Remote, unauthenticated attackers can crash any FreeRDP-based RDP server running a version prior to 3.31.0 by sending crafted RDP connection packets that supply zero or oversized DesktopWidth and DesktopHeight values during GCC capability negotiation. The malformed dimensions are used unchecked in multifragment update capability calculations, producing a division-by-zero (CWE-369) or assertion failure that terminates the server process. This is a pure availability impact (CVSS 4.0 base 8.2, VC:N/VI:N/VA:H); no publicly available exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis.
Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 expose an exploitable flaw in the SQR component that lets a low-privileged, authenticated user reach the service over HTTP and read data well beyond their intended authorization while also crashing or repeatedly hanging the application. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) the attacker needs a valid account but no elevated role and no victim interaction, and the confidentiality impact is rated total for data accessible through PeopleTools, with a matching high availability impact from the resulting denial of service. Oracle rates this 8.1 and released it in its Critical Security Patch Update cycle; no EPSS score, CISA KEV listing, or public exploit code was supplied with the source data at time of analysis.
A low-privileged, authenticated attacker with HTTP network access can exploit the Cube Manager component in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 to modify or delete critical data and to repeatedly crash or hang the application, producing a complete denial of service. Oracle rates the flaw 8.1 on the CVSS 3.1 scale with high integrity and availability impact but no confidentiality impact, and the vulnerability requires an existing valid account rather than being exploitable pre-authentication. No public proof-of-concept code or evidence of active exploitation was present in the supplied intelligence at the time of analysis.
Unauthenticated attackers with network access to the HTTP interface of Oracle WebCenter Portal's Portlet Services component can exploit a hard-to-trigger flaw to fully compromise the application, per Oracle's Critical Security Patch Update (cspusep2026). Impact spans confidentiality, integrity and availability (CVSS 8.1), with the stated outcome being complete takeover of WebCenter Portal. Only supported versions 12.2.1.4.0 and 14.1.2.0.0 are listed as affected; no public exploit code or CISA KEV entry was present in the supplied intelligence, and the high attack-complexity metric (AC:H) suggests exploitation requires specific, non-trivial conditions rather than a simple one-shot request.
Unauthenticated remote attackers with HTTP access to Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware can achieve full takeover of the service by exploiting a flaw in the bundled Centralized Thirdparty Jars component. Only versions 12.2.1.4.0 and 14.1.2.0.0 are listed as affected by Oracle's advisory. The flaw carries a CVSS 3.1 base score of 8.1 with a High attack complexity rating, and no public exploit code or CISA KEV entry has been identified at time of analysis, so real-world exploitation appears opportunistic rather than widespread.
Oracle WebCenter Enterprise Capture 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware, Client Bundle component) can be abused by a high-privileged, network-positioned attacker who convinces a second user to interact with a crafted HTTP request, yielding read, creation, modification, and deletion access to critical capture data. Because the CVSS vector carries a scope change (S:C), the impact is not confined to Enterprise Capture itself and can extend to other Fusion Middleware components reachable from the affected deployment. There is no indication of public exploit code or confirmed active exploitation, and no EPSS score was supplied with the source data, so the practical urgency rests mainly on the 8.1 severity, the scope change, and the sensitivity of captured document data.
Unauthenticated network attackers can achieve full takeover of Oracle Access Manager via a difficult-to-trigger flaw in the Authentication Engine component of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this CVSS 3.1 8.1 with High confidentiality, integrity, and availability impact from a network vector requiring no privileges or user interaction, meaning the identity service itself — and the applications it protects — can be fully compromised. No public exploit code and no CISA KEV entry were identified at time of analysis; the AC:H rating indicates the attack requires precise timing or a specific non-default state rather than a trivial repeatable request.
