A privilege-escalation flaw in Mozilla Firefox's Graphics: CanvasWebGL component lets attacker-supplied web content cross a privilege boundary inside the browser, with high confidentiality, integrity and availability impact. The issue affects Firefox builds prior to 156 and Firefox ESR prior to 153.3, and exploitation requires the victim to load attacker-controlled content (UI:R) but no authentication (PR:N). No public exploit code has been identified and CISA's SSVC assessment records exploitation as 'none', so this is a patch-promptly issue rather than an emergency; the vendor has shipped fixed builds.
Memory-corruption privilege escalation in Mozilla Firefox lets a remote attacker achieve arbitrary code execution at elevated privilege when a victim browses attacker-controlled web content — no account or credentials are required, but the CVSS vector (UI:R) confirms the victim must open the page. Mozilla fixed the flaw in Firefox 156 and Firefox ESR 153.3. No public exploit code and no CISA KEV listing were identified at time of analysis, and CISA's SSVC decision points rate exploitation as 'none' and automatable as 'no', so worm-like or mass-scanning abuse is not currently anticipated.
Privilege escalation in Mozilla Firefox affects all builds prior to Firefox 156 and Firefox ESR 153.3, stemming from use of uninitialized memory inside the Graphics: CanvasWebGL component. A remote attacker who gets a victim to render crafted WebGL canvas content can corrupt memory in the graphics path and potentially escalate privileges or execute arbitrary code in the browser's context — the CVSS vector confirms no authentication is required (PR:N) but user interaction is (UI:R). No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; Mozilla shipped fixes in Firefox 156 and Firefox ESR 153.3 per advisories MFSA2026-90 and MFSA2026-93.
A memory-safety flaw in Firefox's Audio/Video component - a classic out-of-bounds write/overflow class issue caused by incorrect boundary checking - lets an attacker who convinces a user to open a crafted page or media file corrupt memory and escalate privileges to the level the browser process runs at. The issue affects Firefox branches prior to 156 and Firefox ESR prior to 153.3, and is reachable without authentication but requires user interaction. Mozilla has released fixed builds (Firefox 156, Firefox ESR 153.3) via advisories MFSA2026-90 and MFSA2026-93; there is no public exploit identified at time of analysis and CISA SSVC records exploitation as 'none'.
Privilege escalation in Mozilla Firefox's DOM: Service Workers component lets attacker-supplied web content break out of its intended privilege boundary and gain elevated capabilities inside the browser. The flaw affects Firefox before 156 and the ESR branches before 115.41, 140.16, and 153.3, and carries a CVSS base score of 8.8 with a user-interaction requirement (the victim must load attacker-controlled content). No public exploit code has been identified and CISA's SSVC assessment records exploitation as 'none' with 'automatable: no', so this is a high-severity patch-now issue rather than a known exploited threat.
Privilege escalation in the Mozilla Firefox DevTools component allows code running in a lower-privileged context to cross the DevTools/chrome privilege boundary and execute with elevated browser privileges; Firefox 156 and Firefox ESR 153.3 contain the fix. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and classified CWE-269 (Improper Privilege Management), but CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', and no public exploit code or KEV listing was observed at time of analysis. Notably, the network attack vector with user interaction suggests a page-delivered trigger rather than purely local DevTools misuse, though the advisory itself is terse.
Improper privilege management in Mozilla Firefox's Enterprise Policies component lets a remote attacker escalate privileges inside the browser after convincing a user to interact with malicious content (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). Successful exploitation yields high confidentiality, integrity and availability impact across the browser's security boundary, although CISA's SSVC assessment rates the flaw as not automatable and with no known exploitation. Fixes ship in Firefox 156 and Firefox ESR 153.3; no public exploit code or KEV listing has been identified at time of analysis.
Privilege escalation in Mozilla Firefox's Session Restore component (CWE-269) allows an attacker who lures a user into viewing crafted content to escape the normal browser security boundary and obtain elevated privileges inside the browser process. The issue is fixed in Firefox 156 and Firefox ESR 153.3, and the 8.8 rating reflects a network-delivered, unauthenticated attack that nonetheless requires victim interaction. No public exploit code or CISA KEV entry has been identified at time of analysis, so this is currently a patch-now flaw rather than a confirmed in-the-wild campaign.
