Authenticated low-privileged users can fully compromise Oracle Business Intelligence Enterprise Edition 8.2.0.0.0 and 26.01.0.0.0 by sending crafted HTTP requests to the Analytics Server component, obtaining complete control over confidentiality, integrity, and availability of the platform. Oracle rates this 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the only real prerequisite is a valid low-privilege account and network reachability to the HTTP interface. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so the immediate risk is driven by the severity of a successful takeover rather than confirmed in-the-wild activity.
Authenticated low-privileged users can fully compromise the Oracle Applications Framework (Personalization) component of Oracle E-Business Suite 12.2.9 through 12.2.15 by sending crafted HTTP requests, achieving complete loss of confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). Oracle rates the flaw as easily exploitable with no user interaction, and the impact is described as full takeover of the Applications Framework rather than simple data exposure. No public exploit code or CISA KEV listing was identified at time of analysis, and remediation is available through Oracle's Critical Security Patch Update (cspusep2026).
Oracle E-Business Suite 12.2.9 through 12.2.15 contain a flaw in the Personalization component of the Oracle Applications Framework that lets a low-privileged user with HTTP network access take full control of the framework, with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8). Exploitation is rated 'easily exploitable' by the vendor because it requires no user interaction and no special complexity — only a valid low-privileged account. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so real-world exploitation status is currently unconfirmed. The vendor has published an out-of-band Critical Security Patch Update covering this issue; organizations running affected EBS releases should treat patching as urgent because the pre-authentication barrier is only a low-privilege login.
Oracle BI Publisher in Oracle Analytics (versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0) contains a flaw in the BI Platform Security component reachable over SOAP that allows a low-privileged, authenticated attacker with network access to fully take over the affected BI Publisher instance, with high confidentiality, integrity and availability impact (CVSS 8.8). Oracle characterizes the issue as easily exploitable, and the reference is the Oracle Critical Security Patch Update cspusep2026 advisory. No public exploit code and no CISA KEV entry were identified in the supplied intelligence at time of analysis, and no EPSS score was provided.
An authenticated remote attacker with low privileges can fully take over Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 by sending crafted HTTP requests to the Resource Catalog Services component, which is part of Oracle Fusion Middleware. The flaw is rated CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning successful exploitation yields complete loss of confidentiality, integrity and availability of the affected JDeveloper instance. No CWE, EPSS score, KEV entry or public proof-of-concept was supplied in the source data, so active exploitation is not confirmed, but the low attack complexity and lack of user interaction make rapid patching advisable once the Oracle CPU fix is applied.
Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 contains an easily exploitable flaw in the Service Administration UI component that allows a low-privileged attacker with network access over HTTP to fully take over the platform, with high confidentiality, integrity, and availability impact (CVSS 8.8). Because exploitation only requires a valid low-privileged account rather than an administrator, any provisioned BI user could potentially escalate to full control of the BI deployment. There is no public exploit identified at time of analysis, no KEV listing, and no EPSS data supplied; Oracle has published a Critical Security Patch Update advisory covering the issue.
Oracle Database Server's RDBMS component (19c 19.3–19.32, 21c 21.3–21.23, and 23ai 23.4.0–23.26.3) can be fully compromised by a low-privileged database account that holds EXECUTE on the DBMS_REDEFINITION package. An attacker reaching the database over Oracle Net can abuse that package to achieve takeover of the RDBMS, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no CISA KEV listing were identified in the supplied intelligence at the time of analysis; the vulnerability is addressed by Oracle's Critical Security Patch Update referenced at oracle.com/security-alerts/cspusep2026.html.
Application takeover in Oracle Siebel CRM's Self Service module (Helpdesk/Training component) affects versions 17.0 through 26.7 and lets a low-privileged, network-positioned attacker who holds an ordinary Self Service account fully compromise the application. Because the flaw is reachable over HTTP with low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), an authenticated but unprivileged user can escalate to control over confidentiality, integrity and availability of the whole Self Service deployment. No public exploit code or active exploitation is identified at time of analysis, and neither EPSS nor CISA KEV data was supplied with this report.
