Unauthenticated OS command injection in Wavlink WL-WN530BE1-A firmware through M30BE1_V251117 lets remote attackers execute arbitrary commands as root by forging an IP-FROM: 127.0.0.1 header to bypass login and supplying a crafted file_id parameter to /protocol.csp?opt=ovpn_file with type=del. Publicly available exploit code exists, and the VulnCheck advisory plus a public write-up describe the flaw; no CISA KEV confirmation was provided. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, making this a high-priority exposure when the management interface is reachable.
Unauthenticated remote code execution in PiFlow 2.0.0-2.0.1 allows network attackers to drive the DeepAgents chat agent through POST /chat or POST /chat/stream and invoke the exec_shell tool, which runs arbitrary commands via subprocess.run without human approval or an allow-list. Publicly available exploit code exists, and successful exploitation can expose LLM API keys and database credentials present in the process environment. This is a genuine high-priority risk for exposed deployments where the chat agent feature is enabled and reachable, with no CISA KEV entry indicated in the supplied data.
Unauthenticated remote command execution in Langchain-Chatchat through version 0.3.1.3 allows any network-reachable attacker to invoke the built-in shell tool through the POST /tools/call endpoint and run arbitrary OS commands as the Chatchat server user. Because the shipped Docker image runs the service as root, successful exploitation typically yields root-level command execution. Publicly available exploit code exists; there is no CISA KEV confirmation of active exploitation at time of analysis.
Unauthenticated remote code execution and full administrative takeover affect Letta deployments through 0.16.8 that use the project's shipped compose.yaml, because the file leaves LETTA_SERVER_SECURE unset so the password middleware is never registered and every REST API route is reachable without credentials. A network-positioned attacker can therefore invoke POST /v1/tools/run to execute arbitrary Python, manage users via /v1/admin, and - through the same compose file's published PostgreSQL superuser port with default credentials - run operating-system commands via COPY PROGRAM. Publicly available exploit code exists and the issue has been cataloged by VulnCheck, though it is not confirmed actively exploited (CISA KEV); exploitation requires only that the instance be network-reachable in its default configuration, with no authentication or user interaction needed.
Missing authorization in OpenSRE through 0.1.2026.10.19 allows remote attackers to run shell commands on the agent host without any human confirmation, because the headless presenter's execution_allowed() returns True unconditionally for every shell_run request. The practical attack path is prompt injection: crafted instructions placed in an alert feed or Slack message that the agent triages get interpreted as commands, letting the attacker execute on the host and exfiltrate LLM, Slack and cloud credentials. No CISA KEV entry exists and EPSS is low at 0.45% (38th percentile), but SSVC rates exploitation proof-of-concept, automatable and total technical impact, and a public PoC reference exists that is not verified as working exploit code; the priority label is act_now.
EvoScientist 0.1.0 up to (but not including) 0.2.5 lets an attacker reach host shell execution by delegating work to async sub-agents that carry no human-approval gate: instructions planted in ingested content such as a fetched web page can cause the agent to call start_async_task, and the resulting commands run with the invoking user's OS privileges and environment secrets. The bypass is a missing-authorization flaw (CWE-862) in the approval wiring rather than a credentials attack - per CVSS 4.0 (AV:N/AC:L/PR:N/UI:N, all impact metrics High) and our assessed CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) it is unauthenticated and requires no user interaction beyond the agent processing the poisoned content, and per the fix the vulnerable async thread lacks any approval path at all, so exploitation does not depend on auto_approve being enabled. A public PoC reference exists; it is not verified as working exploit code, EPSS is low at 0.44% (37th percentile), SSVC marks exploitation as 'poc' with automatable/total technical impact, and the vuln.today decision label is act_now with a vendor fix in v0.2.5.
DB-GPT through 0.8.2 ships a default docker-compose.yml that hardcodes the MySQL root password and publishes port 3306 on every host interface, so any instance deployed with the stock configuration exposes a root@% database account with publicly known credentials. An unauthenticated remote attacker who can reach port 3306, or who has a foothold on the shared 'dbgptnet' Docker bridge network, can log in with that static password and inherit FILE and SUPER privileges - full read/write access to all DB-GPT data plus the ability to read or write files on the database host. Publicly available exploit code exists (referenced by VulnCheck and Lasso Security); the issue is not in CISA KEV, but any deployment left in its default state is directly exploitable, and operators who rotated the root password, bound 3306 to localhost, or firewalled the host are materially less exposed.
