Local information disclosure in Oracle Communications BRM - Elastic Charging Engine 15.0.0.0.0, 15.0.1.0.0.0, 15.1.0.0.0, and 15.2.0.0.0 lets an authenticated low-privileged user who can log on to the ECE host read critical data accessible to the product. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, so exploitation requires existing local access, is straightforward once that access exists, and affects confidentiality only. No public exploit identified at time of analysis.
Oracle BRM 15.x allows a locally authenticated low-privileged user to read critical or complete application data, with no integrity or availability impact. Affected releases are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0; exploitation requires a pre-existing local logon to the infrastructure hosting BRM Server and the ability to interact with that component. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 3.1 base score is 5.5.
Oracle GoldenGate 21.3 through 21.23 can expose sensitive GoldenGate-accessible data to a low-privileged local user through the Vendor Access Module. The issue is locally exploitable by an attacker who already has a valid logon on the GoldenGate host (CVSS 5.5, AV:L/PR:L), with high confidentiality impact but no integrity or availability effect. No public exploit or CISA KEV entry is identified in the provided data, and exploitation requires local access rather than a remote unauthenticated path.
Low-privileged local users with logon access to Oracle Product Lifecycle Analytics 3.6.1 can exploit installation-related weaknesses to read critical or all accessible data, with no user interaction required (CVSS 5.5). The flaw is confined to the local host and requires valid credentials, limiting exposure to insiders or attackers who already have a foothold; confidentiality is the only impacted property. No public exploit identified at time of analysis.
Local applications on unpatched Apple macOS can trigger an out-of-bounds write that terminates the system, producing a denial-of-service condition with no confidentiality or integrity impact (CVSS 5.5). The flaw affects macOS Sequoia before 15.8 and macOS Tahoe before 26.7; exploitation requires a local, low-privileged attacker who can run an app on the host (AV:L/PR:L) and does not require user interaction. Apple has released fixes in macOS Sequoia 15.8 and macOS Tahoe 26.7, and no public exploit code or active exploitation has been identified at time of analysis.
Local low-privileged apps on unpatched Apple iOS, iPadOS, and macOS devices can exploit an improper authorization and state-management weakness to read sensitive user data outside their intended access. The flaw affects releases before iOS 27, iPadOS 27, and macOS Golden Gate 27, and Apple has shipped fixes in those versions. No public exploit identified at time of analysis, and CISA SSVC rates exploitation as none with non-automatable attack potential, keeping this a moderate local-risk issue rather than a remotely exploitable one.
Privacy check bypass in Apple macOS before Golden Gate 27 allows a locally executing app with low privileges to access sensitive user data that should be protected by macOS privacy controls. The issue is scored CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, CWE-200) and affects confidentiality only; Apple fixed it with improved checks in macOS Golden Gate 27. No public exploit identified at time of analysis, the CISA SSVC exploitation assessment is none, and a vendor patch is available.
iOS and iPadOS devices running versions prior to 27 contain a missing-authorization defect in permission-state management that can allow an already-installed app to access sensitive user data beyond its intended sandbox. Exploitation is local (AV:L) and requires a malicious or compromised app to be present and running with low privileges (PR:L), with no additional user interaction (UI:N); confidentiality impact is high while integrity and availability are unaffected. Apple addressed the issue through improved state management in iOS 27 and iPadOS 27, and no public exploit code or CISA KEV entry was identified at time of analysis.
Kernel memory disclosure in Apple macOS (all releases prior to Golden Gate 27) lets a local, low-privileged application read portions of kernel memory, breaking the confidentiality boundary between user space and the kernel. Per the CVSS vector (AV:L/PR:L/UI:N) the attacker must already be able to execute code on the host as a low-privileged app; there is no remote path and no user interaction beyond running the malicious program. Apple fixed the flaw by removing the vulnerable code in macOS Golden Gate 27, and no public exploit has been identified at time of analysis; EPSS is 0.14% (3rd percentile), consistent with a local-only, availability-neutral issue whose main value is as a building block in a larger exploit chain.