Oracle GraalVM 25.0.4.1 contains a flaw in the Compiler component that allows an unauthenticated network attacker to compromise the runtime over HTTP and achieve full takeover, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.1, AV:N/AC:H/PR:N/UI:N). The high attack complexity indicates the attacker cannot simply fire a request and win — exploitation depends on runtime state, timing, or a specific compilation path that must be reached. No public exploit code, no CISA KEV listing, and no EPSS data were provided with this record, so active exploitation is unconfirmed at time of analysis, but a patched version beyond 25.0.4.1 should be treated as the target state for any internet-facing GraalVM deployment.
Oracle GraalVM 25.0.4.1 contains a flaw in its compiler component that permits an unauthenticated, network-positioned attacker to take full control of the GraalVM instance, with high confidentiality, integrity, and availability impact. Oracle rates it 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and explicitly calls it 'difficult to exploit', implying exploitation depends on precise
Let me synthesize. CVE-2026-91727: Incorrect reference resolution in Extensions in Chrome on Mac prior to 153.0.8010.47. Local attacker who compromised renderer process could execute arbitrary code outside sandbox via a local program. CWE-706 (Use of Incorrectly-Resolved Name or Reference). CVSS 8.1 AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. Product: Google Chrome (macOS). Product name 1-3 words: "Google Chrome". Prevalence: ubiquitous. Now fields. Summary: must not copy description; start with impact verb and product. E.g. "Sandbox escape in Google Chrome on macOS (prior to 153.0.8010.47) lets an attacker who has already compromised the renderer process escalate to code execution outside the browser sandbox..." Technical context: CWE-706 incorrect reference resolution in Extensions — extension API resolves a reference (name/path/identifier) incorrectly, allowing a local program to be loaded/executed outside sandbox. macOS-specific. Renderer compromise prerequisite. Risk assessment: CVSS 8.1 with AV:L AC:H PR:N UI:N S:C. EPSS not provided, KEV not provided. Patch available. No POC known. Attack requires renderer compromise (two-stage). S:C indicates sandbox escape crossing security scope. Not KEV → no public exploit identified at time of analysis. Note missing EPSS/KEV data explicitly. Affected products: Google Chrome on macOS versions prior to 153.0.8010.47; EUVD lists "Chrome 153.0.8010.47 <153.0.8010.47" which is malformed/likely means before 153.0.8010.47. Reference: chromereleases blog, chromium issue 516893912. Remediation: upgrade to 153.0.8010.47 or later. Chrome auto-update. macOS-specific. Compensating controls: restrict extension installs via enterprise policy, disable extensions, etc. Trade-offs. Exploit scenario: attacker chains a renderer RCE (e.g. via malicious web content) then exploits the extension reference resolution flaw to break out of sandbox and run native code on macOS host. Exploitation conditions: requires (1) macOS platform, (2) att
Full takeover of Oracle GraalVM 25.0.4.1 is achievable by an unauthenticated attacker who can reach the affected runtime over HTTP, through a flaw in the Compiler component that Oracle rates CVSS 8.1 with high confidentiality, integrity and availability impact. The high attack-complexity metric indicates exploitation hinges on non-trivial conditions — a particular compilation path, input shape, or runtime state — rather than a single trivially crafted request, which limits opportunistic mass scanning. No public exploit code and no CISA KEV listing are associated with this CVE at time of analysis, and no EPSS score was supplied with the source data.
Oracle E-Business Suite deployments running Oracle Purchasing 12.2.3 through 12.2.15 expose a flaw in which any authenticated low-privileged user can reach a Purchasing web endpoint over HTTP and read, create, modify, or delete critical procurement data they should not be able to touch. With a CVSS 3.1 base of 8.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, no availability impact), the issue is trivial to trigger once a valid EBS account exists, and Oracle treats it as critical in its September 2026 Critical Security Patch Update. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so this reads as a broadly-applicable, low-complexity authorization defect that requires an account rather than as an actively exploited campaign.