Unauthenticated remote code execution in DB-GPT through 0.8.2 allows remote attackers to reach the /api/v1/chat/react-agent endpoint, where a mock get_user_from_headers function grants every caller the admin role. Crafted prompts can cause the ReAct agent's unsandboxed code_interpreter and shell_interpreter tools to execute arbitrary Python or bash as root in the webserver container, potentially reaching the bundled database with default credentials. Publicly available exploit code exists; the provided data does not confirm active exploitation, and the assessed CVSS 3.1 severity is 9.3 with network access, no privileges, and no user interaction required when the endpoint and interpreter tools are deployed and reachable.
Unauthenticated remote takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 is achievable through the Adapters component of Oracle Fusion Middleware, with Oracle assigning the maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). No credentials, user interaction, or special preconditions are required beyond network reachability of the SOA Suite HTTP listener, and the scope-change rating means successful exploitation can cascade into connected or dependent products rather than being contained to the SOA Suite host. At the time of analysis there is no public exploit code or CISA KEV listing, but the combination of maximum severity, unauthenticated access, and low complexity makes this a top-priority patch item for any internet- or broadly internally reachable deployment.
Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 are exposed to unauthenticated remote takeover through the Fabric Layer component reachable via T3 and IIOP. An attacker with network access can exploit the flaw without credentials or user interaction to achieve high confidentiality, integrity, and availability impact; the changed scope means interconnected products may also be affected. No public exploit identified at time of analysis, and the supplied intelligence does not indicate CISA KEV listing, but the unauthenticated network vector and CVSS 10.0 score make this a top-priority exposure for internet- or broadly reachable T3/IIOP listeners.
Unauthenticated remote takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 is possible through the Fabric Layer over T3 or IIOP, with a maximum CVSS 3.1 score of 10.0 and a scope change indicating impact beyond the SOA Suite host. Any attacker who can reach the T3/IIOP listener needs no credentials or user interaction, so exposure is primarily governed by network reachability. The provided intelligence shows no KEV listing and no public exploit identified at time of analysis, but the assessed risk remains top-priority because successful exploitation can fully compromise confidentiality, integrity, and availability.
Unauthenticated remote takeover of Oracle E-Business Suite Workflow is possible in versions 12.2.3 through 12.2.15 via HTTP through the Workflow Notification Mailer component. Successful exploitation has a CVSS 3.1 base score of 10.0 with scope change, meaning confidentiality, integrity, and availability impact can extend beyond Workflow to additional products. No public exploit was identified at time of analysis and no KEV entry was provided.
Unauthenticated remote attackers can compromise Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 through the Authentication Engine, obtaining high-impact confidentiality and integrity access and potentially affecting other products because the CVSS scope is changed. The CVSS 3.1 base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), with no availability impact; no public exploit identified at time of analysis. Exposure depends on reachability of the OAM authentication endpoint, and default deployments appear exploitable because the description calls out no special configuration prerequisite.
Unauthenticated remote takeover of JD Edwards EnterpriseOne Orchestrator affects versions 9.2.0.0 through 9.2.26.5, where a network attacker can compromise the E1 IOT Orchestrator Security component over HTTP without credentials or user interaction. The CVSS 3.1 score is 10.0 with scope change, meaning a successful attack can extend beyond the Orchestrator into additional connected EnterpriseOne products. No public exploit code or CISA KEV entry is identified at time of analysis, but the maximum severity, unauthenticated network vector, and broad version range make this a top remediation priority for exposed deployments.
Argo CD's repo-server evaluates .jsonnet files with an importer that is not confined to the repository root, allowing authenticated users who hold only Application 'get' permission to read any file the repo-server can access and to exhaust its memory. Affected deployments are Argo CD 0.9.0 through the releases preceding 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, where absolute paths, parent-directory traversal, and repository symlinks can reach files such as /proc/self/environ, projected service-account tokens, mounted private keys, and repository credentials; stolen data must be routed through a non-Secret resource like a ConfigMap because generated Secrets are redacted, and importstr on a non-terminating device like /dev/zero can cause a denial of service. No public exploit code was identified at time of analysis, but Argo CD's default role:catch-all policy grants Application get to every authenticated user, so the upload path through POST /api/v1/applications/manifestsWithFiles lowers the bar substantially on multi-tenant installations.