Local applications on Apple macOS releases before Golden Gate 27 can exploit a missing authorization check to access sensitive user data. The attacker must already have a malicious or compromised app installed and running with low privileges on the Mac; there is no remote network path and no user interaction is required. No public exploit was identified at time of analysis, and Apple has released macOS Golden Gate 27 to correct the state-management flaw.
A local path-handling flaw in macOS (addressed in Golden Gate 27) allows an application already running on the host to use improper path validation to reach protected user data, resulting in confidentiality-only impact. Exploitation requires the attacker to have a malicious or compromised app running with standard user privileges and no network path exists, so it is a moderate-severity local information-disclosure issue rather than an urgent priority. No public exploit code or confirmed active exploitation was identified at time of analysis, and Apple has released a fix in macOS Golden Gate 27.
Low-privileged local users can crash Oracle Solaris 11.4 through a flaw in the Filesystems component, causing a hang or repeatable complete denial of service. The issue requires a valid local logon (CVSS 5.5, AV:L/PR:L) and affects availability only, with no confidentiality or integrity impact; no public exploit code or confirmed active exploitation was identified at time of analysis. It is a routine-patching priority rather than an emergency remote threat.
A local availability flaw in the Filesystems component of Oracle Solaris 11.4 lets a low-privileged user who already holds a logon on the host hang or repeatedly crash the operating system, producing a complete denial of service. The CVSS 3.1 score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so there is no remote vector, no user interaction, and no confidentiality or integrity impact - the only meaningful precondition is existing local account access, which confines practical exposure to insider, shared-host, and post-compromise scenarios. There is no public exploit identified at time of analysis and no evidence of active exploitation, so this is a routine patch-cycle item rather than an emergency: moderate risk, availability only, gated behind local credentials.
Confidential data disclosure in Oracle Siebel CRM's End User Open UI affects versions 17.0 through 26.9, allowing a low-privileged user with local logon access to the Siebel infrastructure to read critical data. The CVSS 3.1 score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so the issue is local, requires valid credentials, and has no integrity or availability impact. No public exploit was identified at time of analysis.
Authenticated low-privileged attackers can read a limited subset of data and cause a partial denial of service in Oracle JD Edwards EnterpriseOne Localizations 9.2 through the JDENET protocol. Oracle rates it CVSS 3.1 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L), so exploitation requires valid low-privilege credentials and network reachability to the JDENET listener; impact is confined to confidentiality and availability, with no integrity effect. No public exploit was identified at time of analysis.
Low-privileged authenticated users of Oracle JD Edwards EnterpriseOne Human Resources Management 9.2 can abuse the JDENET communication service to tamper with HR data and degrade service availability. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), the attacker must already hold valid low-privilege credentials and be able to reach JDENET, but no user interaction or elevated privileges are required, making it easily exploitable for any such account. Impact is limited to partial integrity modification/deletion of some HR-accessible records and a partial denial of service; this is a moderate-severity (5.4) issue rather than a top-priority one, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Use-after-free in Mozilla Thunderbird's S/MIME decryption path can crash the mail client and is potentially exploitable when a security device password prompt (smartcard PIN or Primary Password) stays open while a message load finishes or is cancelled. Only users who have configured such a password and then open an attacker-supplied S/MIME-encrypted message are exposed, and triggering the bug also requires winning a timing race. No public exploit identified at time of analysis, CISA SSVC lists exploitation as none, and the vendor fixed the issue in Thunderbird 158.0.1.
Stored cross-site scripting can occur in sites using sanitize-html before 2.18.0 when a non-default allow-list permits meta refresh elements and their http-equiv/content attributes, because unsafe script or redirect destinations in the refresh value are retained. ApostropheCMS deployments that bundle the affected library are in scope, but default sanitize-html configurations are not affected; exploitation requires an account able to submit content and a victim who renders it. The issue is fixed in sanitize-html 2.18.0, and no public exploit was identified at time of analysis.
Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 expose the Content Server component to an unauthenticated HTTP-reachable attack that only succeeds after a non-attacker user interacts with attacker-supplied content or a crafted link, after which the attacker can make limited unauthorized updates, inserts or deletions to accessible data and partially degrade availability. Integrity and availability impacts are both rated Low with no confidentiality exposure, yielding a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L); the user-interaction requirement means exploitation is not fully automatable, and no public exploit code was identified at time of analysis. Oracle addressed the issue in its October 2026 Critical Patch Update.