A privilege-escalation flaw in Firefox's Crash Reporting component lets an attacker who can influence crash-report handling gain elevated privileges on the affected host, potentially leading to full compromise of confidentiality, integrity and availability. Exploitation is unauthenticated at the network layer (PR:N) but requires victim interaction (UI:R), and affects Firefox builds prior to 156 and Firefox ESR prior to 153.3. There is no public exploit identified at time of analysis, CISA KEV does not list this CVE, and CISA's SSVC framework rates exploitation as 'none' with automatable 'no', indicating a serious but not currently weaponized issue.
Memory corruption via use-after-free in Microsoft Edge (Chromium-based) lets a remote attacker run arbitrary code at elevated privilege in the browser and ultimately on the host, provided the victim opens attacker-controlled content. Microsoft scores it 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so no credentials are needed but a single user visit is — a classic one-click browser exploitation pattern rather than a zero-click worm. The intelligence feed contains no EPSS score, no CISA KEV listing, and no public exploit reference, so at time of analysis this is a high-severity but not yet observed-exploited issue.
Heap-based buffer overflow in Microsoft Edge (Chromium-based) versions 1.0.0.0 through 153.0.4234.32 allows remote attackers to execute arbitrary code in the browser by getting a victim to load attacker-controlled web content. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no authentication or privileges are needed but successful exploitation requires user interaction such as visiting a crafted page or opening malicious content rendered by Edge. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but a vendor patch is available from Microsoft and the affected range is bounded precisely by the fixed build, so exposure is limited to unpatched or unmanaged installations.
Use-after-free in the V8 JavaScript engine of Google Chrome desktop builds prior to 153.0.8010.47 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Because the CVSS vector is PR:N/UI:R, no credentials or special browser configuration are required, but the victim must actively navigate to attacker-controlled content; the memory-corruption primitive is confined to the renderer process, so full host compromise would require a second, independent sandbox-escape vulnerability. No public exploit code has been identified at time of analysis, and the vendor has released a fixed build, making this a high-priority patch item rather than a confirmed active-exploitation emergency.
Type confusion in Chrome's CacheStorage implementation in builds prior to 153.0.8010.47 lets a remote, unauthenticated attacker execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page. The bug is rated High by Chromium and 8.8 by NVD (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but it is a renderer-level compromise rather than a sandbox escape, so host impact requires chaining a second vulnerability. No CISA KEV listing and no public exploit code were identified at time of analysis, and no EPSS score was supplied in the input data.
Remote code execution inside the renderer sandbox can be triggered in unpatched Google Chrome builds by a use-after-free in the browser's built-in PDF rendering component. Exploitation is unauthenticated (CVSS PR:N) but requires the victim to open a crafted HTML page that embeds malicious PDF content (UI:R), and any resulting code execution is confined to Chrome's renderer sandbox - meaning this bug alone does not compromise the host and would typically need to be chained with a separate sandbox-escape flaw for full system compromise. A vendor patch is available in Chrome 153.0.8010.47; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, though the 8.8 CVSS score and the ubiquity of Chrome make timely patching a priority.
Use-after-free in Chrome's DOM implementation allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page in Chrome versions prior to 153.0.8010.47. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is rated High by Chromium security severity; a vendor patch is available and no public exploit code or CISA KEV entry was identified at time of analysis.
Remote code execution inside the renderer sandbox affects Google Chrome desktop builds prior to 153.0.8010.47, caused by a type confusion flaw in the browser's compositing pipeline (CWE-843) that is reachable from a crafted HTML page. An attacker needs only to convince a user to load the page: the CVSS 3.1 vector is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), so no credentials or privileges are required, but user interaction is mandatory. Google rates the issue Chromium security severity High and has shipped a fixed stable-channel build; no public exploit code or CISA KEV listing appears in the supplied intelligence, and no EPSS score was provided, so the current exploitation picture is best described as patch-now-but-not-known-exploited.