Unauthenticated remote write access in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an attacker manipulate the shared Redis backing store under any tenant's key, collapsing the platform's credential-encryption boundary and allowing cached flow parameters to be poisoned across tenants. The issue is rated CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) and requires the multi-tenant deployment pattern where tenants share the same Redis instance. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.
OpenStack Manila before 23.0.1 allows any authenticated member of an OpenStack project to act on another tenant's public share, exposing data and enabling access-rule and lifecycle tampering. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9), reflecting a low-privileged, network-reachable cross-tenant authorization failure; target shares must be public, which makes their UUIDs visible. No public exploit code was identified at time of analysis, and active exploitation is not confirmed in the supplied data.
Takeover of Oracle Enterprise Manager 13.5 and 24.1 is achievable by a low-privileged authenticated attacker with HTTP access to the Data Guard Management component. Exploitation requires only network reachability and a low-privilege account, yields high confidentiality, integrity and availability impact, and can affect additional products because of the CVSS scope change; no public exploit identified at time of analysis.
Low-privileged console users can achieve full takeover of Oracle Enterprise Manager for Oracle Database 13.5 and 24.1 through the Data Guard Management component, with scope change extending impact to managed databases and additional products reachable from the management server. The issue is network-reachable over HTTP with low complexity and no user interaction, but it requires a valid low-privileged OEM account (PR:L), so it is not unauthenticated. No public exploit code or confirmed active exploitation was identified at time of analysis; the CVSS 3.1 base score is 9.9.
Oracle Trusted Answer Search 26.1 contains a PL/SQL package flaw that lets low-privileged, authenticated attackers with Oracle Net connectivity fully compromise the component and potentially affect additional products due to a scope change. The CVSS 3.1 score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting high confidentiality, integrity, and availability impact; exploitation requires valid low-privilege database credentials rather than anonymous access. No public exploit code or confirmed active exploitation was identified at time of analysis.
Remote takeover of Oracle SOA Suite is possible for low-privileged, authenticated attackers who can reach the Adapters component over HTTP, affecting versions 12.2.1.4.0 and 14.1.2.0.0; Oracle rates it CVSS 9.9 because successful exploitation can also significantly affect connected products through scope change. No public exploit was identified at time of analysis, but the combination of low attack complexity, no user interaction, and high confidentiality, integrity, and availability impact makes this a high-priority patch target.
Low-privileged authenticated attackers with network access can take over Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through its Adapters component, with CVSS 9.9 and a scope change that can extend impact to connected Oracle products. Exploitation requires only low privileges and no user interaction, though authentication requirements keep fully unauthenticated attacks out of scope; no public exploit code or CISA KEV entry was identified at time of analysis. This is a high-priority issue because the Adapters interface is often network-exposed and the scope change can amplify a single compromise across integrated middleware.
Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 contain an easily exploitable Fabric Layer flaw that lets a low-privileged, network-positioned attacker take over the SOA Suite service over HTTP. Successful exploitation can also impact integrated products because the vulnerability changes scope, with high confidentiality, integrity, and availability impact; a low-privilege authenticated account is required. No public exploit code or CISA KEV entry was identified at the time of analysis.
Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0 can be fully compromised by a low-privileged, authenticated remote attacker exploiting the Human Workflow (11g+) component over SOAP, with a scope change that may extend impact to additional products. Successful exploitation can result in takeover of the BPM Suite with high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, but the low attack complexity and high impact make this a priority patching target.
Takeover of Oracle Siebel CRM Cloud Applications is possible through the Siebel Cloud Manager component in supported versions 17.0 through 26.9, where a low-privileged, authenticated attacker with HTTP network reachability can exploit the flaw to gain full control of the application. The CVSS 3.1 score is 9.9 with a scope change (S:C), reflecting that compromise of Cloud Manager can spill over into additional, dependent products, with high confidentiality, integrity, and availability impact. Exploitation requires a valid low-entitlement account or reachable authenticated interface rather than anonymous access, but once that foothold exists, attack complexity is low and no user interaction is needed; no public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addresses the issue in its October 2026 Critical Patch Update.