Authentication bypass in Oracle Hyperion Financial Management 11.2.26.0.000 allows an unauthenticated attacker positioned on the adjacent network segment to read, create, modify, or delete critical financial consolidation data. Oracle rates it 8.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact. No public exploit code, EPSS score, or CISA KEV listing was included in the available intelligence, so active exploitation is unconfirmed at time of analysis.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged attacker with HTTP access to the application read, create, delete, or alter critical financial consolidation data. Oracle rates it 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning exploitation requires a valid but low-privileged account and no user interaction, but yields both high confidentiality and high integrity impact. No public exploit code or CISA KEV listing is identified in the supplied intelligence, so this is currently a patch-priority issue rather than a confirmed active campaign, though the affected data set is exactly the kind of high-value financial record attackers target.
Oracle Hyperion Financial Management 11.2.26.0.000 exposes a flaw in its Security component that allows an unauthenticated attacker positioned on the same network segment as the HFM server to read and tamper with the application's critical data. Successful exploitation yields high confidentiality and integrity impact — financial consolidation records, metadata and user data can be viewed, created, deleted or modified — while availability is unaffected. Oracle has rated it 8.1 and issued a fix in the cspusep2026 Critical Patch Update; no public exploit code or CISA KEV listing is present in the available intelligence, so active exploitation is not confirmed.
Unauthenticated attackers with network access to the HTTP interface of Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to fully compromise the application, with high impact to confidentiality, integrity and availability (CVSS 8.1). Oracle rates the flaw as difficult to exploit (AC:H), meaning success depends on conditions outside the attacker's control rather than on a trivially repeatable request. No CISA KEV listing, EPSS score or public exploit code was provided in the source data, so active exploitation and weaponization are not confirmed.
Unauthenticated attackers positioned on the same network segment as an Oracle Hyperion Financial Management 11.2.26.0.000 server can exploit a flaw in the product's Security component to modify or destroy critical financial data and to crash the application repeatedly. Oracle rates this at CVSS 3.1 base 8.1 with integrity and availability impact but no confidentiality impact, and the restricted AV:A vector means the attacker must already sit on the physical communication segment attached to the host rather than reaching it over the internet. No public exploit code has been identified and the issue is not listed in CISA KEV, so current risk is concentrated in environments where flat layer-2 networks expose EPM servers to semi-trusted users or adjacent compromised hosts.
Unauthorized creation, deletion, modification, and disclosure of data in Oracle Purchasing (Oracle E-Business Suite 12.2.10 through 12.2.15) is possible for an attacker who holds a valid low-privilege EBS account and can reach the G-Invoicing component over HTTP; the CVSS 3.1 base score is 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting full loss of confidentiality and integrity with no availability impact. The assessment vector confirms the attacker must be authenticated with only low privileges (PR:L) and that no user interaction is required (UI:N), so the public 'Authentication Bypass' tag overstates reachability - this is not accessible to fully unauthenticated actors. There is no KEV listing and no public exploit identified at time of analysis, and the practical target population is narrowed by the requirement that the G-Invoicing module (a U.S. federal intragovernmental buy/sell invoicing feature) actually be in use, which skews exposure toward government and federal-contractor deployments.
Oracle E-Business Suite 12.2.11 through 12.2.15 ships a flaw in the G-Invoicing component of Oracle Purchasing that lets an authenticated, low-privileged user reach data and functions they should not control over plain HTTP. Successful exploitation gives full read and write reach into Purchasing data — creation, modification, and deletion of critical records plus complete disclosure of everything the module can access — with no user interaction required. Oracle rates it CVSS 8.1 (C:H/I:H/A:N, PR:L), but no EPSS score, CISA KEV entry, or public exploit code was present in the supplied intelligence, so active exploitation is unconfirmed and the practical risk is best judged against the wide enterprise footprint of EBS Purchasing.
Oracle Purchasing, the procurement module inside Oracle E-Business Suite 12.2.3 through 12.2.15, fails to properly enforce authorization on HTTP-reachable functionality, letting an authenticated low-privileged user read, create, modify, or delete purchasing data far beyond their intended role. The flaw is rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning no user interaction and only a basic valid account are needed, though the attacker must already be authenticated to the EBS instance. No public exploit code and no CISA KEV entry have been reported at time of analysis, so the immediate threat is assessed as targeted rather than mass-exploited.
