Oracle JD Edwards EnterpriseOne Tools (Interoperability SEC) versions 9.2.0.0 through 9.2.26.5 allows a low-privileged authenticated attacker with network access to JDENET to create, delete, or modify critical data and read all data accessible to the application. The CVSS 3.1 score is 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N); no public exploit code or CISA KEV confirmation was identified at time of analysis. Despite an 'Authentication Bypass' tag, the assessed vector requires valid low-privileged credentials, making this a credible high-priority patch target but not a confirmed emergency.
Oracle E-Business Suite 12.2.3 through 12.2.15 ships a Contract Lifecycle Management for Public Sector module whose Award/PO component fails to properly constrain what a logged-in low-privileged user can do, so any account holder with HTTP reach to the application can read and alter contract and purchase-order data they should not touch. The result is a CVSS 3.1 score of 8.1 with high confidentiality and integrity impact and no availability impact; the vector (AV:N/AC:L/PR:L/UI:N/S:U) means exploitation requires prior authentication but no admin rights, no user interaction and no special configuration. Risk is concentrated in EBS deployments with large or loosely governed user populations, or where credentials can be phished or reused; no public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle has published a fix in its October 2026 Critical Patch Update.
Oracle Quality in Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated low-privileged remote attacker to read and modify critical data through the Internal Operations component over HTTP. The flaw is low complexity and requires no user interaction, but valid EBS credentials are required, which limits anonymous exploitation; confidentiality and integrity are fully impacted while availability is not. No public exploit code or CISA KEV entry was identified at time of analysis.
Low-privileged users of Oracle Communications BRM - Elastic Charging Engine 15.2.0.0.0 can read and alter critical charging data through a flaw in the product's Security component reachable over TLS. The issue scores CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N): Oracle rates it easily exploitable once a low-privilege foothold exists, with high confidentiality and integrity impact and no availability impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update.
Unauthenticated attackers can tamper with critical data and cause a complete, repeatable denial of service in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 by targeting the Report Distribution component over HTTP, but only if a legitimate user is induced to interact with the attack. The CVSS 3.1 score is 8.1 with high integrity and availability impact and no confidentiality impact. No public exploit identified at time of analysis, and the risk is high-priority but not an active-exploitation emergency.
Unauthenticated attackers with network reach to Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 can potentially achieve full takeover of the platform through the BI Foundation component over HTTP, with high impact across confidentiality, integrity and availability (CVSS 3.1 base 8.1). The high attack complexity reflects Oracle's own 'difficult to exploit' classification, meaning success hinges on timing, state or environmental preconditions outside the attacker's direct control rather than a single reliable request. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so practical risk is gated primarily by whether the BI HTTP interface is exposed to untrusted networks.
Compromise of Oracle EBS Workflow 12.2.3 through 12.2.15 is possible for unauthenticated network attackers via HTTP, with successful exploitation yielding high confidentiality, integrity, and availability impact and takeover of the Workflow component. The flaw is rated CVSS 8.1 but is difficult to exploit (AC:H), meaning success depends on a server condition or timing window the attacker cannot fully control. No public exploit code or CISA KEV active-exploitation signal is present at time of analysis, so exposure is primarily a function of whether Workflow Notification Mailer HTTP endpoints are reachable from untrusted networks.
Oracle Database Server in versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3 lets an authenticated low-privileged user who holds the Create Table privilege subvert the Virtual Private Database (VPD) row-level security feature over Oracle Net, gaining unauthorized read, creation, modification, and deletion access to data those VPD policies are supposed to protect. Successful exploitation yields high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) with no user interaction required; the attacker must already have a valid database account and network reachability to the database listener. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied in the source data, so the practical risk is concentrated in environments where low-privilege accounts are routinely granted Create Table.
Authentication bypass in Oracle JD Edwards EnterpriseOne Tools (Monitoring and Diagnostics SEC) lets a low-privileged attacker with network access over HTTP read and modify critical application data in versions 9.2.0.0 through 9.2.26.5. Exploitation requires a valid low-privileged account (PR:L), no user interaction, and low attack complexity, with high confidentiality and integrity impact but no availability impact. The provided intelligence identifies no public exploit code and no confirmed active exploitation; internet-exposed EnterpriseOne web tiers are the highest-risk deployments.
Successful exploitation of Oracle Essbase 21.8.3.0.0 could allow a remote, unauthenticated attacker with TCP network access to take over the Essbase service, with high confidentiality, integrity, and availability impact. Oracle rates the issue difficult to exploit (CVSS 8.1, AC:H), and the specific precondition is not disclosed; no public exploit was identified at time of analysis. Realistic exposure depends heavily on whether the Essbase TCP listener is reachable from untrusted networks.
Unauthenticated network attackers can achieve full takeover of Oracle Essbase 21.8.3.0.0 by reaching the product's WebLogic T3 and/or IIOP remoting listeners, with complete confidentiality, integrity, and availability impact (CVSS 3.1 base 8.1, C:H/I:H/A:H). The flaw sits in the Security component and is rated difficult to exploit (AC:H), meaning the attacker must satisfy conditions outside their direct control beyond simply reaching the port; no user interaction is required (PR:N/UI:N). There is no public exploit code and no confirmed active exploitation at time of analysis, but exposure is real wherever T3/IIOP is reachable from untrusted networks - the October 2026 Oracle Critical Patch Update is the only fix path identified in the available data.