A low-privileged, authenticated attacker with network access can fully take over Oracle Siebel CRM Deployment (versions 17.0 through 26.7) by abusing SQL handling in the Server Infrastructure component, achieving high confidentiality, integrity, and availability impact (CVSS 8.8). The flaw is trivially exploitable once any valid low-privilege account is obtained — no user interaction and no elevated privileges beyond a standard login are required. Oracle released a fix in its Critical Security Patch Update (cspusep2026); there is no CISA KEV listing and no public exploit code identified at time of analysis, so current exploitation appears opportunistic rather than confirmed in the wild.
A low-privileged, authenticated attacker with HTTP access to the Workflow component of Oracle Siebel CRM Development can fully take over the affected deployment, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). All supported Siebel CRM Development releases from 17.0 through 26.7 are affected per Oracle and ENISA EUVD-2026-79561. No public exploit code or CISA KEV entry is reported in the supplied intelligence, and no EPSS score or CWE classification was provided, so real-world exploitation activity is currently unconfirmed.
Oracle Siebel CRM Deployment (Migration component), versions 17.0 through 26.7, can be fully taken over by a low-privileged attacker who reaches the component over the network and supplies crafted SQL. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N, all three impact metrics High), meaning a single authenticated low-privilege account is enough to gain high confidentiality, integrity and availability impact across the deployment. At time of analysis there is no public exploit identified and no CISA KEV listing, though no EPSS score was supplied, so real-world exploitation likelihood could not be quantified from the provided intelligence.
Low-privileged attackers with network access via HTTP can fully compromise the Oracle Applications Framework component (Personalization) of Oracle E-Business Suite 12.2.3 through 12.2.15, achieving complete loss of confidentiality, integrity and availability of that component (CWE not assigned). The vulnerability is trivially exploitable — network vector, low complexity, no user interaction — and carries a CVSS 3.1 base score of 8.8. No public exploit code or CISA KEV listing was reported in the supplied intelligence, and no EPSS score was provided; Oracle's own advisory (cspusep2026) is the authoritative source and a patched update is expected through the relevant Critical Patch Update.
Takeover of Oracle Siebel CRM Deployment is possible for any low-privileged, authenticated attacker who can reach the Server Infrastructure component over HTTP, affecting supported versions 17.0 through 26.7. Oracle rates the flaw 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning a single valid low-privilege account is enough to gain full confidentiality, integrity and availability impact on the deployment — no user interaction or privilege escalation step is required. No CISA KEV entry, EPSS score or public exploit code was present in the supplied intelligence, so this is currently 'no public exploit identified at time of analysis', though Oracle's advisory language ('easily exploitable') and the low attack complexity make it an attractive post-authentication target.
Any authenticated low-privileged user who can reach the Oracle Depot Repair module over HTTP can fully compromise it in Oracle E-Business Suite versions 12.2.10 through 12.2.15, gaining read, modify and delete access across the module. Oracle rates the issue 8.8 with a network vector, low complexity, low privileges required and no user interaction, and has published a Critical Security Patch Update addressing it. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
A broken authorization flaw in the Proxy User Delegation component of Oracle User Management (Oracle E-Business Suite 12.2.3 through 12.2.15) lets an authenticated, low-privileged user reach the application over HTTP and fully take over the module, with high impact to confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). Because delegation features inherently exercise impersonation logic, a bypass here can translate directly into acting as a higher-privileged user across the suite. No CISA KEV listing, no public exploit code and no EPSS score were supplied with the input; exploitation status is therefore 'no public exploit identified at time of analysis'.
Full compromise of Oracle Siebel CRM Deployment (Server Infrastructure component, versions 17.0 through 26.7) is achievable by an authenticated low-privileged user who can reach the deployment tier over HTTP. Oracle's own advisory rates it 8.8 with complete confidentiality, integrity, and availability impact, meaning a single low-privilege account can escalate to takeover of the deployment rather than merely reading data. No CISA KEV listing, no public exploit code, and no EPSS score were included in the source data, so the current exploitation status is unconfirmed and the immediate risk is driven by the breadth of the affected version range combined with trivial attack complexity.
