A high-severity flaw in Oracle E-Business Suite Integrated SOA Gateway (Internal Operations) 12.2.3 through 12.2.15 allows a low-privileged, network-positioned attacker using HTTP to read and modify critical data and cause partial denial of service. CVSS 3.1 is 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L), so a valid low-privilege account and a reachable Gateway endpoint are required - the 'Authentication Bypass' tag should not be read as fully unauthenticated access. No CISA KEV listing was present, and no public exploit identified at time of analysis; Oracle's October 2026 Critical Patch Update advisory is the referenced fix source.
Low-privileged authenticated attackers can compromise Oracle Siebel CRM Deployment 17.0 through 26.9 over HTTP, gaining high confidentiality and integrity impact and causing partial denial of service (CVSS 8.3, PR:L). The affected Server Infrastructure component allows unauthorized creation, deletion, modification, and access to critical deployment data, and no public exploit code or CISA KEV entry was identified at time of analysis. Although tagged 'Authentication Bypass', the assessed vector requires valid low-privilege credentials and does not represent unauthenticated access.
Authenticated low-privileged users can read, modify, and delete critical Product Quality Management data in Oracle Agile Product Lifecycle Management for Process 6.2.4, and can additionally degrade availability, giving the issue a CVSS 3.1 base score of 8.3. The flaw is reachable over the network via HTTP, requires only a valid low-privilege account (PR:L), needs no user interaction, and has low attack complexity, so exploitation is straightforward once an attacker holds credentials. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the main practical constraints are the authentication prerequisite and the narrow deployment base of this specialized supply-chain product.
Oracle MySQL Server and MySQL Cluster are exposed to a high-severity integrity and availability flaw in the Server: JSON component, affecting MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. An authenticated low-privileged attacker with network access can use MySQL protocols to create, delete, or modify critical data, read a limited subset of data, and cause hangs or repeatable crashes, yielding CVSS 3.1 score 8.3. No public exploit was identified at time of analysis, and exploitation is constrained by the need for valid low-privileged database credentials.
Broken object-level authorization in IBM Langflow OSS 1.0.0 through 1.12.4 allows any authenticated low-privilege user to bulk-delete another user's messages, overwrite message content to inject malicious prompts, or reassign a conversation session ID to hijack the session. The CVSS 3.1 score is 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L), so exploitation requires a valid account and a shared deployment where other users' messages or sessions exist; single-user instances have little cross-user data to target. No public exploit code or confirmed active exploitation was identified at time of analysis, and this is assessed as above-average priority rather than an emergency.
Adjacent-network attackers can achieve takeover of Oracle Business Intelligence Enterprise Edition 8.2.0.0.0 and 26.01.0.0.0 through a high-complexity Platform Security flaw, with no authentication or user interaction required; CVSS 8.3 reflects high confidentiality, integrity, and availability impact plus scope change. Oracle rates exploitation as difficult and requires access to the physical or adjacent communication segment attached to the OBIEE host, not the open internet. No public exploit was identified at time of analysis.
Easy Property Listings before 3.5.27 exposes CRM contact, lead, and private activity-note data to any authenticated WordPress user with a role as low as subscriber because several contact-management read AJAX actions omit authorization checks. An attacker who can obtain or self-register a subscriber account can query those actions remotely without victim interaction, resulting in read-only information disclosure rather than modification or denial of service. Publicly available exploit code exists, but EPSS is low at 0.14% (3rd percentile), and no CISA KEV active-exploitation flag is present in the supplied data.
The Advantech ADAM-3600 industrial RTU/edge controller can be crashed by a remotely delivered crafted message that triggers an assertion fault, causing a denial of service limited to availability. No authentication or user interaction is required (PR:N/UI:N), but exploitation depends on network reachability to the affected service and on a specific precondition (AT:P) for the fault to fire. No public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated remote attackers can read critical data and cause a partial denial of service in Oracle Outside In Technology 8.5.8 by supplying crafted files to applications that embed the Outside In Core parser. The CVSS 3.1 score is 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L), reflecting high confidentiality impact, low availability impact, and no integrity impact. No public exploit was identified at time of analysis, and exploitation depends on a host application exposing file-processing paths to untrusted input.
