Local code injection in IBM Sterling Connect:Direct for Unix's apnotify utility can let an authenticated low-privileged user trigger a stack-based buffer overflow and potentially execute code with the host privileges of the utility. The flaw affects versions 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 and requires local access plus the ability to invoke apnotify with crafted input; there is no remote or unauthenticated path. No public exploit identified at time of analysis, and CISA KEV status is not indicated, so risk is concentrated on shared Unix hosts with untrusted local accounts.
Command injection in PyPA virtualenv before 21.14.9 lets an attacker who controls the destination path of a virtual environment execute arbitrary commands with the victim's privileges the next time the victim runs a generated POSIX console-script launcher. The flaw arises because virtualenv's ScriptMakerCustom and pip seeding pass an incompletely quoted interpreter path to distlib's ScriptMaker, which emits a /bin/sh wrapper whose double-quoted interpreter path still expands command substitutions and backticks whenever the path contains a space or tab, or yields a shebang longer than 127 bytes. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:N/UI:R), reflecting that the attacker needs local influence over the environment destination and the victim must manually run the launcher - environment creation and activation alone do not trigger execution.
Local code execution in thefuck 3.32 allows an attacker with a low-privileged local account to run arbitrary Python code by planting or modifying a rule file in a directory searched by get_rules_import_paths, which Rule.from_path later imports when the victim invokes thefuck. The flaw is CWE-94 code injection with CVSS 3.1 score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring local write access to a rules path; code runs with the privileges of the user running thefuck, so privilege escalation depends on a higher-privileged user executing the tool against an attacker-writable location. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is 0.16% (5th percentile).
Local privilege escalation to full takeover of Oracle Communications Billing and Revenue Management (BRM) is possible on the Platform component of versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. An attacker who already holds interactive logon access to the BRM host with low-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8) can achieve high confidentiality, integrity and availability impact - Oracle describes the outcome as 'takeover' of the product - with low attack complexity and no user interaction. The attack is not remotely reachable: no path exists for an unauthenticated network attacker, so exposure depends entirely on how tightly shell/local access to BRM infrastructure is controlled; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Local low-privilege users with a logon to the infrastructure hosting Oracle HTTP Server 12.2.1.4.0 can exploit the OSSL module to take full control of the HTTP Server, with high confidentiality, integrity, and availability impact. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) confirms the attack is local, requires an authenticated low-privileged account, needs no user interaction, and has low complexity once that access exists. No public exploit identified at time of analysis, and no confirmed active exploitation was provided in the intelligence.
Takeover of Oracle Concurrent Processing is possible for any low-privileged user who can log on to the Oracle E-Business Suite application tier, affecting versions 12.2.3 through 12.2.15. The CVSS 3.1 vector (AV:L/PR:L/UI:N, C:H/I:H/A:H) confirms the flaw is local rather than network-reachable: an attacker must already hold a valid low-privileged account on the host running Concurrent Processing, after which no user interaction is needed and the component's confidentiality, integrity, and availability are fully compromised. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle has addressed the issue in its October 2026 Critical Patch Update, so exposure is limited to unpatched systems and realistic risk is concentrated on insiders or attackers performing post-compromise lateral movement within the EBS environment.
Local privilege escalation in Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 lets an attacker who already holds a valid low-privileged logon on the OSB host take full control of the backup server through the Device Management and Support component. Because the vector requires local access (AV:L) and an existing account (PR:L), the realistic exposure is limited to environments where untrusted users can log on to the OSB infrastructure, but successful exploitation yields complete confidentiality, integrity, and availability impact (CVSS 7.8). No public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Oracle Autonomous Health Framework 26.3 through 26.8 allows an authenticated, low-privileged user with a logon on the AHF host to take over the product's Trace File Analyzer component, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8). The flaw cannot be reached remotely or without credentials: exploitation depends entirely on the attacker already holding a local account on the infrastructure where AHF executes, so least-privilege OS accounts and tight host access control directly shrink the exposed population. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the Oracle advisory is the authoritative remediation source.