Oracle HRMS (India), a localized module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an Internal Operations component that fails to properly enforce authorization, letting a low-privileged authenticated user reach data and functions they should not control. A successful attack gives the attacker the ability to create, delete, or modify critical HR data and to read the full set of HRMS (India) records, with CVSS 3.1 scoring it 8.1 (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N) — high confidentiality and integrity impact but no availability impact. There is no public exploit code or CISA KEV listing at time of analysis, so this is a patch-cycle priority rather than a confirmed in-the-wild emergency.
Authenticated low-privileged users with network HTTP access can fully compromise Order Management data in Oracle E-Business Suite 12.2.4 through 12.2.15, gaining unauthorized read, creation, deletion, and modification of any Order Management data reachable through the Product Diagnostic Tools component. Rated CVSS 3.1 base 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the issue needs only a valid low-privileged account, no user interaction, and no elevated privileges, so any authenticated foothold on the instance is enough; there is no availability impact and no scope change. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), though no EPSS score was provided in the source data.
In Oracle Product Hub — the product information management module of Oracle E-Business Suite — the Internal Operations component mishandles authorization, letting a low-privileged user who can reach the application over HTTP create, delete or modify critical records and read all Product Hub data they should not see. Every supported release from 12.2.3 through 12.2.15 is affected; the flaw carries a CVSS 3.1 base score of 8.1 (C:H/I:H/A:N) with no user interaction required. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle rates it 'easily exploitable' and a routine authenticated HTTP request is the only delivery mechanism needed.
Oracle Product Hub within Oracle E-Business Suite 12.2.3 through 12.2.15 exposes an authorization weakness in the Internal Operations component that lets a low-privileged attacker with network access over HTTP read, create, modify, or delete critical Product Hub data beyond their intended privileges. The flaw carries a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning no user interaction is required but a valid low-privileged account is. No public exploit code and no CISA KEV listing were identified at time of analysis; the only authoritative source is Oracle's Critical Security Patch Update advisory (cspusep2026).
Oracle E-Business Suite's Installed Base module (Create Item Instance component) in supported versions 12.2.3 through 12.2.15 allows an authenticated but low-privileged user with HTTP access to the application to read, create, modify, or delete critical Installed Base records, yielding high confidentiality and integrity impact with no availability impact. Oracle rates this 8.1 on CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) and describes it as easily exploitable, meaning the attack path is straightforward once a valid low-privilege account and network reachability exist. There is no public exploit identified at time of analysis, and no EPSS score, CISA KEV listing, or proof-of-concept reference was supplied in the intelligence feed.
Oracle Work in Process, a module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), exposes a flaw in its Workbenches component that lets an unauthenticated attacker on an adjacent network segment read and modify critical data without any credentials or user interaction. Per the vendor's advisory the issue is 'easily exploitable,' so anyone with a presence on the same physical communication segment as the Oracle WIP application server can tamper with or extract manufacturing/Work-in-Process records. No CISA KEV listing, EPSS score, or public exploit code was present in the supplied intelligence, so confirmed active exploitation cannot be asserted at this time.
Unauthenticated attackers with network reach to the Mobile Application Server of Oracle E-Business Suite can fully take over the MWA Terminal Server component in supported 12.2.3 through 12.2.15 releases, gaining high impact across confidentiality, integrity and availability. Exploitation is rated high-complexity (AC:H) but requires no credentials and no user interaction, and Oracle scores it 8.1. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided, so the current real-world exploitation picture is unconfirmed.
Oracle E-Business Suite's Demand Signal Repository component (versions 12.2.3 through 12.2.15) contains an access-control weakness that lets a low-privileged, network-positioned user reach Internal Operations functionality over HTTP and perform unauthorized creation, deletion, or modification of critical DSR data while also triggering a hang or repeated crashes for a complete denial of service. Rated CVSS 3.1 base 8.1 (AV:N/AC:L/PR:L/UI:N, Integrity and Availability High), the flaw requires a valid low-privileged account but no user interaction. There is no public exploit code identified and the issue is not listed in CISA KEV; no EPSS score was supplied with the intelligence feed.