Oracle Solaris 11.4 exposes an HTTP-reachable service in its Services component that remote unauthenticated attackers can exploit to crash or repeatedly hang the system (complete denial of service) and read a subset of accessible data. No authentication or user interaction is required, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) scores 8.2, with availability impact dominant and a secondary confidentiality leak; scope is unchanged, so impact stays confined to the Solaris host. No public exploit code or confirmed active exploitation was identified at time of analysis, and real-world urgency hinges primarily on whether the affected HTTP service is exposed beyond trusted management networks.
Arbitrary file write in Advantech ADAM-3600 lets an authenticated attacker with high-privilege operator or administrator credentials and network access to the device management interface write files to arbitrary system locations, compromising device integrity and potentially that of a subsequent system. The assessed impact is integrity-only, with no confidentiality or availability impact, and a CVSS 4.0 base score of 8.2. No public exploit was identified at time of analysis, and exploitation is gated by the need for valid privileged credentials.
Advantech ADAM-3600 industrial remote terminal units expose a path traversal flaw that allows a high-privileged authenticated user to read arbitrary files from the device filesystem over the network. This is a moderate-priority issue because exploitation requires a valid high-privilege session and network reachability to the management interface, which are constrained in segmented OT deployments; no public exploit identified at time of analysis, and the vendor advisory plus a CSA alert are available.
follow-redirects 1.16.0 through 1.16.x before 1.16.1 can disclose Authorization, Proxy-Authorization, Cookie, and caller-declared sensitiveHeaders when an application supplies headers in Node's alternating name/value array form and follows an attacker-influenced redirect to a different host or a downgraded protocol. This is an unauthenticated confidentiality issue (CWE-200) with high credential impact, but exploitation is conditional because object-form headers are unaffected and the attacker must serve or influence the redirect; the supplied CVSS 4.0 score is 8.2, while the independent CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N captures the high attack complexity. No public exploit was identified at time of analysis, and no CISA KEV confirmation was present in the supplied data; the vendor patch is 1.16.1.
Unauthenticated HTTP access to the Oracle E-Business Suite Integrated SOA Gateway can expose critical data and permit limited unauthorized data changes in EBS 12.2.3 through 12.2.15, because the SOA Provider component does not adequately enforce access controls. The issue is an authentication bypass rated CVSS 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), so where the optional gateway is deployed and reachable, default configurations are remotely exploitable without credentials or user interaction. No public exploit identified at time of analysis; practical risk is driven by whether the gateway is enabled and network-exposed.
Unauthenticated HTTP access to the Audience component of Oracle Marketing in Oracle E-Business Suite 12.2.3 through 12.2.15 can let a remote attacker read all Oracle Marketing-accessible data and modify some of it, with no privileges or user interaction required. Oracle rates the issue 8.2 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N); exposure depends on the Marketing module being installed and its HTTP endpoints being reachable. Exploitation status at time of analysis: no public exploit identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory provides the vendor remediation.
Oracle BPM Suite 12.2.1.4.0 and 14.1.2.0.0 expose the Case Management Service (11g+) to unauthenticated, low-complexity HTTP attacks that can read critical data and make limited unauthorized changes. Oracle rates the issue 8.2 (High) with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, meaning no credentials or user interaction are required against a reachable instance. No public exploit was identified at time of analysis, so exposure is primarily a function of whether the BPM Suite HTTP interface is reachable from untrusted networks.
Unauthenticated HTTP access to the Data Transforms component in Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 can be abused to read critical ODI data and perform limited unauthorized data changes. The flaw is rated CVSS 8.2 with high confidentiality and low integrity impact and requires no credentials or user interaction, making reachable ODI endpoints a high-priority exposure. No public exploit code was identified at time of analysis.