Local takeover of Oracle Autonomous Health Framework (Trace File Analyzer component) in versions 26.3 through 26.8: any user with an existing low-privileged logon on the Oracle Database or Grid Infrastructure host can exploit the component to gain full control of AHF, with high confidentiality, integrity and availability impact (CVSS 3.1 base score 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is not remote and needs no victim interaction, so exposure is confined to hosts where untrusted local principals already hold accounts or a foothold - shared and multi-tenant database servers carry the real risk, while single-administrator, tightly controlled hosts are substantially lower risk. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; Oracle published it through its October 2026 Critical Patch Update.
Takeover of Oracle Business Intelligence Enterprise Edition 8.2.0.0.0 and 12.2.1.4.0 is possible when an attacker who already holds a local OS-level logon on the Analytics Server host can get a different user to open or process attacker-supplied content. The CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no OBIEE application credentials are needed, but host access and user interaction are hard prerequisites. No public exploit code or CISA KEV entry was identified at time of analysis.
Oracle BI EE 8.2.0.0.0 and 12.2.1.4.0 can be taken over through a low-complexity Platform Security flaw that an unauthenticated attacker triggers after obtaining interactive logon access to the host and persuading another user to perform an action. The local attack path (AV:L) and user-interaction requirement (UI:R) keep it from being remotely wormable against default internet-facing deployments, despite high confidentiality, integrity, and availability impact and a 7.8 CVSS score. No public exploit was identified at time of analysis, and CISA KEV does not list this CVE.
Local processing of attacker-supplied files by Oracle Outside In Technology 8.5.8 can lead to full compromise of the affected parsing instance, with high confidentiality, integrity, and availability impact. The flaw is rated CVSS 7.8 and requires local access plus a victim action to open or convert a crafted document, so only deployments that feed untrusted content into OIT are realistically exposed; no public exploit code or confirmed active exploitation was identified at time of analysis.
Local file-processing exploitation in Oracle Outside In Technology 8.5.8 (Outside In Image Export SDK) can let an attacker who can log on to the host take over the component when a crafted file is opened or processed by another user or automated workflow. The CVSS 3.1 score is 7.8 with high confidentiality, integrity, and availability impact; the vector is local (AV:L), requires user interaction (UI:R), and does not require privileges for the vulnerable component itself (PR:N). No public exploit was identified at time of analysis, and the provided data does not indicate CISA KEV status.
Full compromise of Oracle Outside In Technology 8.5.8's Image Export SDK requires local logon access plus a victim opening a malicious file, yielding high confidentiality, integrity, and availability impact at CVSS 7.8. The CVSS vector is AV:L/AC:L/PR:N/UI:R, so the attacker needs logon to the host where Outside In runs, needs no privileges, and must convince another person to open or process a crafted file. No CISA KEV entry or public exploit code was identified at time of analysis.
Local file-processing flaws in the Outside In Image Export SDK shipped with Oracle Outside In Technology 8.5.8 let an attacker who can log on to the host achieve full takeover of the affected SDK process by convincing another user or service to open a crafted file. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) confirms this is a local, unauthenticated attack that requires victim interaction rather than something reachable over the network, and only the Image Export SDK component of the 8.5.8 release is in scope. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a moderate-priority issue that is chiefly dangerous where the SDK is exposed to untrusted documents on shared or multi-tenant conversion hosts.
Full compromise of JD Edwards EnterpriseOne Tools can be achieved by an attacker who can log on locally to the host running the Tools installation, provided a separate user or administrator performs a required action. This affects Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 and is scored CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No public exploit identified at time of analysis, and no CISA KEV entry was supplied; the local-access plus human-interaction prerequisites substantially narrow practical risk compared with a network-reachable flaw.
Local compromise of the Applications DBA (AD Utilities) component in Oracle E-Business Suite 12.2.3 through 12.2.15 can let an attacker who already has logon access to the EBS host seize control of the Applications DBA component, with high confidentiality, integrity and availability impact (CVSS 3.1 base score 7.8). No authentication to the E-Business Suite application itself is needed (PR:N), but the attack is local (AV:L) and requires a separate privileged user such as a DBA to perform an action (UI:R), so the practical exposure is limited to hosts with multi-user interactive access. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; no EPSS score was supplied in the available data.