Oracle REST Data Services versions 24.2.0 through 26.2.1 allow a low-privileged, authenticated user with HTTP access to the Core component to read a subset of and improperly insert, update, or delete data that should be outside that account's authorization scope. The requirement to already hold valid low-privilege credentials (PR:L) is the primary limiting factor, so exposure concentrates in multi-tenant, shared, and internet-facing ORDS deployments where accounts are broadly provisioned; there is no availability impact and the assessed severity is a moderate 5.4. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, making this a genuine but moderate-priority issue rather than a top-tier emergency.
Authenticated low-privileged users of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can read a limited subset of application data and partially degrade service availability by sending crafted requests to the JDENET business-logic infrastructure component. The weakness is trivially reachable over the network once a valid low-privilege EnterpriseOne account exists, but its blast radius is bounded: confidentiality and availability impacts are both rated Low and there is no integrity impact, giving a CVSS 3.1 base score of 5.4. No public exploit code or confirmed active exploitation was identified at time of analysis, and no CISA KEV listing exists for this CVE.
Authenticated low-privileged users of Oracle Siebel CRM End User 17.0 through 26.9 can bypass intended Open UI access controls to read and modify data beyond their authorized scope. The issue is network-reachable over HTTP with low complexity and no user interaction, but requires a valid low-privilege session; impact is partial confidentiality and integrity loss with no availability impact (CVSS 5.4). This is a medium-severity authenticated access-control flaw rather than a top-priority emergency, and no public exploit or CISA KEV active-exploitation confirmation is present in the provided data.
Low-privileged users of Oracle JD Edwards EnterpriseOne Tools can read and modify data beyond their authorized scope through the JDENET interface, affecting versions 9.2.0.0 through 9.2.26.5. The flaw sits in the Business Logic Infra SEC component and requires only a valid low-privilege account plus network reachability to JDENET (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 5.4), with no user interaction; impact is bounded to partial confidentiality and integrity loss with no availability effect. The available intelligence contains no confirmed active exploitation (not in CISA KEV) and no public exploit code, so practical risk concentrates on deployments where the JDENET listener is broadly reachable and low-privilege accounts are loosely provisioned or shared.
Oracle ORDS 24.2.0 through 26.1.0 allows low-privileged authenticated users with HTTP network access to the ADP component to read a subset of accessible data and perform unauthorized inserts, updates, or deletes. The issue is remotely reachable with low attack complexity and no user interaction, but it requires valid low-tier credentials and has no availability impact, making it a moderate-severity access-control problem rather than an unauthenticated compromise. No public exploit code or CISA KEV entry was identified at time of analysis.
Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 contain an access-control weakness in the ADP component that lets a low-privileged, authenticated ORDS user reach data they should not control over HTTP, resulting in unauthorized read plus insert/update/delete operations against a subset of ORDS-accessible data (CVSS 3.1 base 5.4, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Exploitation requires a valid low-privilege identity on the ORDS instance - a point worth stressing because the third-party 'Authentication Bypass' tag implies a pre-auth condition, which the assessed vector and Oracle's own description (low-privileged attacker, PR:L) do not support. There is no availability impact, no public exploit identified at time of analysis, no CISA KEV listing, and EPSS data was not provided; Oracle addresses the issue through its standard Critical Patch Update for October 2026, so this should be handled in the normal CPU cadence rather than as an emergency.
Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 contain an access-control weakness in the Core component that lets a low-privileged, already-authenticated user reach HTTP endpoints they should not be able to modify, yielding partial read plus insert/update/delete access to a subset of ORDS-accessible data (CVSS 3.1 base 5.4, C:L/I:L/A:N). Because the attacker must hold a valid low-privilege account and only HTTP reachability is required, the realistic exposure is greatest on internet-facing ORDS deployments where self-registered or broadly provisioned low-privilege accounts exist. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update advisory.
