7.5, the vulnerability is explicitly difficult to exploit (AC:H) and requires valid low-privileged credentials (PR:L), but successful exploitation yields full confidentiality, integrity and availability impact. No public exploit code or confirmed active exploitation appears in the available intelligence, and no EPSS or CISA KEV data was supplied.
Oracle Coherence (Core component) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 can be fully taken over by a low-privileged attacker who can reach the HTTP interface, per Oracle's Critical Security Patch Update. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N, C/I/A all High) confirms a network-reachable but difficult-to-exploit flaw that yields complete compromise of the data grid rather than a limited data leak. No CISA KEV listing, public exploit code, or EPSS score is present in the supplied intelligence, so no public exploit identified at time of analysis and active exploitation is unconfirmed.
Low-privileged users with HTTP access to Oracle Business Intelligence Enterprise Edition can exploit a hard-to-trigger flaw in the BI Search component to gain full control of the platform, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected supported versions are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. At the time of analysis there is no CISA KEV entry and no public exploit identified; the 7.5 score reflects the vendor's own assessment and exploitation is gated by a high attack-complexity condition.
Complete takeover of Oracle Business Intelligence Enterprise Edition is achievable by a low-privileged attacker who can reach the product's HTTP interface in versions 8.2.0.0.0 and 26.01.0.0.0, through a flaw in the Platform Security component. Oracle rates it 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning confidentiality, integrity and availability of the BI platform are all fully at risk, but exploitation is difficult and requires an existing low-privileged account. At time of analysis there is no CISA KEV listing, no public exploit code, and no EPSS score in the supplied intelligence.
Oracle Quality, a module of Oracle E-Business Suite, contains a difficult-to-exploit flaw in its Internal Operations component affecting versions 12.2.3 through 12.2.15, allowing a low-privileged attacker with network access via HTTP to take over the module with full confidentiality, integrity and availability impact. Oracle's own advisory rates it CVSS 7.5 with attack complexity High and privileges required Low, meaning an attacker must already hold a valid low-privilege account but can reach the vulnerable code remotely over HTTP. No public exploit code has been identified and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not supplied in the intelligence feed, so real-world exploitation likelihood cannot be quantified from that signal.
Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 can be fully taken over by a low-privileged, network-positioned attacker who reaches Forms Services over HTTP. Oracle rates the flaw difficult to exploit (AC:H) but complete in impact, with high confidentiality, integrity and availability loss once triggered. No public exploit code has been identified and the issue is not listed in CISA KEV, so current risk is driven by the value of Forms-based business applications rather than by observed exploitation.
Unauthenticated denial of service in Oracle Hyperion Data Relationship Management 11.2.26.0.000 lets any attacker who can reach the HTTP interface hang or repeatedly crash the application, removing master-data services for all legitimate users. Oracle rates it CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only), and the vulnerable code sits in the 'Access and security' component, so no credentials or user interaction are needed. Active exploitation is not confirmed — no KEV listing, EPSS score, or public exploit code was supplied with this report — but the low attack complexity makes automated mass scanning plausible if the endpoint is internet-reachable.
Unauthenticated HTTP/2 traffic can hang or repeatedly crash Oracle Helidon versions 4.0.0 through 4.5.4 through a flaw in the helidon-webclient-http2 component, giving a full denial-of-service of the affected service. The issue is network-reachable with no credentials and no user interaction (CVSS 3.1 base 7.5, availability-only impact). No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though Oracle's own advisory describes the flaw as 'easily exploitable', so the barrier to a working denial-of-service is judged to be low.
Unauthenticated attackers with network access can achieve full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 through a flaw in the Forge component, but only if a legitimate user is first induced to interact with attacker-supplied content delivered over HTTP. The vendor rates this CVSS 3.1 base 7.5 (AV:N/AC:H/PR:N/UI:R, C/I/A all High), reflecting high impact gated behind a difficult, interaction-dependent exploit path. No public exploit code and no CISA KEV listing were present in the supplied intelligence at time of analysis, and no EPSS score was provided, so the practical risk profile rests primarily on the vendor advisory and the internal exposure of the affected Forge endpoints.
Unauthenticated remote denial of service in Oracle Siebel CRM Deployment (Server Infrastructure component) affects all supported releases from 17.0 through 26.7 and lets any attacker who can reach the deployment service over TCP hang or repeatedly crash it, with CVSS 3.1 scored 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only). Because the flaw needs no credentials, no user interaction, and no special conditions, any internet- or WAN-exposed deployment endpoint is at risk of sustained outage, though impact is limited to availability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Oracle's CPU-style advisory at https://www.oracle.com/security-alerts/cspusep2026.html is the authoritative source.
Unauthenticated denial of service against Oracle Siebel CRM Deployment (Server Infrastructure component) lets network-reachable attackers hang or repeatedly crash the service, taking the deployment offline; affected releases span 17.0 through 26.7. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U, availability-only impact), meaning no credentials, no user interaction, and no special complexity are required — a low bar for automation. No public exploit code or CISA KEV listing was identified in the supplied intelligence at time of analysis, so the immediate concern is exposure management rather than confirmed active exploitation.
Unauthenticated remote denial of service in Oracle Hyperion Financial Management 11.2.26.0.000 (Security component) lets any attacker who can reach the service over TCP cause a hang or repeatable full crash of the application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, availability-only impact) and is fixed through Oracle's Critical Security Patch Update cycle described in the cspusep2026 advisory. There is no public exploit code, no CISA KEV listing, and no EPSS signal in the supplied data, so this should be triaged as a high-severity availability risk for internet- or network-exposed HFM deployments rather than an actively exploited emergency.
Unauthenticated remote attackers can render Oracle Hyperion Financial Management 11.2.26.0.000 unavailable by sending crafted HTTP requests that hang or repeatedly crash the application (complete denial of service). The flaw sits in the product's Security component and carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning no credentials, no user interaction, and no special complexity are required once the HTTP interface is reachable. At the time of analysis, no public exploit code has been identified and no EPSS, KEV, or POC data was supplied, so active exploitation is unconfirmed — the practical risk is driven mainly by whether the HFM web endpoint is exposed beyond a trusted network.