Oracle Demand Signal Repository, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, contains a flaw in its Internal Operations component that lets a low-privileged, authenticated user reach network-exposed HTTP functionality and read or alter data well beyond their intended authorization level. Successful exploitation yields high confidentiality and integrity impact - unauthorized creation, deletion, modification of, and full read access to, critical Demand Signal Repository data. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, though the low privileges required and network attack vector make it attractive for insider or compromised-account abuse.
Low-privileged Oracle E-Business Suite accounts can read and modify all Bills of Material data by reaching the Internal Operations component of Oracle Bills of Material over HTTP in versions 12.2.3 through 12.2.15 (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). The flaw is rated easily exploitable, but it is not pre-authentication: an attacker must first hold a valid low-privileged EBS account, which is the primary limiting factor, and no user interaction or elevated privileges are needed. Impact is confined to confidentiality and integrity - creation, deletion, modification and disclosure of Bills of Material-accessible data - with availability unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Oracle Bills of Material, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an Internal Operations component that fails to properly restrict what a low-privileged authenticated user can do over HTTP. An attacker holding any valid low-privilege E-Business Suite account can send crafted HTTP requests that read all Bills of Material data and create, delete, or modify it, giving full confidentiality and integrity compromise of the module's records without any user interaction. At the time of analysis there is no CISA KEV listing, no public exploit code identified, and no EPSS score supplied, so the practical near-term risk is driven by whether the target EBS instance is internet-facing or reachable from a compromised low-privilege account.
Low-privileged users of Oracle E-Business Suite 12.2.3 through 12.2.15 can read and modify critical Financials Common Modules data by sending crafted HTTP requests to a vulnerable Common Components endpoint, with no user interaction required. Oracle scores the flaw 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact. No public exploit code or CISA KEV entry has been identified at time of analysis, although the low attack complexity and the fact that only a normal authenticated session is needed make weaponization plausible and patch urgency high.
An authentication/authorization bypass in Oracle Helidon's helidon-security-providers-idcs-mapper component (versions 3.0.0–3.2.20 and 4.0.0–4.5.4) lets a low-privileged attacker with network access over HTTP impersonate or over-privilege an identity mapped from Oracle Identity Cloud Service, gaining unauthorized read and modification access to critical application data. Oracle's advisory rates it CVSS 8.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, no availability impact). No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, but the flaw is trivially automatable against any Helidon service that enables the IDCS mapper, so internet-facing deployments should be treated as high priority.
Oracle Product Workbench, a module within Oracle E-Business Suite, permits a low-privileged attacker who already holds a valid account and HTTP network access to read, create, delete, or modify critical business data across the module's Internal Operations component, affecting supported releases 12.2.3 through 12.2.15. With CVSS 8.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, no availability impact), exploitation requires only an authenticated session rather than user interaction or a race condition. No public exploit code, POC, or CISA KEV entry has been identified at time of analysis, and no EPSS score was supplied, so the current risk is driven by the low skill barrier and the sensitivity of ERP data rather than confirmed active exploitation.
Oracle Depot Repair, a module of Oracle E-Business Suite, exposes the Estimate and Actual Charges component to a low-privileged, authenticated attacker who can reach the application over HTTP. Because the component fails to enforce proper authorization on its data operations, a successful attack grants full read and write access to charge records that the user should never be able to see or change, giving a broad confidentiality and integrity impact across all Depot Repair data. Oracle rates this 8.1 against versions 12.2.3 through 12.2.15; no public exploit code or CISA KEV entry is associated with the issue at the time of analysis, and no EPSS score was supplied with the intelligence feed.