Command injection in virtualenv's bash activation script prior to 21.14.7 allows a crafted environment name or --prompt value to execute shell commands each time bash renders the prompt. The flaw arises because the script escapes the name for only one of bash's two PS1 processing passes, so a backslash before $(...) or backticks survives as command substitution; exploitation is local and requires the victim to activate the malicious environment while prompt modification is enabled. No public exploit identified at time of analysis, and virtualenv 21.14.7 contains the vendor fix.
Local takeover of Oracle Application Testing Suite 13.3.0.1 through its OpenScript component: any user who can log on to the host running the suite can leverage the flaw to gain full control of the product, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The prerequisite is meaningful - the attacker must already hold an authenticated local account on the ATS infrastructure host - but once that condition is met, exploitation is low-complexity and requires no user interaction. There is no remote or network-exploitable path, no public exploit identified at time of analysis, and exposure is effectively bounded to shared or multi-user test servers where lower-tier or untrusted accounts are permitted to log on.
Takeover of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 can be achieved by a low-privileged attacker with an existing interactive logon on the OBIEE host, through the Presentation Services component. The local CVSS 3.1 vector (7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact, but the need for local access and valid low-privilege credentials keeps this a genuine, not emergency-grade, priority. No public exploit was identified at time of analysis, and no KEV confirmation is present in the provided data.
Local takeover of Oracle HTTP Server 12.2.1.4.0 is achievable by an authenticated low-privileged user who can log on to the host running the Web Listener, yielding high confidentiality, integrity and availability impact (CVSS 7.8). The AV:L/PR:L/UI:N vector confines realistic exploitation to insiders or attackers who already hold a foothold on the server, and only version 12.2.1.4.0 is listed as affected; no public exploit code exists and there is no CISA KEV entry, so the status is no public exploit identified at time of analysis.
Local privilege escalation in Oracle JD Edwards EnterpriseOne Tools (Installation Security component, versions 9.2.0.0 through 9.2.26.5) allows an attacker holding low-privileged logon access on the application host to take over the product, with high confidentiality, integrity, and availability impact (CVSS 7.8). Exploitation is not remote: it requires a local foothold and valid low-privileged credentials on the infrastructure where EnterpriseOne Tools runs, so the practical exposure is insider threat and post-exploitation escalation rather than an internet-facing emergency. No public exploit code has been identified at time of analysis.
Local privilege escalation in the Oracle Solaris 11.4 kernel lets an attacker who already holds a low-privileged logon on the host elevate to full control, compromising confidentiality, integrity, and availability. The flaw is local-only (AV:L) and requires a valid account (PR:L), but needs no user interaction and is low complexity, so a local user meeting the prerequisite can exploit it reliably. The provided intelligence does not confirm CISA KEV active exploitation or publicly available exploit code, so exploitation status is no public exploit identified at time of analysis.
Takeover of the Applications Platform Engineering component in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for an attacker who already holds a low-privileged local logon on the EBS host. The flaw sits in the 'Valid Session' component, is low-complexity with no user interaction, and yields high confidentiality, integrity, and availability impact (CVSS 7.8). Exploitation is gated by the AV:L/PR:L prerequisites, and no public exploit code was identified at time of analysis.
Takeover of Oracle JD Edwards EnterpriseOne Tools (Enterprise Infrastructure SEC component) is possible for an attacker who already holds a low-privileged authenticated logon on the host running the product, affecting versions 9.2.0.0 through 9.2.26.5. The flaw is local rather than network-reachable (AV:L), needs no user interaction, and has low attack complexity, so once the prerequisite account access exists the attacker can reliably gain high confidentiality, integrity, and availability impact, yielding a CVSS 3.1 base score of 7.8. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical gating factor is possession of local credentials on the EnterpriseOne server tier.
Local privilege escalation in Oracle Solaris 11.4 lets an attacker who already holds a low-privileged logon escalate to full control of the host through the Services component, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.8). Exploitation is local only (AV:L) and requires a valid low-privileged account (PR:L), but no user interaction (UI:N) and low complexity (AC:L) mean escalation is reliable once a foothold exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and hosts where untrusted users have no shell access are not exposed.