Use-after-free in Google Chrome's Input handling allows a remote attacker to achieve code execution in affected desktop builds prior to 153.0.8010.47. Exploitation is unauthenticated (PR:N) but requires the victim to render attacker-controlled HTML (UI:R), making drive-by or malicious-page delivery the primary vector; default configurations are affected with no non-default prerequisites. The vulnerability is rated CVSS 8.8 (C:H/I:H/A:H) and a vendor patch is available in the Stable channel build 153.0.8010.47; no public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).
A use-after-free in Google Chrome's Internals component allows a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim opens a crafted HTML page, affecting all Chrome builds prior to 153.0.8010.47 on desktop. Exploitation requires user interaction (visiting the page) but no authentication or elevated privileges, and Google rates the Chromium security severity as Critical. Vendor-released patch: 153.0.8010.47. There is no public exploit code identified at time of analysis and no confirmed actively exploited (CISA KEV) status, though the SSVC framework assigns total technical impact.
Type confusion in Chrome's ServiceWorker implementation allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by enticing a victim to load a crafted HTML page in any Chrome build prior to 153.0.8010.47. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) - the victim must visit or be redirected to attacker-controlled content - and the resulting code execution is confined to the sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape flaw. There is no public exploit identified at time of analysis, and a vendor-released patch (153.0.8010.47) is available, making this a high-priority but practically bounded patching task rather than an urgent zero-day response.
An out-of-bounds write in Google Chrome's ServiceWorker implementation allows remote code execution inside the browser's renderer sandbox when a victim loads a crafted HTML page; exploitation requires the user to visit or be redirected to attacker-controlled content and to have a service worker exercised (UI:R, PR:N), so no credentials or pre-existing privileges are needed. Successful exploitation yields high confidentiality, integrity and availability impact within the sandboxed renderer process (CVSS 3.1 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and host compromise would additionally require a separate sandbox-escape. Only Chrome builds prior to 153.0.8010.47 are affected, a vendor patch is available, and no public exploit code has been identified at time of analysis; because Chrome auto-updates in the background, most installations will remediate themselves quickly, though managed and long-lived sessions should be verified.
Type confusion in Google Chrome's ServiceWorker implementation before version 153.0.8010.47 allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by getting a user to open a crafted HTML page. The flaw carries a CVSS base score of 8.8 (AV:N/AC:L/PR:N/UI:R), the classic memory-corruption profile for Chrome renderer bugs, and Google rated it High in its Chromium severity scheme. A vendor patch shipped in the 153.0.8010.47 stable release, and there is no public exploit code identified and no CISA KEV entry at time of analysis, so this is a prioritise-and-patch issue rather than a confirmed active campaign.
Authenticated low-privileged attackers who can reach the SQL-facing surface of Oracle Hyperion Financial Management 11.2.26.0.000 can achieve complete takeover of the application. Oracle's advisory rates this 8.8 with full confidentiality, integrity, and availability impact, and the flaw is described as easily exploitable with no user interaction required. At the time of analysis there is no public exploit code, no CISA KEV listing, and no EPSS score in the supplied intelligence, so this should be treated as a high-severity, patch-now issue rather than a known active campaign.
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an authenticated, low-privileged attacker who reaches the application over the network via HTTP and exploits a flaw in its Security component. Oracle's advisory rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), describing it as easily exploitable with complete loss of confidentiality, integrity and availability. No EPSS score, CISA KEV entry, or public proof-of-concept was supplied in the available intelligence, so active exploitation is unconfirmed; the only vendor reference is the Oracle Critical Security Patch Update advisory.
A low-privileged attacker with network access over HTTP can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000, achieving complete loss of confidentiality, integrity, and availability of the application (CVSS 3.1 base 8.8). The defect resides in the product's Security component and requires only a valid low-privileged account, with no user interaction, making it straightforward to automate once an attacker has a foothold. There is no public exploit identified at time of analysis and no CISA KEV listing, but Oracle's Critical Security Patch Update advisory is the authoritative source for the fix.