Oracle Applications Manager, the web-based management console shipped with Oracle E-Business Suite 12.2.3 through 12.2.15, contains an easily exploitable flaw in its Oracle Diagnostics Interfaces component that lets a low-privileged attacker with network access over HTTPS seize control of the console. Successful exploitation yields full compromise of confidentiality, integrity and availability (CVSS 8.8) and effectively hands over the EBS management plane to the attacker. No public exploit code or CISA KEV listing was present in the available intelligence at the time of analysis, so exploitation status remains unconfirmed.
Oracle E-Business Suite releases 12.2.3 through 12.2.15 allow a low-privileged, authenticated user with network access to the HTTPS interface to take over the Customer Interaction History module, compromising confidentiality, integrity and availability of that component's data. No public exploit code has been identified and the CVE is not listed in CISA KEV, but the attack is network-reachable with low complexity and no user interaction, so a single valid account is the only real barrier. Exploitation probability metrics (EPSS) were not supplied with this record, so real-world activity cannot be quantified from the available data.
Authenticated low-privileged users can fully compromise the Customer Interaction History module (Outcome-Result component) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 over HTTP, achieving complete loss of confidentiality, integrity and availability of that module. Oracle rates the issue 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning the attacker needs only a valid low-privilege account and no user interaction, making the barrier to exploitation low for anyone who already holds any EBS login. No public exploit code has been identified and the flaw does not appear in CISA KEV at time of analysis, but the Oracle Critical Patch Update reference (cspusep2026.html) indicates a vendor fix is published and patching should follow normal CPU urgency for internet-facing EBS deployments.
Network-reachable file-upload flaws in Oracle E-Business Suite's Application Object Library (Attachments component, versions 12.2.3 through 12.2.15) allow a low-privileged authenticated user to take over the affected component, earning a CVSS 3.1 base score of 8.8 with High confidentiality, integrity and availability impact and no user interaction. Exploitation needs only a valid low-privilege EBS account plus HTTP access — no privileged role, no crash, no victim action — which makes it an attractive post-authentication escalation path inside ERP deployments. No public exploit code or CISA KEV entry has been identified at time of analysis, and Oracle's cspusep2026 Critical Patch Update is the authoritative fix source.
Oracle Database Server releases 23.4.0 through 23.26.3 contain a flaw in the RDBMS component that allows a low-privileged database account holding the Create Table privilege to escalate to full takeover of the database engine over Oracle Net. The attack is network-reachable, requires no user interaction, and carries high confidentiality, integrity and availability impact, producing a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied in the source data, so the immediate driver is the combination of a low privilege bar and complete database compromise rather than confirmed in-the-wild activity.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 can be fully taken over by a low-privileged attacker who can reach the deployment server over HTTPS, with high impact to confidentiality, integrity and availability. Oracle rates the flaw 8.8 (AV:N/AC:L/PR:L/UI:N) and describes it as easily exploitable, meaning a valid low-privilege account plus network reachability to the Deployment tier is sufficient — no user interaction and no elevated privileges are required. No public exploit code or CISA KEV entry is associated with this CVE in the supplied intelligence, and no technical root-cause detail (CWE) has been published, so exploitation in the wild is not confirmed.
Full takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by an attacker who already controls a low-privileged account holding the 'Test Manager for Web Apps' role: a crafted HTTP request traverses a privilege boundary and grants control of the platform with high confidentiality, integrity and availability impact (CVSS 8.8). Because the vector is AV:N/AC:L/PR:L/UI:N, exploitation is network-reachable and needs no user interaction but does require valid low-privilege credentials, so credential theft or reuse is the practical entry point. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied with this record.
Oracle Spares Management, a module of Oracle E-Business Suite, contains a flaw in its Internal Operations component that lets a low-privileged authenticated user with HTTP network access take full control of the module. Versions 12.2.3 through 12.2.15 are affected, with a CVSS 3.1 base score of 8.8 reflecting high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis, and no EPSS score was provided, so real-world exploitation status cannot be confirmed from available data.