Local privilege escalation in Oracle E-Business Suite (Oracle Application Object Library, DB Privileges component) allows a low-privileged user who can log on to the infrastructure hosting the application to compromise the product and achieve takeover of it, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8). Affected releases are 12.2.3 through 12.2.15; the AV:L/PR:L/UI:N vector means a remote unauthenticated attacker cannot reach the flaw directly - the attacker must already hold valid low-privilege credentials plus interactive logon to the EBS host, which realistically limits exposure to insiders or intruders who have established an initial foothold. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible but not emergency-level patching priority.
Local privilege escalation in Oracle VM VirtualBox 7.2.20 lets a user who already holds a low-privileged logon on the host take over the VirtualBox instance with low complexity and no user interaction, causing high confidentiality, integrity, and availability impact. The flaw scores 7.8 HIGH and is strictly local (AV:L), so it cannot be reached remotely without prior host access. No public exploit code or CISA KEV entry was identified at time of analysis; risk is concentrated on shared, multi-user, or untrusted local hosts running the affected release.
A local privilege-escalation flaw in the Enterprise Manager Install component of Oracle Enterprise Manager Base Platform lets a low-privileged user who can log on to the host running the platform escalate to full control of the EM Base Platform itself, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.8). Only versions 13.5 and 24.1 are affected, and exploitation is not possible over the network - CVSS vector AV:L/PR:L/UI:N means the attacker needs existing interactive logon plus at least low-privilege credentials on the EM infrastructure, and no user interaction or non-default configuration. There is no public exploit code and no confirmed active exploitation (not in CISA KEV) at time of analysis; fixes are published in Oracle's October 2026 Critical Patch Update advisory.
Local takeover in Oracle Autonomous Health Framework 26.3 through 26.8 allows an authenticated low-privileged user with logon to the host to compromise the AHF Instant Diagnostic Replay component, with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 at 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and the assessment emphasizes that it is local, not remotely exploitable, and requires a pre-existing host account. No public exploit identified at time of analysis.
A sandbox escape in Apple iOS and iPadOS (versions prior to 27) and macOS (versions prior to 27) allows a malicious app already running inside the app sandbox to break out of that containment by winning a timing-sensitive race condition that Apple's added validation is designed to close. The CVSS 3.1 base score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects that the attacker must have local code execution as an installed app and must reliably win a narrow, non-deterministic race, but success grants high-confidentiality, high-integrity and high-availability impact beyond the sandbox boundary (scope change). No public exploit code or confirmed active exploitation is identified at time of analysis; Apple has released fixes in iOS 27, iPadOS 27, and macOS Golden Gate 27, so this is a high-priority patch-soon issue rather than an emergency.
Opening a crafted document through Oracle Outside In Technology 8.5.8 can let an unauthenticated local attacker seize control of the affected runtime, with high impact across confidentiality, integrity and availability (CVSS 3.1 score 7.8). Because the flaw sits in the Outside In Core parsing component, the practical attack path is delivery of a malicious file that a victim then opens or processes on the host - the attacker cannot trigger it remotely and must rely on user interaction. Only version 8.5.8 is listed as affected; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vulnerability is addressed in Oracle's October 2026 Critical Patch Update.
Local attackers who can log on to the infrastructure hosting JD Edwards EnterpriseOne Tools can exploit a flaw in the Deployment SEC component to achieve full takeover of the product, but only if they can persuade another user to perform an action on attacker-controlled input. The vulnerability affects versions 9.2.0.0 through 9.2.26.5 and carries a CVSS 3.1 base score of 7.8 with high impacts to confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, and the required host access plus user interaction make this a high-severity but not opportunistic remote threat, favoring insider or post-compromise scenarios.
Takeover of JD Edwards EnterpriseOne Tools (Installation Security component, supported versions 9.2.0.0 through 9.2.26.5) is achievable by an attacker who already holds a logon on the host where the tooling executes, provided a second person - an operator or administrator - is tricked into a user-interaction step such as opening or processing attacker-supplied content. Successful exploitation yields high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), but the combination of a local attack vector plus a mandatory human victim makes this a high-severity rather than high-urgency issue at this moment. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no EPSS score was supplied with the source data.