Oracle JD Edwards EnterpriseOne Tools (E1 Dev Platform Tech - UNIX), versions 9.2.0.0 through 9.2.26.5, exposes an HTTP-reachable weakness that lets an unauthenticated remote attacker achieve limited read and limited insert/update/delete access to application-accessible data. Exploitation is not direct: the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) shows no authentication barrier but a mandatory human-interaction step, meaning a legitimate user must be induced to engage with attacker-supplied content before the payload succeeds, and there is no availability impact. At CVSS 3.1 base 5.4 this is a routine patch-cycle item rather than an emergency; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Oracle WebCenter Content 14.1.2.0.0 (Content Server component) exposes an HTTP-reachable path that lets an unauthenticated remote attacker cause limited unauthorized reads and writes of Content Server data - but only if a human victim is lured into performing an interaction (CVSS 3.1 5.4, AV:N/AC:L/PR:N/UI:R/C:L/I:L/A:N). The mandatory user-interaction prerequisite and the bounded confidentiality/integrity impact (no availability effect) keep this a moderate-priority item rather than an emergency: without victim action the attack does not succeed, and the flaw cannot by itself disrupt service. No public exploit code or confirmed active exploitation was identified at time of analysis; Oracle addressed the issue through its Critical Patch Update referenced in the October 2026 security advisory.
Limited unauthorized read and update/delete access to Oracle ORDS data is possible for unauthenticated network attackers who convince a separate user to interact with attacker-supplied content in Oracle REST Data Services 24.2.0 through 26.1.0. The CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), reflecting partial confidentiality and integrity impact with no availability impact, and the attack cannot succeed without that human interaction. No public exploit code was identified at time of analysis, and no CISA KEV confirmation was provided.
Oracle REST Data Services versions 24.2.0 through 26.1.0 expose an access-control weakness in the Backend-as-a-Service component that lets an unauthenticated network attacker over HTTP obtain partial read and partial insert/update/delete access to ORDS-accessible data, scored CVSS 3.1 base 5.4 (C:L/I:L/A:N). Exploitation is not attacker-completable on its own: the vector carries UI:R, so a legitimate ORDS user must be induced into a crafted interaction, making phishing and social-engineering defenses directly relevant. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update; this is a moderate-severity item rather than a drop-everything priority.
Oracle Agile PLM 9.3.6 contains an application server flaw that an authenticated low-privileged attacker can trigger over HTTP, but only with a second user's interaction, to read and modify limited PLM data and potentially affect other integrated products through a scope change. The CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and no public exploit code was identified at time of analysis. The vendor advisory is Oracle's October 2026 Critical Patch Update.
Oracle Payroll, a module of Oracle E-Business Suite 12.2.3 through 12.2.15, contains an authenticated cross-site scripting-style flaw in its Internal Operations component that can let a low-privileged user trick a second, likely higher-privileged user into performing unintended actions over HTTP. Successful exploitation yields limited read access plus limited insert/update/delete capability within Payroll, and because the CVSS scope flag is changed, the impact can spill over into other EBS products sharing the environment. Neither CISA KEV listing nor public exploit code is indicated in the available intelligence, and with a base score of 5.4 the practical risk is constrained by the need for valid credentials and victim interaction.
Oracle Trade Management in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes a Claim LOV component issue that lets a low-privileged authenticated attacker cause unauthorized read and limited insert/update/delete actions, but only if a separate victim user interacts with attacker-influenced content. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), and no public exploit code or confirmed active exploitation (CISA KEV) is identified at time of analysis.
Oracle Trade Management in Oracle E-Business Suite 12.2.3 through 12.2.15 exposes a moderate-severity (CVSS 5.4) HTTP attack path that requires a low-privileged authenticated account and interaction from a separate victim user. Successful exploitation can allow unauthorized read access and update, insert, or delete access to limited Trade Management data, and the scope-change rating means additional products may be significantly impacted; no public exploit was identified at time of analysis.