Low-privileged users with network access to Oracle E-Business Suite's Product Workbench component (Internal Operations) can read, create, modify, and delete critical business data across the full 12.2.3–12.2.15 release range. Oracle rates this 8.1 with a network-accessible, low-complexity, no-user-interaction vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning a valid but unprivileged account is enough to reach full confidentiality and integrity impact on Product Workbench data, with no availability impact. No CISA KEV listing, no public exploit code, and no EPSS score were provided in the source data, so current exploitation activity is unconfirmed — though Oracle CPU-class issues in EBS are historically targeted by attackers who already hold a foothold account.
Oracle Demand Signal Repository, a component of Oracle E-Business Suite versions 12.2.3 through 12.2.15, can be compromised by a low-privileged attacker with network access over HTTP, leading to unauthorized read, creation, deletion, or modification of the module's critical data. Oracle rates the flaw CVSS 3.1 8.1 (AV:N/AC:L/PR:L/UI:N, high confidentiality and integrity impact, no availability impact), meaning exploitation is straightforward but requires some level of authenticated access. There is no public exploit code identified and no CISA KEV listing at time of analysis; the vulnerability is addressed through Oracle's Critical Security Patch Update process referenced in the advisory.
Oracle E-Business Suite 12.2.3 through 12.2.15 ships a Demand Signal Repository module whose Internal Operations component fails to enforce proper authorization, letting any holder of a low-privileged account read, create, modify, or delete critical records through ordinary HTTP requests. Oracle's CVSS 8.1 rating reflects full confidentiality and integrity impact with no availability impact, and the flaw is rated easily exploitable because it needs only network reachability, no user interaction, and a low-privileged login. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so exploitation is currently a patch-window problem rather than a confirmed active campaign.
Unauthenticated remote attackers can obtain complete read and write access to Oracle Identity Manager's OIM Legacy UI component in supported versions 12.2.1.4.0 and 14.1.2.1.0, enabling unauthorized creation, deletion and modification of critical identity data as well as full disclosure of OIM-accessible data (CVSS 3.1 base score 8.1, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). The decisive limiting factor is the UI:R requirement: a legitimate OIM user or administrator must be induced to interact with attacker-supplied content over HTTP, which makes this a targeted social-engineering vector rather than a fully automated one, and there is no availability impact. No public exploit has been identified at time of analysis, and Oracle published the issue as part of its September 2026 Critical Patch Update, which is the authoritative remediation source; the issue is tracked in the EU as EUVD-2026-79722.
Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contain a flaw in the Core component that allows a low-privileged attacker with TCP network access to create, delete, or modify critical clustered data and to read all data accessible to Coherence. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) yields a base score of 8.1, reflecting complete confidentiality and integrity loss with no availability impact and no user interaction. No public exploit code and no CISA KEV entry were present in the supplied intelligence at time of analysis, so exploitation status remains unconfirmed rather than actively exploited.
Unauthenticated database takeover is possible in Oracle Database Server RDBMS releases 23.4.0 through 23.26.3 via crafted traffic sent to the Oracle Net listener. Per the Oracle-supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), an attacker with network reachability can fully compromise confidentiality, integrity and availability of the RDBMS without credentials or user interaction, though Oracle characterizes the flaw as 'difficult to exploit' (AC:H). There is no public exploit code and no CISA KEV listing at time of analysis, so this is a patch-now enterprise hygiene issue rather than a confirmed active campaign.
Low-privileged remote attackers can compromise Oracle BI Publisher through its SOAP-based Web Service API, gaining unauthorized ability to create, delete or modify critical report data and to repeatedly crash the service for a complete denial of service. The affected versions are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0, and the flaw carries a CVSS 3.1 base score of 8.1 (network vector, low complexity, low privileges required, no user interaction). No public exploit code has been identified and the vulnerability is not listed in CISA KEV, although enterprise reporting platforms of this kind are attractive targets once technical details become public.
Oracle BI Publisher (part of Oracle Analytics) is affected by a network-reachable flaw in its BI Platform Security component that lets a low-privileged, authenticated attacker via SOAP tamper with or delete critical reporting data and repeatedly crash the service, enabling a full denial of service. Versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 are listed as affected, and the vendor rates it 8.1 with high integrity and availability impact while confidentiality is untouched. No public exploit code or CISA KEV listing was present in the supplied intelligence, and EPSS data was not provided, so real-world exploitation status is unconfirmed.