Argo CD deployments that run Kustomize with --enable-helm enabled can be tricked into executing attacker-supplied code inside argocd-repo-server, because helmGlobals.configHome lets a repository redirect Helm's config/data home to a repository-controlled path and Helm then auto-loads and runs a downloader plugin from <configHome>/.data/plugins without any plugin-install step. The barrier is low-privilege authenticated access (CVSS PR:L, scope-changed, 9.9): an attacker can either commit the Kustomization and plugin to a Git repository an Application already builds, or push the same files through POST /api/v1/applications/manifestsWithFiles (also reachable via argocd app diff --local --server-side-generate), which requires only Application get permission on an existing Application - no update, sync, or repository write rights. The payload runs as the repo-server user and can read repository credentials and other process-accessible data, so the blast radius extends beyond the Application itself; no public exploit code or confirmed active exploitation was identified at time of analysis, and the --enable-helm flag is a hard prerequisite - deployments that never enabled it are unaffected.
Authenticated low-privileged users can achieve integrity compromise and cause repeated denial of service against Oracle Trusted Answer Search 26.1 through a PL/SQL package reachable over Oracle Net, with the CVSS 3.1 score reaching 9.9 because the scope-change flag (S:C) extends the impact to additional products beyond the vulnerable component. Confidentiality exposure is limited to a subset of accessible data, but attackers can create, delete, or modify critical data and hang or repeatedly crash the service. No public exploit code or confirmed active exploitation was identified at time of analysis, and the exposure hinges on whether low-privilege accounts and Oracle Net listener access are broadly granted in a given environment.
Oracle Essbase 21.8.3.0.0 (Security component) permits a low-privileged authenticated user to take full control of the Essbase deployment over HTTP, with high confidentiality, integrity, and availability impact and a scope change that can extend compromise to integrated products. Exploitation requires network reachability to the Essbase HTTP interface plus valid low-level credentials (CVSS PR:L, AC:L, UI:N), so anonymous attacks are not indicated - the attacker must already hold some account on the server. Our assessment rates this as a genuine high-priority vulnerability rather than a high-CVSS-but-low-risk paper tiger; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis. No CWE was published, so the precise root-cause class is not confirmed from available data.
Oracle Outside In Technology 8.5.8 contains a high-severity flaw in the Outside In Clean Content SDK that becomes exploitable when the SDK is embedded in an HTTP-facing service accepting attacker-supplied files for parsing or conversion. A low-privileged authenticated network attacker can exploit it without user interaction to achieve high confidentiality, integrity, and availability impact, with scope change extending the impact to the host product. No public exploit code or CISA KEV entry was identified at time of analysis.
Low-privileged authenticated attackers can take full control of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through the Fabric Layer component reachable over HTTP, with a CVSS 3.1 base score of 9.9. The scope-change rating (S:C) means a successful compromise is not contained to the SOA Suite instance and can significantly impact additional connected products, so confidentiality, integrity and availability are all rated high. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; the practical gate for attackers is possession of any valid low-privilege account plus network reachability of the SOA Suite HTTP interface.
Authenticated low-privileged attackers with network access to Oracle Essbase 21.8.3.0.0's T3/IIOP listeners can achieve full takeover of the Essbase instance, with scope change allowing significant impact on additional products. The vulnerability carries a CVSS 3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and is considered high priority; no public exploit identified at time of analysis, and no CISA KEV confirmation was provided. Exploitation is gated by reachability to the T3/IIOP management protocols and possession of a low-privileged account.
Remote takeover of Oracle Essbase 21.8.3.0.0 is possible for low-privileged authenticated attackers with HTTP network access, due to a security flaw in the product's Security component. Successful exploitation can fully compromise confidentiality, integrity, and availability and, because of the scope change, may extend impact to additional connected products. This is a high-priority vulnerability; no public exploit identified at time of analysis, and the CVSS 3.1 base score is 9.9.
Oracle Essbase 21.8.3.0.0 contains an easily exploitable flaw in its Security component that lets a low-privileged, network-positioned attacker take over the Essbase deployment over HTTP. The CVSS 3.1 base score is 9.9 with scope change (S:C), meaning a compromise is not contained to Essbase and can significantly affect other products sharing the deployment. Authentication requirements are confirmed from the vector as low-privileged (PR:L) with no user interaction (UI:N); no public exploit code or CISA KEV active exploitation is identified in the available data.