Low-privileged authenticated attackers with HTTP network access can exploit the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 to fully take over the application, with high impact to confidentiality, integrity and availability. Oracle scores the flaw 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is low-complexity once a valid low-privilege account exists, and a fix is published through Oracle's Critical Patch Update process. No public exploit code or CISA KEV entry has been identified at the time of analysis, and no EPSS score was supplied.
Authenticated low-privileged attackers with HTTP access can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000 through a flaw in the product's Security component, gaining complete control of confidentiality, integrity and availability (CVSS 8.8). The issue is easily exploitable once a valid account exists — low complexity, no user interaction — and results in takeover of the HFM application rather than a limited data leak. No EPSS score, CISA KEV entry, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed and no public exploit code was identified at time of analysis.
A flaw in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 lets a low-privileged attacker who can reach the service over the network take full control of the application via SQL-based manipulation. Oracle's Critical Security Patch Update rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity and availability with no user interaction. There is no CISA KEV listing and no public exploit code identified at time of analysis, so the immediate driver is the fully-compromised-outcome severity for any internet- or partner-exposed HFM deployment, not observed attacks.
Authenticated low-privileged attackers with HTTP access to Oracle Hyperion Financial Management 11.2.26.0.000 can fully compromise the application through a flaw in its Security component, gaining complete control over confidentiality, integrity and availability of the platform. Oracle rates this 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and describes it as 'easily exploitable', meaning a valid low-privilege account is the main barrier rather than technical complexity. No public exploit code, EPSS score, or CISA KEV listing was provided in the intelligence feed, so exploitation status is 'no public exploit identified at time of analysis' — but the low attack complexity and the sensitivity of financial consolidation data make this a priority for internet- or intranet-exposed HFM deployments.
Unauthenticated attackers positioned on a network segment adjacent to an Oracle Hyperion Financial Management server can fully compromise the application, resulting in complete loss of confidentiality, integrity and availability (CVSS 3.1 base 8.8). Only version 11.2.26.0.000 is identified as affected, and Oracle's September 2026 Critical Patch Update advisory is the sole reference. No public exploit code, EPSS score, or CISA KEV listing is present in the available data, so active exploitation is not confirmed.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an authenticated low-privileged attacker reach the application over HTTP and escalate to full takeover of the HFM instance, with high impact to confidentiality, integrity and availability. The vulnerability is trivially automatable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), meaning any valid low-rights account becomes a stepping stone to administrative control of the financial consolidation platform. Exploitation status at time of analysis: no public exploit identified and no CISA KEV listing; no EPSS score or CWE classification was supplied with the source data.
Local privilege escalation in Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a valid low-privileged logon on the host running the application take over the product, with a scope change indicating the compromise can extend to interconnected systems. Successful exploitation yields full confidentiality, integrity and availability impact — this is a takeover-class flaw, not merely an information leak. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was provided with the record.
Low-privileged attackers with HTTP network access can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000 through a flaw in its Security component, achieving high impact to confidentiality, integrity, and availability (CVSS 8.8). The vulnerability is easily exploitable with no user interaction, and successful exploitation can result in complete takeover of the HFM application and the financial consolidation data it manages. At time of analysis there is no public exploit code identified and the issue is not listed in CISA KEV, though the low attack complexity means weaponization risk is meaningful; Oracle addressed it in its April 2026 Critical Patch Update advisory.
Oracle Hyperion Financial Management 11.2.26.0.000 can be taken over by a low-privileged attacker who can reach the application's HTTP interface, because the Security component does not properly restrict what an authenticated but unprivileged session can do. Successful exploitation yields full compromise of confidentiality, integrity and availability of the HFM application, meaning an attacker could read, alter or destroy financial consolidation data and gain administrative control of the deployment. The flaw is rated 8.8 on CVSS 3.1; no public exploit code or CISA KEV listing was present in the source data at time of analysis, so this is currently a patch-now, monitor-for-exploitation issue rather than a confirmed actively exploited one.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a security-component flaw that lets a low-privileged, network-connected user take full control of the application over HTTP. Per the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), exploitation requires only a valid low-privilege account and no user interaction, but delivers complete compromise of confidentiality, integrity and availability. There is no public exploit code or CISA KEV entry in the supplied intelligence at time of analysis; the only consolidated signal is Oracle's own security alert, and separate risk scores (EPSS) were not provided.