Unauthenticated attackers with network reachability to the Analytics Web component of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 can exploit a hard-to-trigger flaw to fully compromise the platform, achieving high confidentiality, integrity and availability impact consistent with a complete takeover. Oracle rates this CVSS 3.1 base 8.1 with attack complexity High, meaning exploitation depends on conditions outside the attacker's direct control rather than simply sending a request. No public exploit code has been identified and the issue is not listed in CISA KEV, so measured risk is driven by exposure of the Analytics Web HTTP interface rather than by observed in-the-wild activity.
Oracle BI Publisher (Oracle Analytics, BI Platform Security component) in versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0 permits a low-privileged attacker with network reach to the LDAP-facing interface to read, create, delete or modify critical BI Publisher data, effectively breaking the authorization boundary between a basic account and the full reporting repository. Oracle scores this 8.1 with high confidentiality and integrity impact, low attack complexity and no user interaction, making it trivially automatable once a low-privileged credential is held. No public exploit code and no CISA KEV listing were present at time of analysis, and no EPSS score was supplied, so real-world exploitation is currently unmeasured rather than confirmed.
Unauthenticated network attackers can achieve complete takeover of Oracle Business Intelligence Enterprise Edition (Analytics) by exploiting a flaw in the Platform Security component of versions 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Oracle describes the flaw as 'difficult to exploit' but rates it 8.1 with full confidentiality, integrity and availability impact, so a successful attack means total loss of control over the BI platform and the analytical data it exposes. No EPSS score, KEV listing or public exploit code is present in the input, so there is no public exploit identified at time of analysis, though the unauthenticated network vector makes patching urgent for internet- or intranet-exposed deployments.
Unauthenticated remote takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is possible through the Forge component, which an attacker reachable over HTTP can abuse to gain full control of the platform (confidentiality, integrity and availability all rated High). Oracle scores it 8.1 with a High attack complexity, meaning the attack is feasible but requires favorable timing or a specific internal state rather than a trivial one-shot request. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is currently a patch-now risk rather than an observed campaign.
Unauthenticated attackers with network access to the Forge indexing component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 can achieve complete takeover of the platform, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.1). Oracle rates the flaw as difficult to exploit (AC:H), so it likely requires precise protocol knowledge, timing, or a race condition rather than a simple one-shot request. No public exploit code or CISA KEV listing is present in the available intelligence, and no EPSS score was supplied, so the practical exploitation likelihood remains unquantified.
Unauthenticated network attackers can achieve full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 through the Forge component, causing complete loss of confidentiality, integrity and availability of the platform. Oracle's own rating (CVSS 8.1, AV:N/AC:H/PR:N/UI:N) concedes the flaw is 'difficult to exploit', meaning a non-trivial timing or state precondition must be satisfied before the crafted TCP traffic succeeds, which materially lowers real-world urgency versus a typical 8.1. Exploitation status at time of analysis: no public exploit identified — there is no CISA KEV listing and no POC reference in the supplied intelligence, and no EPSS score was provided to quantify likelihood.
Full takeover of Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 is achievable by an unauthenticated remote attacker who can reach the Forge component over TCP, with successful exploitation yielding complete confidentiality, integrity, and availability impact (C:H/I:H/A:H) per Oracle's advisory and the corroborating ENISA EUVD-2026-79606 record. Oracle explicitly characterises the flaw as 'Difficult to exploit' (CVSS AC:H), meaning a condition outside the attacker's direct control - such as a timing window, race condition, or a specific data-processing state - must be satisfied before exploitation becomes reliable, so mass opportunistic scanning is unlikely. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the source data; practical exposure is bounded to installations where Forge is network-reachable, which for most deployments is an internal data-pipeline interface rather than an internet-facing default service.