Unauthenticated HTTP requests to Oracle BRM Server in Oracle Communications Billing and Revenue Management 15.0.0.0.0 through 15.2.0.0.0 can read critical billing data and make limited unauthorized changes, according to Oracle's October 2026 Critical Patch Update. The CVSS 3.1 score is 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), so confidentiality is fully exposed while integrity impact is partial and availability is unaffected. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Unauthorized data access and limited data modification in Oracle Siebel CRM Deployment 17.0 through 26.9 are possible for unauthenticated network attackers able to reach the Server Infrastructure HTTP interface. The CVSS 3.1 score is 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), reflecting high confidentiality impact and low integrity impact with no availability impact; Oracle tags the issue as an authentication bypass. No CISA KEV entry or public exploit code was identified in the supplied intelligence, so exposure is chiefly governed by whether the Siebel HTTP endpoint is reachable from untrusted networks.
IBM QRadar SIEM 7.6.0.0 through 7.6.0.4 and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 contains an out-of-bounds read that a network-reachable attacker can trigger without authentication or user interaction. Successful exploitation can crash or degrade the service for a high availability impact and may expose limited adjacent memory, yielding low confidentiality impact; no public exploit has been identified at time of analysis and no KEV status is provided.
Authenticated attackers can achieve broad data tampering and disclosure against Oracle E-Business Suite's Global Order Promising Web Service in versions 12.2.3 through 12.2.15, with CVSS 3.1 scoring 8.2 (C:H/I:H, no availability impact). Exploitation requires a valid low-privilege EBS account (PR:L) plus network HTTP reachability to the affected component and satisfaction of high-complexity, server-side conditions the attacker cannot directly control (AC:H); no user interaction is needed (UI:N), and successful attacks cross a scope boundary (S:C), meaning other products can be significantly impacted. No public exploit code or confirmed in-the-wild activity was identified at time of analysis - no public exploit identified at time of analysis - so risk is real but bounded by the authentication prerequisite and the High attack complexity.
Unauthenticated network attackers can read critical data and make limited unauthorized changes in Oracle Agile Product Lifecycle Management for Process 6.2.4 through the Product Quality Management component. The flaw is remotely reachable over HTTP with low attack complexity, no credentials, and no user interaction, yielding high confidentiality impact and low integrity impact; availability is not affected. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a high-priority patch item rather than a confirmed active exploitation event.
Oracle Outside In Technology 8.5.8, specifically the Outside In Clean Content SDK, can be compromised by a crafted document delivered over HTTP, enabling an unauthenticated remote attacker to create, delete, or modify critical data and read a limited subset of accessible data when a victim opens, uploads, or triggers conversion of the malicious file. The scope-change rating means exploitation can affect host applications and other products that embed the SDK, not just Outside In itself, although mandatory user interaction prevents unattended mass exploitation. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a credible mid-to-high priority issue rather than an emergency.
Unauthenticated network attackers can access critical data and make limited unauthorized changes in Oracle Agile Product Lifecycle Management for Process 6.2.4 through the Product Quality Management component, yielding a CVSS 3.1 score of 8.2 with high confidentiality and low integrity impact. The CVSS vector indicates network reachability to the HTTP interface with no credentials, user interaction, or special configuration required, though real-world risk depends on whether the application is internet-facing or only reachable from trusted internal networks. No public exploit identified at time of analysis; this is a credible mid-to-high priority for organizations running the affected version.
Unauthenticated network attackers can access critical data and perform limited data modification in Oracle Siebel CRM End User versions 17.0 through 26.9 via the Communications Panel/Dashboard component. The vulnerability is easily exploitable (CVSS 8.2, AV:N/AC:L/PR:N/UI:N) and requires only HTTP reachability to the Siebel web tier. No public exploit code or active exploitation has been identified at time of analysis, but internet- or intranet-exposed deployments should prioritize patching.
The Advantech ADAM-3600 intelligent remote I/O module exposes a proprietary management protocol in which the SafeEnhancement protection feature fails to enforce login lockout or rate limiting, so remote attackers can repeatedly guess the administrator password until it is recovered even with the hardening option turned on. Successful guessing yields high-impact confidentiality, integrity, and availability loss on the device (CVSS 3.1 base 8.2, AV:N/AC:H/PR:N/UI:N), although exploitation is gated by attack complexity: the adversary must reach the device's protocol port and correctly implement that proprietary protocol, and the outcome depends on administrator password strength and available attack time. The issue is reported by Singapore's CSA, affects ADAM-3600 units per the wildcard CPE, and has no confirmed CISA KEV listing or public exploit code - no public exploit identified at time of analysis - with no EPSS score supplied in the available intelligence.