Authenticated but only low-privileged access to the Oracle Spares Management module in Oracle E-Business Suite 12.2.3 through 12.2.15 is sufficient to seize full control of that module, with high confidentiality, integrity and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The weakness sits in the module's Internal Operations component and is reachable over HTTP with no user interaction required, which makes it practically exploitable by anyone who already holds a valid EBS account. No CISA KEV entry, public exploit code or EPSS score was supplied, so active exploitation and real-world prevalence of attacks remain unconfirmed
Oracle Report Manager, a component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, can be fully taken over by an attacker who holds only a low-privileged account and can reach the application over HTTP. The flaw sits in the Internal Operations component and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity, and availability for the Report Manager component with no user interaction required. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the source data, but the low privilege bar and network reachability make this a strong candidate for post-authentication lateral movement inside an EBS environment.
Oracle Sales Online, a module of Oracle E-Business Suite, can be fully taken over by an attacker who holds only a low-privileged account and can reach the application over HTTP; the flaw sits in the 'Internal Operations' component and is rated 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), with high confidentiality, integrity and availability impact across versions 12.2.3 through 12.2.15. Exploitation needs no user interaction and no elevated privileges, only a valid low-privilege login, making any internet- or partner-facing EBS deployment with this module enabled a realistic target. No public exploit code and no CISA KEV listing were identified at time of analysis, so the immediate driver is exposure and patch lag rather than observed in-the-wild activity.
Oracle Report Manager — the reporting and output-management product within Oracle E-Business Suite — can be taken over by an attacker who already holds a low-privileged account on the same instance and can reach the application tier over HTTPS. Affected releases are E-Business Suite 12.2.3 through 12.2.15, covering a very long-lived branch of the ERP platform (per the EUVD record and Oracle's Critical Security Patch Update advisory). Successful exploitation yields full read, write and denial-of-service impact on the Report Manager component (CVSS 3.1 base 8.8: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no EPSS score, CISA KEV entry, or public proof-of-concept is present in the supplied intelligence, so exploitation status should be treated as unconfirmed.
Oracle Marketing, a module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), contains an easily exploitable flaw in its Audience component that lets a low-privileged attacker with HTTP network access fully compromise the application, resulting in complete loss of confidentiality, integrity, and availability. Oracle's own advisory classifies the issue as takeover-level, and because the attack requires only an authenticated low-privilege account with no user interaction, any tenant with self-service or limited marketing roles should treat it as a priority. No public exploit code or CISA KEV entry was provided in the source data, so active exploitation is not confirmed at time of analysis.
Oracle Alert, a component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, can be taken over by an attacker holding only a low-privileged account with HTTP access to the application. Because the flaw sits in the Internal Operations component and requires no user interaction, any valid low-privilege EBS user can reach it and obtain full read/write control over Alert data and functionality, with high confidentiality, integrity and availability impact (CVSS 8.8). There is currently no public exploit code or confirmed in-the-wild exploitation (no CISA KEV listing), but Oracle's out-of-band Critical Security Patch Update is the only authoritative fix, and internet-exposed EBS deployments should treat the missing authentication boundary as the primary risk.
A low-privileged, network-reachable flaw in the Internal Operations component of Oracle User Management (part of Oracle E-Business Suite 12.2.6 through 12.2.15) lets an attacker who already holds a valid low-privileged account take full control of the User Management module. Successful exploitation yields high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N), effectively amounting to a takeover of the user-provisioning and authorization layer of the ERP. No public exploit code and no CISA KEV listing were identified at time of analysis, so this should be treated as a patch-now, high-severity issue rather than a confirmed active campaign.
Oracle Spares Management, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be fully taken over by a low-privileged attacker who holds a valid account and can reach the application over HTTP. The Internal Operations component fails to properly restrict access, so a single crafted request yields high impact to confidentiality, integrity and availability of the module (CVSS 3.1 base 8.8). No public exploit code or CISA KEV entry has been identified at time of analysis, but because the flaw is trivially automatable and unauthenticated patching windows are absent, Oracle's Critical Security Patch Update should be applied without delay.