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 can expose sensitive information because components of the product may bind to an unrestricted IP address (for example 0.0.0.0 or a public interface) rather than a loopback or otherwise restricted address, leaving the listener reachable from untrusted networks. IBM's published score is 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but the assessed vector is information disclosure only (C:H/I:N/A:N): a remote, unauthenticated attacker with network reachability to the exposed listener could read data they should not have access to, without user interaction or special conditions. The practical risk is entirely governed by network exposure - deployments that firewall ACE, segment it, or bind listeners to restricted interfaces are largely shielded; no public exploit code and no CISA KEV entry were identified at time of analysis.
Oracle APEX versions 24.1.0 through 24.1.21, 24.2.0 through 24.2.20, and 26.1.0 through 26.1.4 contain an easily exploitable flaw in the General component that unauthenticated remote attackers can reach over HTTPS to fully compromise the APEX instance, with high confidentiality, integrity, and availability impact (CVSS 3.1 base score 9.8). The Oracle CPU October 2026 advisory is the vendor's reference for this issue, and no public exploit code or CISA KEV listing was identified in the available data at time of analysis. Network exposure is the primary gating factor: any internet-reachable or otherwise attacker-accessibly APEX deployment on an affected release should be treated as high priority for patching.
Unauthenticated remote attackers can take over Oracle Application Object Library, the core component of Oracle E-Business Suite 12.2.3 through 12.2.15, over HTTP with low complexity and no user interaction, yielding a CVSS 3.1 score of 9.8 with full confidentiality, integrity, and availability impact. The Oracle October 2026 Critical Patch Update advisory is the coordination point; no CISA KEV listing and no public exploit identified at time of analysis, and EPSS was not supplied. Exposure is highest for EBS web tiers reachable from untrusted networks; deployments restricted to trusted internal networks or VPN/WAF fronts have materially reduced attack surface.
Unauthenticated remote takeover of Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 is possible through the Core component, with a CVSS 9.8 vector requiring only HTTP network access and no credentials or user interaction. Successful exploitation yields high confidentiality, integrity, and availability impact, effectively handing the attacker control of the server. No public exploit identified at time of analysis, and no EPSS score was provided; Oracle's October 2026 Critical Patch Update advisory is the authoritative remediation source.
Complete compromise of Oracle WebLogic Server is possible for unauthenticated, network-positioned attackers targeting the T3 or IIOP listeners in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), meaning no credentials or user interaction are required and confidentiality, integrity, and availability are all fully impacted. No CISA KEV entry or public exploit code is identified in the provided intelligence at time of analysis, but the lack of exploit reporting does not reduce the priority for internet-exposed T3/IIOP endpoints.
Unauthenticated remote takeover of Oracle WebCenter Sites is possible in supported versions 12.2.1.4.0 and 14.1.2.0.0, per Oracle Fusion Middleware's October 2026 advisory. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H means network attackers need no credentials or user interaction and can fully compromise confidentiality, integrity, and availability. No public exploit code or CISA KEV entry was identified in the supplied data at time of analysis.
Unauthenticated attackers with TCP network reach to Oracle Secure Backup 19.1.0.0.0 or 19.1.0.1.0 can take full control of the backup service, with high confidentiality, integrity and availability impact and a CVSS 3.1 base score of 9.8. The vendor rates the attack as low-complexity with no privileges or user interaction required, so network exposure is the main constraint. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.
Argument injection in Argo CD's repo-server allows an authenticated user holding only get permission on an existing Application to run arbitrary commands inside the argocd-repo-server pod. Kustomize forwards ref/version query values from remote base, component or resource URLs straight into git fetch without an end-of-options separator, so a leading-hyphen value is interpreted as --upload-pack and executed whenever the remote uses the local file:// transport; https:// remotes do not trigger execution. Affected releases run from 2.7.0 through the fixed versions 3.3.15, 3.4.10, 3.5.4 and 3.6.0-rc2, and the injected command runs as the repo-server user, exposing repository credentials and other process-readable data with output returned through manifest-generation error messages. No public exploit code or confirmed active exploitation was identified at time of analysis, but the low privilege bar (Application get, no sync or repository write needed via POST /api/v1/applications/manifestsWithFiles) makes this a genuine high-priority issue rather than an inflated score.