Local attackers who already hold logon access to the host running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can achieve full takeover of the application through its Installation Security component, provided a legitimate operator is induced to perform an interactive step such as running an installer or configuration action. The 7.8 High CVSS 3.1 score (AV:L/AC:L/PR:N/UI:R) reflects high confidentiality, integrity and availability impact with no application-level credentials required, but the local-access and victim-interaction prerequisites confine realistic exploitation to insider or post-foothold scenarios rather than remote mass exploitation. No public exploit code and no CISA KEV entry were identified at time of analysis, so this sits well below network-facing criticals in prioritization.
Stormshield Network Security (SNS) can accept forged update and license files because a logic error in its signature verification routine bypasses authenticity checks. A local attacker must rely on user interaction: an administrator must obtain a malicious file from a source other than the official MyStormshield servers or not use SNS automatic verification, then apply it to the appliance. No public exploit was identified at time of analysis, and the risk is neutralized when updates and licenses are retrieved only from MyStormshield with automatic SNS verification enabled.
Local privilege escalation in Oracle Solaris 11.4 can let a low-privileged attacker with an existing logon compromise the host, with high confidentiality, integrity, and availability impact. The flaw is in the Utility component and has a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit has been identified at time of analysis. Exposure is limited to systems where untrusted users can obtain local interactive access.
A high-severity local privilege escalation and takeover flaw exists in the Installation Security component of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5). An attacker who already holds interactive logon access to the host running EnterpriseOne Tools and low-level credentials can exploit the component to gain full control of the application, with complete confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8, AV:L/PR:L/AC:L/UI:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the requirement for pre-existing local access plus valid credentials is the primary limiting factor on real-world risk.
Local privilege escalation in Oracle E-Business Suite's Application Object Library (DB Privileges component) allows a low-privileged user who can log on to the host where the library executes to take over the affected EBS instance, with high confidentiality, integrity, and availability impact (CVSS 3.1 base score 7.8). All supported releases from 12.2.3 through 12.2.15 are affected. No public exploit code or confirmed active exploitation was identified at time of analysis, and the local-plus-authenticated prerequisite confines realistic risk to insiders and post-compromise lateral movement rather than direct external attack.
Out-of-bounds heap write in Eclipse FileX allows an attacker who can supply a malformed FAT image to corrupt heap memory during fault-tolerant log replay, with the write position and value under attacker control. On embedded layouts where the FX_MEDIA driver callback is within reach, this can redirect the instruction pointer and yield code execution; the CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting a local path that requires the victim to mount attacker-controlled media. No public exploit code or CISA KEV entry was identified at time of analysis, and practical exposure is limited to builds with FileX fault tolerance enabled that mount untrusted FAT images.
Low-privileged authenticated users of Oracle Essbase 21.8.3.0.0 can exploit the Security component over HTTP to obtain unauthorized access to critical data, potentially extending beyond Essbase because of a scope change. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N: no user interaction is needed, but the attacker must already hold a valid low-privilege account and network access to the Essbase service. No public exploit was identified at time of analysis, and the 'Authentication Bypass' tag should not be read as allowing fully unauthenticated access given PR:L.
Oracle Essbase 21.8.3.0.0 exposes critical data to any holder of a valid low-privilege account, who can reach the Security component over HTTP and read information far beyond their intended authorization - up to all data the Essbase instance can access. The scope-change rating means the disclosure is not confined to Essbase itself and can extend into other connected Oracle products, making this an elevated-priority integrity-of-confidentiality issue rather than a CVSS-inflated one. Exploitation requires authenticated network access (CVSS PR:L, AV:N, AC:L, UI:N), so the practical barrier is obtaining or abusing a low-privilege account; no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV.