Low-privileged authenticated access to Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 is sufficient to fully compromise the platform through a flaw in the Siebel Cloud Manager component that is reachable over HTTP. Successful exploitation produces complete loss of confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), effectively handing the attacker the application and the data it manages rather than merely leaking records. No public exploit code or CISA KEV listing is associated with CVE-2026-83086 at time of analysis, and no EPSS value was supplied, so prioritization rests on the severity of the flaw and the fact that the affected code sits in a cloud-management plane rather than an end-user feature.
Oracle Fusion Middleware Control — the Enterprise Manager-style administration console bundled with Oracle Fusion Middleware — is vulnerable in the Framework component of versions 12.2.1.4.0 and 14.1.2.0.0, allowing a low-privileged user who can reach the console over HTTP to fully compromise it (CVSS 8.8, C:H/I:H/A:H), effectively achieving takeover of the management console itself. Because the console is the administrative nerve center for the middleware stack, a takeover grants a foothold with very broad downstream authority. No CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 contain an easily exploitable flaw in the Runtime Tools component that lets any authenticated low-privileged user reach the portal over HTTP and take full control of the application (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity, and availability impact). An attacker only needs a valid low-privilege account and network reachability to the portal — no user interaction and no elevated privileges are required. Oracle has published a Critical Security Patch Update (cspusep2026) covering the issue; there is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is currently assessed as opportunistic rather than confirmed in the wild.
Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw that lets a low-privileged, authenticated attacker reach the application over HTTP and gain complete control of the WebCenter Sites instance, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N). Because the flaw is rated 'easily exploitable' and requires no user interaction, any organization exposing a WebCenter Sites deployment to a network where attackers can hold even a basic account should treat this as a high priority. There is no evidence of active exploitation (not in CISA KEV), and no public proof-of-concept has been identified at time of analysis; exploitation status is therefore unconfirmed, and Oracle's patch is delivered through the October-2026-cycle Critical Security Patch Update referenced by NVD.
A low-privileged authenticated attacker with HTTP network access can fully compromise Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0, resulting in complete takeover of the application with high confidentiality, integrity, and availability impact. Oracle rates this 8.8 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the attack requires no user interaction, making it remotely exploitable by anyone holding a basic account. No public exploit code, EPSS score, or CISA KEV listing was present in the provided intelligence, so active exploitation is not confirmed at time of analysis.
Low-privileged attackers with network access to the HTTP interface of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can exploit the Report Distribution component to achieve full takeover of the PeopleTools application, with high impact to confidentiality, integrity, and availability. Oracle rates the issue 8.8 under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), characterizing it as easily exploitable because it needs only a basic authenticated account and no user interaction. No public proof-of-concept or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed at time of analysis.
Low-privileged network attackers can fully take over Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 by exploiting a flaw in the Client Bundle component of Oracle Fusion Middleware, with high confidentiality, integrity, and availability impact. The vulnerability is remotely reachable over HTTP with low attack complexity and no user interaction, but requires an authenticated low-privileged account (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N). No CISA KEV listing, public exploit code, or EPSS score was provided in the available intelligence, so active exploitation is not confirmed and the practical threat is currently tied to the likelihood of an attacker obtaining a valid low-privilege account.
Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Client Bundle component that a low-privileged, network-positioned attacker can leverage to take over the affected application, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 8.8). Exploitation requires only a low-privileged account and HTTP access to the product — no user interaction and no elevated privileges — making it a serious risk for internet- or broadly reachable deployments. No public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis, and no EPSS score was provided, so active exploitation is unconfirmed.
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 can be fully taken over by an attacker who holds only a low-privileged account but can reach the product's T3 and IIOP network listeners, as described in Oracle's Critical Patch Update advisory. Because the flaw is rated AV:N/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8), a single authenticated foothold is enough to gain control of the capture application rather than just read data from it. At the time of analysis there is no CISA KEV listing and no public exploit code identified; EPSS data was not supplied, so exploitation likelihood cannot be quantified.
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 can be fully taken over by a low-privileged attacker who can reach the product over HTTP, with high impact to confidentiality, integrity and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The flaw sits in the Client Bundle component of the Oracle Fusion Middleware product and is described by Oracle as easily exploitable, meaning no unusual conditions or user interaction are needed beyond a valid low-privilege account. No public exploit code, EPSS score or CISA KEV listing was present in the provided intelligence, so active exploitation is unconfirmed at time of analysis.