Crafted-document processing in Oracle Outside In Technology 8.5.8 can let a remote unauthenticated attacker access or alter sensitive data when a victim opens or processes a malicious file in an application that embeds the Outside In Clean Content SDK. The CVSS 8.2 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, so HTTP delivery needs no credentials but exploitation depends on victim-side parsing, and the scope change means the real impact tracks the privileges of the host product. No public exploit was identified at time of analysis, and no KEV entry is indicated.
Compromise of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 allows unauthenticated attackers on the adjacent network segment to read critical data and make limited unauthorized modifications through the Monitoring and Diagnostics SEC component. The CVSS 8.2 severity reflects no credentials or user interaction and a scope change that can affect connected products, but exploitation requires Layer 2 adjacency rather than public-network reachability; no public exploit identified at time of analysis.
Local compromise of Oracle Concurrent Processing in Oracle E-Business Suite 12.2.3 through 12.2.15 requires an attacker who already has high-privilege logon access to the infrastructure where the component runs, but successful exploitation can take over Concurrent Processing and, through scope change, significantly impact additional EBS products. The issue is context-dependent and moderate priority rather than a mass-exploitation threat; no public exploit was identified at time of analysis, and exploitation is not remotely or anonymously reachable.
A stack-based buffer overflow in the web management interface of certain ASUS router models allows an attacker positioned on the adjacent network segment (LAN or Wi-Fi) who already holds high-privilege administrative credentials to corrupt device operations and cause a denial of service by sending an HTTP request containing an input field longer than the expected length. The 8.2 CVSS 4.0 score reflects high integrity and availability impact, but confidentiality is unaffected and the preconditions are substantial: no internet-facing exposure and no unauthenticated path, since the required admin session is already sufficient to reboot or reconfigure the device. No public exploit code or confirmed active exploitation was identified at time of analysis, and the advisory does not enumerate the specific affected models or firmware builds.
Denial of service in libexpat 2.7.2 through 2.9.0 lets a remote attacker render a reused XML parser permanently unusable for subsequent documents: XML_ParserReset() clears the direct byte counter but never offsets the tracked heap allocations (m_alloc_tracker.bytesAllocated) accumulated by the previous document, so a large XML document followed by a reset causes the next document on that parser to fail with XML_ERROR_NO_MEMORY until the parser object is destroyed and recreated. Only services that keep one parser alive across documents via XML_ParserReset() and link an XML_GE==1 build (the default) are affected; applications that allocate a fresh parser per document are not. Exploitation requires a non-default reuse pattern (assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), impact is limited to availability with no confidentiality or integrity loss, and no public exploit code or in-the-wild activity was identified at time of analysis; a vendor fix exists in upstream PR #1431.
Hard-coded cryptographic key in IBM Guardium Data Protection 12.1 and 12.2 means the same static key ships inside every installation, so an attacker who reverse-engineers the product and recovers that key can decrypt (and potentially forge) the data it protects across any deployment. The assessed vector (AV:N/AC:H/PR:N/UI:N) rates this High complexity rather than trivially exploitable, because the attacker must both extract the key and gain access to the ciphertext it guards, and the independent assessment scopes the realistic impact to confidentiality loss rather than integrity or availability. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied; the issue is serious but not a top-tier emergency.
Authenticated low-privileged users of Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can abuse the Package Build SEC component over HTTP to create, delete, or modify critical application data and to hang or repeatedly crash the Tools service, yielding a combined integrity and availability impact rated CVSS 8.1. Exploitation requires only a valid low-tier account (PR:L), with low attack complexity, no user interaction, and no elevated privileges, so the practical barrier is account provisioning plus reachability of the EnterpriseOne Tools web layer rather than any exploit precondition. At the time of analysis no public exploit code or confirmed active exploitation was identified, and no CISA KEV listing exists for this CVE.