Authenticated low-privileged attackers with HTTP access to Oracle Contract Lifecycle Management for Public Sector (part of Oracle E-Business Suite, V16) can escalate their privileges and achieve full takeover of the Contract Lifecycle Management application, affecting confidentiality, integrity and availability of contract data (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The flaw sits in the "ECC For Award and IDV" component, which is exposed over the web and requires only an ordinary user account rather than administrative rights. At time of analysis there is no public exploit code identified and the issue has not been added to CISA KEV, but Oracle rates it "easily exploitable," so patching on the vendor's published patch-update timeline is the priority.
Low-privileged attackers holding a valid Oracle E-Business Suite account can take over the Oracle Purchasing module (versions 12.2.3 through 12.2.15) by sending crafted HTTP requests to the application's web interface, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N). No user interaction or elevated privilege is needed beyond a basic authenticated session, making the flaw trivially automatable once credentials exist. At time of analysis there is no public exploit code identified and the issue is not listed in CISA KEV; no EPSS score was supplied in the source data. Oracle has published a Critical Security Patch Update advisory (September 2026) covering the affected releases.
Any low-privileged, authenticated user with HTTP access to the Oracle Contract Lifecycle Management for Public Sector module (Award/PO component) of Oracle E-Business Suite 12.2.13 through 12.2.15 can fully take over the application, with high impact to confidentiality, integrity and availability. The flaw is trivially reachable over the network with no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), meaning a compromised or malicious internal account is enough to reach contract and award data and to manipulate application state. At time of analysis there is no public exploit identified and no CISA KEV listing, so the immediate risk is driven by the large installed base of EBS and the low skill barrier implied by the vector; Oracle has published a Critical Security Patch Update advisory covering the fix.
Full takeover of Oracle Product Hub within Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged attacker who can reach the module's HTTP interface, with CVSS 8.8 reflecting high confidentiality, integrity, and availability impact across the whole affected application. Exploitation requires only a valid low-privileged EBS session and network access to HTTP — no user interaction and no administrative privileges. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle's Critical Security Patch Update at oracle.com/security-alerts/cspusep2026.html is the only patch reference provided.
Authenticated attackers holding a low-privileged Oracle E-Business Suite account can fully take over the Bills of Material module in versions 12.2.3 through 12.2.15, achieving high impact against confidentiality, integrity, and availability (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw lives in the module's Setup Workbench component and needs only HTTP reachability plus a valid low-privilege login — no victim interaction — making it a strong privilege-escalation stepping stone for anyone with a foothold in the EBS environment. Oracle documents the issue in its September 2026 Critical Security Patch Update advisory; no public exploit code, EPSS score, or CISA KEV entry accompanies this record, so active exploitation is unconfirmed and no public exploit was identified at time of analysis.
Oracle Contracts, a module within Oracle E-Business Suite 12.2.14-12.2.15, allows a low-privileged authenticated attacker with HTTP network access to take over the Contracts component, resulting in high confidentiality, integrity, and availability impact (CVSS 8.8). The flaw requires any valid low-privilege account but no user interaction or elevated rights, and it works against default configurations of the affected versions, so the primary limiting factor is obtaining an authenticated foothold on the EBS instance. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though the combination of low privileges, network reach, and full component takeover places it in a high-priority tier rather than the pre-authentication maximum tier.
Component takeover in Oracle E-Business Suite's Demand Signal Repository (supported releases 12.2.3 through 12.2.15) lets an authenticated, low-privileged attacker reachable over HTTP (PR:L, network vector) seize control of the affected module, with full confidentiality, integrity and availability impact (CVSS 3.1 base 8.8). The flaw sits in the Internal Operations component of the Demand Signal Repository and requires no user interaction, making it straightforward to trigger once a valid low-privilege session or role is obtained. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the Oracle Critical Security Patch Update advisory is the only authoritative reference and no EPSS score was supplied, so real-world exploitation likelihood is unquantified. Oracle E-Business Suite operators running the affected module should treat the corresponding Critical Patch Update as the remediation path.