Low-privilege authenticated attackers can escalate to root on HPE Networking EdgeConnect SD-WAN Gateways by abusing an API endpoint, gaining the ability to run arbitrary operating-system commands. The flaw carries a CVSS base score of 8.8 (AV:N/AC:L/PR:L/UI:N), meaning the attacker needs only valid low-privileged credentials and network reachability to the management API — no user interaction is required. Affected branches span EdgeConnect SD-WAN Gateways 9.4.x through 9.7.0.0; no public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis.
Privilege escalation in the EdgeConnect SD-WAN Gateway API lets a remote, authenticated low-privileged user gain administrative rights on the web-management interface, resulting in complete compromise of the gateway (CVSS 8.8, AV:N/PR:L). Affected branches are 9.4.0.0–9.4.8.2, 9.5.0.0–9.5.8.1, 9.6.0.0–9.6.3.1, and 9.7.0.0. No public exploit code, EPSS score, or CISA KEV listing was provided at time of analysis; exploitation requires a valid low-privileged account and reachability of the management API.
A buffer overflow in the underlying operating system of HPE Aruba Networking EdgeConnect SD-WAN Gateways lets an unauthenticated attacker on an adjacent network segment execute arbitrary code as a privileged OS user, resulting in full compromise of the appliance. Affected branches span the 9.4.x, 9.5.x, 9.6.x and 9.7.0.0 release trains (up to 9.4.8.2, 9.5.8.1, 9.6.3.1 and 9.7.0.0 respectively). The vendor describes exploitation as conditional on preconditions outside the attacker's control, and no public exploit code, EPSS score or CISA KEV entry was present in the supplied intelligence at time of analysis.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allow a low-privileged authenticated attacker with HTTP network access to fully compromise the Portal through the Composer component, resulting in complete loss of confidentiality, integrity and availability (CVSS 3.1 base 8.8). Exploitation requires only a valid low-privilege account and a reachable HTTP interface - no user interaction and no elevated privileges - making the barrier to abuse relatively low for anyone with any Portal login. There is no public exploit identified, no CISA KEV listing and no EPSS score provided at time of analysis, so this is currently a patch-now vulnerability rather than a confirmed actively exploited one.
Authenticated low-privileged users can fully take over Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 by sending crafted HTTP requests to the Portlet Services component. Oracle's Critical Security Patch Update rates this 8.8 with complete loss of confidentiality, integrity and availability of the portal, meaning an attacker with any valid low-privilege account can seize control of the application. No public exploit code or CISA KEV listing is known at time of analysis, so exploitation is currently limited to attackers who already hold credentials, though the low attack complexity makes weaponization plausible once a proof of concept surfaces.
Low-privileged attackers with network access can achieve full takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 through a flaw in the OIM Legacy UI component of Oracle Fusion Middleware. Successful exploitation compromises confidentiality, integrity, and availability of the identity platform itself, which typically means control over the accounts, roles, and provisioning workflows it governs. The vulnerability is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N), requires only an authenticated low-privilege session, and no public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
Full takeover of Oracle Identity Manager is achievable by any low-privileged authenticated user who can reach the application's HTTP interface in versions 12.2.1.4.0 and 14.1.2.1.0 (Oracle Fusion Middleware, Core component). The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N, high confidentiality, integrity and availability impact), meaning a single authenticated request chain can hand an attacker administrative control over the identity governance platform. No CISA KEV listing, EPSS score, or public proof-of-concept was supplied in the source data, so exploitation status is currently unconfirmed and no public exploit has been identified at time of analysis.
Oracle Identity Manager (OIM), the identity-governance component of Oracle Fusion Middleware, is exposed to a takeover-level flaw in its Core component affecting versions 12.2.1.4.0 and 14.1.2.1.0. An attacker who holds a low-privileged account and can reach the T3 or IIOP listener over the network can exploit the defect to fully compromise the OIM deployment, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). No public exploit code or CISA KEV entry was present in the supplied intelligence, and the accompanying 'Information Disclosure' tag understates the reported impact — the vector's C/I/A metrics are all High.