Content-injection-style weakness in the Audience component of Oracle Marketing (Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged user with network access over HTTP to plant attacker-controlled content that a second, different user must interact with, resulting in unauthorized read plus limited insert, update, or delete access to Marketing data. Because the CVSS vector carries a scope change (S:C), a successful attack can also affect additional Oracle products beyond Marketing itself, although confidentiality and integrity impact remain partial and there is no availability impact. Exploitation is not self-contained - it demands a valid low-privileged Marketing account and a separate victim's interaction - and no public exploit identified at time of analysis; this is a moderate-severity, context-dependent issue rather than a drop-everything priority.
Oracle E-Business Suite deployments running Advanced Outbound Telephony in versions 12.2.3 through 12.2.15 expose the Internal Operations component over HTTP to an authenticated low-privileged user who can then induce a second, more privileged victim to interact with a crafted request. Successful exploitation yields limited read access plus insert/update/delete capability over some Telephony-accessible data, and because the CVSS scope is changed (S:C), the impact can propagate into other Oracle products reachable from the compromised module. No KEV listing and no public exploit code were identified at time of analysis, and EPSS data was not supplied; the CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), with no availability impact.
Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 (Portal component) lets a low-privileged authenticated attacker with HTTP access read and modify Portal-accessible data by inducing a separate user to interact with attacker-influenced content, and the scope change (S:C) means impact can extend to additional integrated products. CVSS 3.1 is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), a limited-to-moderate priority rather than an emergency. No public exploit identified at time of analysis, and no CISA KEV entry was provided.
PeopleSoft Enterprise PeopleTools 8.61 through 8.63 (Fluid Core component) mishandles attacker-supplied content in a way that lets a low-privileged authenticated user plant input which, once a different victim user interacts with it in the Fluid UI, can alter or read PeopleTools data and reach beyond the component's own security scope. Oracle resolved the issue in its October 2026 Critical Patch Update; no public exploit code and no CISA KEV entry were identified at the time of analysis, and the mandatory second-party interaction keeps practical risk moderate at CVSS 3.1 base 5.4. Impact is bounded to partial confidentiality and integrity loss with the scope change indicating possible spillover into connected applications that render Fluid content.
Oracle Java SE 8u503 and 8u503-perf, along with Oracle GraalVM Enterprise Edition 21.3.19.1.1, contain a difficult-to-exploit RMI flaw that unauthenticated network attackers can trigger only by supplying crafted data to the affected RMI APIs, such as through a web service; applet and Java Web Start paths are explicitly excluded. Successful exploitation yields limited confidentiality and integrity impact with scope change but no availability impact, consistent with CVSS 5.4 (AC:H). No public exploit was identified at time of analysis, and the high complexity and narrow input path keep priority moderate rather than emergency.
Oracle BI EE 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 contains an HTTP-reachable flaw in the Analytics Web General component that enables a low-privileged authenticated attacker to read a subset of BI-accessible data and perform limited unauthorized updates, inserts, or deletes after inducing another user to interact with crafted content. The scope change raises the possibility of significant impact on additional products, although confidentiality and integrity effects are partial and availability is unaffected. This is a moderate-priority issue for routine patch cycles; no public exploit identified at time of analysis, and no active exploitation is confirmed by the supplied intelligence.
Oracle PeopleSoft Enterprise SCM Purchasing 9.2 has a medium-severity (CVSS 5.4) weakness in its Supplier Registration component that lets a low-privileged authenticated attacker use HTTP to persuade a different user to interact with malicious content, yielding partial read and limited insert/update/delete access to Purchasing data with possible scope change into connected products. The CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N vector confirms network reachability, low-privileged authentication, and required victim interaction; no public exploit identified at time of analysis and no CISA KEV entry was provided. This should be treated as a routine but non-urgent patch priority rather than an emergency.
Siebel CRM Open UI exposes a low-privileged, network-reachable weakness that lets an attacker with a valid low-privilege account craft HTTP content and rely on a different user, such as an agent or administrator, to interact with it, thereby gaining unauthorized read access and limited insert/update/delete capability in that victim's context. The scope change means the impact can extend to products integrated with Siebel, although confidentiality and integrity effects are partial and availability is unaffected. No public exploit was identified at time of analysis, so this is a moderate-severity, mid-tier-priority issue rather than a drop-everything emergency.