Unauthenticated remote takeover of the Oracle Application Object Library Core component is possible in Oracle E-Business Suite 12.2.3 through 12.2.15 over HTTP, carrying a CVSS 3.1 base score of 8.1 for full confidentiality, integrity and availability impact. Oracle characterizes the flaw as difficult to exploit (AC:H), meaning the attacker must satisfy preconditions outside their direct control rather than sending a single reliable request, but no privileges or user interaction are needed once those conditions are met. No public exploit code has been identified at time of analysis and the issue has not been confirmed actively exploited (no CISA KEV entry); EPSS scoring was not provided, so prioritization should rest on the high impact of a full AOL compromise combined with the exposure of internet-facing EBS web tiers.
Unauthenticated network attackers can achieve full takeover of the Oracle Call Center Technology component in Oracle E-Business Suite 12.2.3 through 12.2.15 by reaching its RMI-based Internal Operations service. Oracle rates exploitation as difficult (AC:H) because success depends on server-side conditions outside the attacker's control, but a successful attack yields complete confidentiality, integrity, and availability loss. No public exploit code or CISA KEV entry was identified at time of analysis, and real-world risk is driven mainly by whether the RMI ports are reachable from untrusted networks.
Takeover of Trusted Answer Search 26.1 is possible for unauthenticated network attackers who can reach a vulnerable PL/SQL package over Oracle Net, with full confidentiality, integrity, and availability impact on success. The flaw is difficult to exploit because success depends on a condition outside the attacker's control, and only version 26.1 is listed as affected. No public exploit code or confirmed active exploitation was identified at time of analysis.
Low-privileged, network-reachable attackers can corrupt or destroy data and repeatedly crash Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 through the Report Distribution component exposed over HTTP. Successful exploitation yields high integrity and availability impact - unauthorized creation, deletion or modification of critical PeopleTools data plus hang or repeatable crash conditions approaching complete denial of service - while confidentiality is unaffected (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/C:N/I:H/A:H). Exploitation is not unauthenticated: a valid low-privileged account is required, so the realistic threat is insiders or attackers who already hold credentials and can reach the report distribution surface; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Authenticated low-privilege users can read and modify critical data in Oracle Mobile Field Service, part of Oracle E-Business Suite 12.2.3-12.2.15, through the Admin UI over HTTP. The CVSS 8.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) confirms network reachability, low attack complexity, and no user interaction, but it is not pre-authentication because a valid low-privilege account is required. No public exploit identified at time of analysis and the CVE is not in CISA KEV.
Unauthenticated network attackers can potentially take over Oracle Access Manager 12.2.1.4.0 and 14.1.2.0.0 through crafted SAML authentication exchanges, yielding high confidentiality, integrity, and availability impact. The flaw is rated CVSS 3.1 8.1 with AC:H, indicating exploitation is difficult and depends on specialized conditions in the SAML flow; no public exploit or CISA KEV status is identified in the provided data, and SAML must be configured and reachable for exposure.
MySQL Connector/J 26.7.0 can be fully compromised - confidentiality, integrity and availability - when a Java application using the driver processes a crafted or attacker-controlled response from the MySQL server endpoint it connects to, giving the attacker a path to take over the connector. Oracle scores this 8.1 but rates attack complexity High despite PR:N/UI:N, reflecting that the realistic precondition is attacker control of, or man-in-the-middle position on, the database endpoint rather than a direct hit on an internet-facing listener. No public exploit code and no CISA KEV entry were identified at time of analysis, and only version 26.7.0 is listed as affected, so upgrading removes exposure.
Unauthenticated network attackers can achieve takeover of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.4 by exploiting a high-complexity flaw in the Installation Security component exposed over HTTP. Oracle rates the issue 8.1 with full confidentiality, integrity, and availability impact, but characterizes exploitation as difficult because additional conditions beyond the attacker's control must be met; no public exploit identified at time of analysis, and no CISA KEV entry was provided. Exposure is greatest where the Tools HTTP interface is broadly reachable.
Unauthenticated network attackers can achieve full takeover of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) by reaching the SMTP mail-handling path of the Enterprise Infrastructure SEC component, as disclosed in Oracle's October 2026 Critical Patch Update. Oracle rates the flaw 8.1 with high confidentiality, integrity, and availability impact, but attack complexity is high (AC:H), meaning success depends on message-processing state or timing the attacker does not fully control, so reliable exploitation is non-trivial. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied, so this should be treated as a serious-but-not-emergency patching priority rather than an active incident.