Cross-tenant privilege escalation in StreamsHub Console for Apache Kafka allows an authenticated Kubernetes tenant that can create or modify Console custom resources to point spec.containers.api.spec.image at an arbitrary container image, which the operator then deploys into a pod running under a ServiceAccount bound by ClusterRoleBinding to cluster-wide Strimzi CRD read access, Kafka/KafkaRebalance patch rights, and cluster-monitoring-view. The attacker-controlled code reads the projected ServiceAccount token and gains read/write control over the Strimzi control plane across tenant boundaries, with high confidentiality and integrity impact (CVSS 9.9, scope changed). Exploitation is gated by the tenant-level RBAC permission rather than being open to the internet, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote takeover of Oracle Access Manager is possible through its SAML-facing Authentication Engine, affecting builds 12.2.1.4.0 and 14.1.2.1.0 of the Oracle Fusion Middleware component. With a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), Oracle characterizes the flaw as easily exploitable by an attacker who can reach the SAML authentication interface over the network, with full confidentiality, integrity, and availability impact and potential full compromise of the OAM service. No public exploit code or CISA KEV entry was identified at time of analysis, so exploitation has not been confirmed in the wild, but the combination of unauthenticated network access, low attack complexity, and complete impact makes this a top-tier patching priority for any internet- or partner-facing OAM deployment.
Remote, unauthenticated takeover of Oracle WebCenter Content is possible through the Content Server component over HTTP, with CVSS 3.1 score 9.8 affecting versions 12.2.1.4.0 and 14.1.2.0.0. The attack requires only network reachability to the Content Server endpoint and no credentials or user interaction, yielding high confidentiality, integrity and availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, but the exposure is serious for internet-facing instances and should be prioritized.
Remote unauthenticated attackers can achieve takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through the Fabric Layer over HTTP, with the 9.8 CVSS reflecting high confidentiality, integrity, and availability impact and no privileges or user interaction required. No public exploit identified at time of analysis and no CISA KEV confirmation is present in the supplied data, but internet-reachable SOA Suite instances should be treated as high priority because the assessed vector is pre-authentication network exploitation.
Oracle SOA Suite releases 12.2.1.4.0 and 14.1.2.0.0 contain a critical flaw in the Fabric Layer component that can be reached over HTTP without any credentials, letting a remote attacker seize full control of the SOA Suite deployment. With a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), successful exploitation yields complete loss of confidentiality, integrity, and availability of the affected middleware, effectively a takeover of the product. There is no KEV listing and no public exploit identified at time of analysis, but the pre-authentication network vector and the fact that Oracle's Fabric Layer normally sits on an internet- or partner-facing service bus make this a top-tier patch priority; EPSS data was not supplied, and our independent assessment confirms the unauthenticated remote exploitation path with network reachability as the primary practical barrier.
Unauthenticated remote compromise of Oracle SOA Suite's Fabric Layer can lead to full takeover of the affected installation. The flaw affects SOA Suite 12.2.1.4.0 and 14.1.2.0.0 and is rated CVSS 9.8 with complete confidentiality, integrity, and availability impact; exploitation requires network access to the SOA Suite HTTP interface. No public exploit identified at time of analysis, and the main practical constraint is reachability rather than authentication or user interaction.
Oracle SOA Suite's Enterprise Scheduling System exposes a SOAP interface that unauthenticated remote attackers can reach on versions 12.2.1.4.0 and 14.1.2.0.0, allowing takeover of the product with high confidentiality, integrity, and availability impact. The 9.8 CVSS score and AV:N/AC:L/PR:N/UI:N vector make network reachability the primary exposure factor, so internet-facing or broadly reachable SOAP endpoints are the highest priority. No public exploit code and no CISA KEV entry were identified in the supplied intelligence at time of analysis.
Unauthenticated remote takeover of Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0 is possible through the Human Workflow component exposed over HTTP. The CVSS 3.1 score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no credentials, user interaction, or non-default configuration are required beyond network reachability. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle's October 2026 Critical Patch Update advisory is the authoritative fix source.
Unauthenticated remote takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 is possible through the Fabric Layer component exposed over HTTP. The CVSS 3.1 score is 9.8 with network access, no privileges, and no user interaction, yielding high confidentiality, integrity, and availability impact; Oracle's October 2026 Critical Patch Update advisory is the reference. No public exploit code or CISA KEV entry was identified at time of analysis, but this is a genuine high-priority exposure because default configurations are affected and the only practical barrier is network reachability to the SOA Suite HTTP interface.