Application takeover of the Document Management and Collaboration module in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by any authenticated low-privileged user with HTTP access, with high confidentiality, integrity and availability impact. Oracle rates the flaw 8.8 (AV:N/AC:L/PR:L/UI:N) because the attack is simple, needs no user interaction, and defeats the authorization boundary around the module's internal operations. No public exploit code or CISA KEV entry is identified at time of analysis, but the low privilege bar combined with broad enterprise EBS deployment makes this a patch-now item.
Low-privileged attackers with HTTPS network access can fully compromise the Internal Operations component of Oracle Complex Maintenance, Repair and Overhaul (CMRO) in Oracle E-Business Suite versions 12.2.3 through 12.2.15, achieving complete confidentiality, integrity, and availability impact on the affected module. The flaw carries a CVSS 3.1 base score of 8.8 and requires only an authenticated network session (PR:L) with no user interaction, making it a straightforward lateral escalation for any user holding a valid low-privilege EBS account. At time of analysis there is no public exploit code, no CISA KEV listing, and no EPSS data provided, so risk is driven by the exposed attack surface of internet- or intranet-reachable EBS deployments rather than confirmed active exploitation.
Oracle Product Hub, a module of Oracle E-Business Suite, contains a flaw in its Internal Operations component that lets a low-privileged attacker with HTTP network access take over the Product Hub application. Supported releases 12.2.3 through 12.2.15 are affected, and successful exploitation yields high confidentiality, integrity and availability impact across the module. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, though Oracle treats this class of flaw as remotely exploitable and easily abused, making prompt patching of internet- or intranet-exposed E-Business Suite deployments important.
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Fusion Middleware Security Framework component that lets a low-privileged attacker who can reach the IDE over HTTP achieve a full takeover of the product, with high confidentiality, integrity, and availability impact. Oracle rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation needs a valid low-privilege account but no user interaction or elevated privilege. There is no public exploit code identified and no CISA KEV listing at time of analysis, and no EPSS score was supplied, so the immediate operational risk is driven mainly by exposure of JDeveloper HTTP services rather than by observed exploitation.
Full compromise of Oracle Coherence is achievable by low-privileged attackers who can reach the Coherence Core HTTP interface, affecting versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 of the Oracle Fusion Middleware product. Successful exploitation gives complete loss of confidentiality, integrity and availability — Oracle describes the outcome as "takeover of Oracle Coherence" — with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N). No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score was supplied with the source data, so the practical urgency currently rests on the size of the exposed Coherence estate rather than on observed exploitation.
Oracle Coherence, Oracle's in-memory data grid shipped as part of Fusion Middleware, can be fully taken over by a low-privileged attacker who can reach the cluster over the network in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The flaw sits in the Core component and is rated by Oracle as easily exploitable — CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) — with confidentiality, integrity and availability all fully impacted, meaning compromise of the Coherence cluster rather than a narrow data leak. No EPSS score, CISA KEV entry or public exploit code was provided with this record; the only authoritative source is Oracle's Critical Security Patch Update advisory, so treat exploitation status as unconfirmed (no public exploit identified at time of analysis).
Oracle Database Server's RDBMS engine can be fully compromised by any database account holding the CREATE DATABASE LINK privilege, affecting releases 19.3–19.32, 21.3–21.23 and 23.4.0–23.26.3. The flaw is reachable over Oracle Net with no user interaction and yields complete confidentiality, integrity and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N), i.e. full takeover of the RDBMS rather than a narrow data leak. Oracle has published a fix through its security advisory referenced by NVD; no public exploit code, EPSS score or CISA KEV entry was supplied, so there is no evidence of active exploitation at time of analysis.
Oracle Identity Manager (OIM) releases 12.2.1.4.0 and 14.1.2.1.0, shipped as part of Oracle Fusion Middleware, contain a flaw in the Security component that lets an attacker holding a low-privileged account reach the application over HTTP and take full control of the identity platform. Oracle rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting complete loss of confidentiality, integrity and availability with no user interaction required. No public exploit code or CISA KEV entry was available at time of analysis, so exploitation is assessed as plausible but not yet observed in the wild.
Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in takeover of Oracle Applications Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).