Unauthenticated network attackers can potentially take over Oracle Shipping Execution in Oracle E-Business Suite 12.2.3 through 12.2.15 by abusing a high-complexity flaw in the Workflow Events component, rated CVSS 8.1 with full confidentiality, integrity, and availability impact. Oracle characterizes the issue as difficult to exploit (AC:H), meaning success depends on conditions outside the attacker's control such as precise timing, server state, or a specific configuration rather than reliable reproduction against any default install, and no public exploit code or active exploitation has been identified at time of analysis. Practical risk is further bounded by exposure: the EBS HTTP interface and the Shipping Execution module must be network-reachable to the attacker, which in many deployments means internal-only rather than internet-facing access.
Unauthenticated, network-reachable attackers can potentially take over MySQL Server and MySQL Cluster through a high-complexity flaw in the 'Client programs' component, with full confidentiality, integrity, and availability impact. The issue affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; Oracle rates it difficult to exploit (AC:H) and no public exploit identified at time of analysis.
Takeover of Oracle MySQL Server and MySQL Cluster can result when a client program connects to an attacker-controlled, rogue, or intercepted MySQL endpoint, exploiting a difficult-to-trigger flaw in the client programs component. Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. Oracle rates it CVSS 8.1 with high confidentiality, integrity, and availability impact; the vector requires network access with no privileges, and high attack complexity reflects the need for server impersonation or interception, with no public exploit identified at time of analysis.
Oracle MySQL Server and MySQL Cluster client programs (MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1; MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1) harbor a high-complexity flaw that an unauthenticated network attacker can use to achieve full confidentiality, integrity and availability impact on a MySQL client, amounting to takeover in the assessed scope. Exploitation is constrained because the victim client must connect to an attacker-controlled or attacker-influenced server endpoint over one of the supported protocols, and Oracle rates the issue 'difficult to exploit' (AC:H). No public exploit was identified at time of analysis and no CISA KEV entry is present; CVSS 3.1 base score is 8.1.
Oracle Agile PLM for Process 6.2.4 can be taken over through its Product Quality Management component by unauthenticated remote HTTP requests, but the exploit path is rated high complexity and difficult rather than reliably repeatable. Oracle's October 2026 Critical Patch Update lists the issue with full confidentiality, integrity, and availability impact and no CWE mapping, and no public exploit or CISA KEV entry was identified in the provided intelligence at time of analysis. The combination of network reachability, no privileges or user interaction, and takeover-level impact makes this a high-impact but condition-dependent risk for supply-chain quality environments.
Unauthenticated network attackers can achieve full takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 through the Business Interlink component, though the high attack complexity - Oracle characterizes the flaw as 'difficult to exploit' - means success depends on conditions beyond the attacker's control, which materially reduces real-world exploitability. The vulnerability carries a CVSS 3.1 base score of 8.1 with complete confidentiality, integrity, and availability impact; no public exploit was identified at time of analysis. This is a genuinely serious but not top-tier-urgent issue, and risk concentrates on internet-exposed PeopleSoft portals where Business Interlink is reachable or in active use.
Unauthenticated network attackers can achieve full takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 by targeting the Business Interlink component over HTTP, with high impact across confidentiality, integrity, and availability. Oracle rates the flaw as 'difficult to exploit' (CVSS 8.1, AC:H), meaning success hinges on conditions outside the attacker's control such as the specific configuration state or timing of the Business Interlink service, so this is a serious but conditional risk rather than an emergency. No public exploit code or confirmed active exploitation has been identified at time of analysis, and exploitation realistically depends on whether Business Interlink is enabled and reachable from untrusted networks.
JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) allows a low-privileged authenticated attacker with HTTP network access to read and modify critical data through a flaw in the Enterprise Infrastructure SEC component, according to Oracle's October 2026 Critical Patch Update. The CVSS 3.1 score is 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), with high confidentiality and integrity impact and no availability impact. No public exploit code or active exploitation has been identified at time of analysis, though the "Authentication Bypass" tag conflicts with the PR:L vector and should be confirmed with Oracle.