Oracle Siebel CRM's Open UI component (End User, versions 17.0 through 26.9) mishandles attacker-supplied content in a way that lets a low-privileged authenticated user cause unauthorized reads and limited insert/update/delete changes to data visible to a different user, with the impact crossing a security scope boundary into other products. Exploitation is over HTTP, requires a valid low-privileged Siebel account, and critically depends on a second user interacting with the crafted content in their own session (UI:R). No public exploit code or confirmed active exploitation was identified at time of analysis; Oracle addresses the issue in its October 2026 Critical Patch Update.
Stored/reflected cross-site scripting in the Web Runtime SEC component of JD Edwards EnterpriseOne Tools (9.2.0.0 through 9.2.26.5) lets a low-privileged authenticated attacker inject content that executes when a different user loads the affected page, producing limited confidentiality and integrity impact and a scope change beyond the vulnerable component. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N); exploitation requires both a valid low-privileged account and victim interaction, so unattended mass exploitation is unlikely. No public exploit identified at time of analysis.
Oracle HRMS (US) Payroll Year End, as shipped in Oracle E-Business Suite 12.2.3 through 12.2.15, exposes a moderate-severity HTTP-reachable flaw that a low-privileged authenticated attacker can exploit only if a different user is induced to view or process attacker-supplied data. Successful exploitation can yield limited unauthorized read access plus insert/update/delete changes within HRMS (US) and may affect additional products through scope change, with no availability impact; no public exploit was identified at time of analysis. The assessed CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
A moderately severe flaw in Oracle HRMS (UK), a module of Oracle E-Business Suite, lets a low-privileged authenticated user with HTTP network access manipulate content that a separate victim must interact with, ultimately granting unauthorized read and limited write access to HRMS (UK) data and potentially affecting other EBS components due to a scope change. Versions 12.2.3 through 12.2.15 are affected; no public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS 3.1 base score is 5.4. Successful abuse hinges on two prerequisites: a valid low-privilege account and a second user's interaction, which curbs automated mass exploitation.
A moderate-severity flaw (CVSS 3.1 base 5.4, MEDIUM) in the Mobile Applications component of Oracle HRMS (US) within Oracle E-Business Suite, disclosed in the October 2026 Critical Patch Update, lets a low-privileged authenticated attacker who persuades another user to interact with attacker-controlled content alter or delete some HRMS data and read a limited subset of it, with scope change extending impact to other products. Deployments running E-Business Suite 12.2.3 through 12.2.15 are affected; exploitation requires network access over HTTP, valid low-privilege credentials, and victim interaction, so the attacker cannot succeed alone. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
A moderate-severity flaw (CVSS 3.1 base 5.4) in the Portal component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a low-privileged, network-positioned attacker who already holds a valid account inject content that a second user must then view or interact with, yielding limited unauthorized read and limited insert/update/delete access to PeopleTools data; the scope change flag means the impact can spill into the victim's session and other integrated products. There is no public exploit code and no confirmed active exploitation at time of analysis, and the combination of a required authenticated account plus mandatory victim interaction keeps this out of the mass-exploitation category. Treat it as routine Oracle Critical Patch Update (October 2026) work rather than an emergency.
Low-privileged authenticated users can tamper with and read limited Oracle HRMS (UK) data in Oracle E-Business Suite 12.2.3 through 12.2.15 by convincing another user to interact with crafted HTTP content. The issue is medium severity (CVSS 3.1 base 5.4) and has scope change into other EBS products, but exploitation requires a valid account (PR:L) and victim interaction (UI:R); the 'Authentication Bypass' tag is not supported by the assessed vector. No public exploit was identified at time of analysis and no KEV entry is present in the provided data.
Oracle Compensation Workbench in Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated low-privileged attacker with HTTP network access to read and modify a subset of Total Compensation Statement data, provided a second, different user interacts with attacker-influenced content (UI:R). The CVSS 3.1 base score is 5.4 with a scope change (S:C), meaning successful exploitation may affect resources beyond the vulnerable component; both the required prior authentication (PR:L) and the mandatory victim interaction materially limit real-world exploitation. No public exploit was identified at time of analysis, and this is a moderate-severity issue best handled through the normal Oracle Critical Patch Update cycle rather than emergency response.