Sensitive data exposure in Oracle E-Business Suite Integrated SOA Gateway 12.2.3 through 12.2.15 allows a low-privileged authenticated remote attacker to read critical data accessible through the SOA Provider component, with a scope change that can affect additional products. The issue is rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) and is easily exploitable once the gateway is deployed and reachable over HTTP. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Authenticated low-privileged users of Oracle E-Business Suite can read critical Oracle Capacity data-and potentially data in other linked EBS products-through HTTP requests to the Internal Operations component in versions 12.2.3 through 12.2.15. Exploitation is low-complexity and needs no user interaction, but it requires a valid EBS account (PR:L) and network access; no public exploit identified at time of analysis, making this a mid-to-high priority issue rather than an emergency.
Authenticated low-privilege users can read critical Oracle Capacity data-and, because of a scope change, potentially data from other Oracle E-Business Suite products on the same deployment-in Oracle Capacity 12.2.3 through 12.2.15. The flaw is remotely reachable over HTTP with low attack complexity and no user interaction, but it is not unauthenticated: the attacker must already hold valid EBS credentials. No public exploit code is identified in the supplied intelligence at time of analysis, and the CVSS 3.1 score is 7.7 with confidentiality-only impact.
Oracle Trusted Answer Search 26.1 exposes an information-disclosure flaw in its Application expert UI component that lets an attacker with an existing low-privilege account reach critical data over HTTP without any user interaction. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7) confirms the attack is network-reachable and low-complexity, but it is not pre-authentication: a valid low-privileged login is the primary barrier, notwithstanding the 'Authentication Bypass' tag applied by the reporter. Because of the scope change (S:C), a successful exploit can expose confidential data belonging to other Oracle products reachable from the same deployment, so the blast radius is larger than the search component alone; no public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle REST Data Services (ORDS) versions 24.2.0 through 26.2.2 expose a confidentiality-only flaw in the Core component that lets a low-privileged, network-positioned user read data well beyond their intended authorization boundary. Because the CVSS vector carries a scope change (S:C) alongside high confidentiality impact, an attacker with valid low-level ORDS credentials can reach critical data and potentially affect other Oracle products reachable through the same deployment, though integrity and availability are untouched and exploitation requires an existing account (PR:L) rather than being fully unauthenticated despite the 'Authentication Bypass' tag. No public exploit code or CISA KEV confirmation was available at time of analysis, and the primary reference is Oracle's October 2026 Critical Patch Update advisory. Note that the 7.7 score reflects confidentiality exposure only; the practical risk is meaningful but not a drop-everything emergency.
Oracle Database Server's RDBMS component (versions 23.4.0 through 23.26.3) lets a low-privileged database account holding the near-universal Create Session privilege read critical data - potentially all RDBMS-accessible data - over Oracle Net, and the scope-change rating means the impact can extend to other Oracle products sharing the instance. Oracle's October 2026 Critical Patch Update is the referenced fix; no public exploit code or CISA KEV entry was identified at time of analysis, and the CVSS 7.7 score reflects a confidentiality-only impact (C:H/I:N/A:N) that requires an authenticated session (PR:L).
Oracle Project Contracts versions 12.2.3 through 12.2.15 expose critical data to any user holding a valid low-privileged E-Business Suite account, because the Internal Operations component fails to adequately restrict what that account can read over HTTP. Successful exploitation gives high-confidentiality read access to Project Contracts data and, due to a scope change in the assessed vector, can extend to data in other Oracle products reachable from the same suite; integrity and availability are unaffected. Exploitation requires authentication (CVSS PR:L) and no user interaction, making it low-complexity for an insider or anyone who has obtained a mundane EBS credential - no public exploit code and no confirmed active exploitation were identified at time of analysis, and Oracle addresses the flaw through its October 2026 Critical Patch Update.
Path-validation bypass in launch-editor before 2.14.2 on Windows allows unauthenticated remote attackers to pass a crafted file:line:column argument that resolves to an existing parent directory and slips past the library's filename-existence check. The bypass does not by itself execute code; it becomes an OS command injection risk only when chained with the separately described Windows percent-expansion flaw, and exploitation requires user interaction plus a reachable launch-editor-middleware endpoint such as a Vite dev server. No public exploit was identified at time of analysis, and the issue is fixed in 2.14.2.