Unauthenticated attackers positioned on the same network segment as an Oracle JD Edwards EnterpriseOne Tools host can read and tamper with protected data through the Enterprise Infrastructure SEC component in supported releases 9.2.0.0 through 9.2.26.5. The flaw scores CVSS 3.1 base 8.1 (AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:N): once an attacker has layer-2 adjacency to the EnterpriseOne hardware, no credentials, user interaction, or special conditions are required, and the result is full loss of confidentiality and integrity of EnterpriseOne-accessible data with no availability impact. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is driven less by exploit maturity than by whether an organization exposes its EnterpriseOne host segment to untrusted or flat internal networks.
Unauthenticated read access to the complete contents of prefixed system databases is possible in Apache CouchDB 3.5.2 and earlier because chttpd fails to enforce authorization on an API endpoint that serves those databases. Only deployments that have renamed their system databases with a prefix (a configuration the vendor calls 'very rare') are exposed - instances using the default _users and _replicator names are not exploitable - but where that condition holds, a remote attacker with network reach to the HTTP API can dump user credential documents or replication definitions without credentials or user interaction. Our assessment rates confidentiality impact as high with no integrity or availability effect, and no public exploit code or CISA KEV entry was identified at the time of analysis.
Server-side request forgery in Kroxylicious's Azure Key Vault KMS provider lets an attacker who can influence wire-deserialized EDEK bytes redirect the proxy's Azure bearer token to a host they control, then replay that token against the real Key Vault to break the record-encryption trust model. The issue affects Red Hat Streams for Apache Kafka 3 deployments only when record encryption is enabled with the Azure Key Vault provider, and the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects the need for low-privileged influence over EDEK input plus a reachable attacker-controlled host. No public exploit code has been identified at time of analysis, and no CISA KEV entry confirms active exploitation.
Authenticated low-privileged users can achieve full takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 through the Product Quality Management component, but only if a separate, typically higher-privileged victim is induced to interact with attacker-supplied content over HTTP. Rated CVSS 3.1 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H), the flaw yields high confidentiality, integrity, and availability impact once the interaction occurs. The dual precondition of valid credentials plus a second user's action confines this to targeted, social-engineering-style attacks against authenticated deployments rather than opportunistic internet-wide scanning; no public exploit code has been identified at time of analysis.
Adjacent-network attackers can achieve takeover of Oracle Management Pack for Oracle GoldenGate (EM Plugin) versions 13.4.1.0.1 through 13.5.2.0.6, with high confidentiality, integrity, and availability impact, provided they can reach the communication segment attached to the host and a legitimate operator performs a required interaction. No authentication is required and attack complexity is low, but the AV:A and UI:R requirements sharply limit exposure compared with an internet-reachable flaw. The supplied intelligence contains no public exploit code and no CISA KEV entry, so there is no public exploit identified at time of analysis.
Unauthenticated attackers positioned on the physical communication segment attached to the hardware running Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.9) can exploit the Siebel Cloud Manager component to obtain complete read and write access to critical application data, with scope change extending the impact to additional products. The CVSS 3.1 base score is 8.0 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N): no credentials or user interaction are needed, but the High attack complexity and the requirement to already reside on the adjacent/local network segment substantially constrain real-world exposure, and availability is not affected. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV, so the practical risk is concentrated in environments where untrusted parties can reach the Siebel Cloud Manager host's local segment.
OS command injection in virtualenv 20.26.6 through 21.14.2 lets an attacker who controls the environment's destination path or the --prompt value smuggle shell metacharacters into generated activation scripts. Because the template engine substitutes placeholders one key at a time over the whole template, a path or prompt containing the literal text __VIRTUAL_NAME__, __VIRTUAL_ENV__, or __VIRTUAL_PROMPT__ gets rewritten again during a later pass, and the later value's quoting can close the earlier literal and execute the remaining path when a victim activates the environment with bash, fish, xonsh, or activate_this.py. Per the CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H this is a local, low-complexity issue requiring no attacker privileges but mandatory victim interaction, yielding full confidentiality, integrity, and availability impact; no public exploit code or CISA KEV entry was identified at time of analysis, and the vendor-released fix is version 21.14.2.
Command injection in virtualenv's activation script allows an attacker who controls the virtual environment name (directory name, the --prompt argument, or the VIRTUALENV_PROMPT variable) to execute arbitrary commands in a victim's zsh shell each time the prompt is redrawn. Affected are virtualenv releases prior to 21.14.4; from 21.13.0 through 21.14.3 the PS1 escaping logic only ran when BASH_VERSION was set, leaving zsh with the raw, unescaped prompt value, and earlier releases left the environment name unescaped entirely. Exploitation requires a zsh interactive shell with the PROMPT_SUBST option enabled and a local victim activating the crafted environment (CVSS 3.1 7.8, AV:L/UI:R/PR:N), so unauthenticated remote exploitation is not possible; bash and default zsh configurations without PROMPT_SUBST are not affected, and no public exploit has been identified at time of analysis.
Command injection in virtualenv's fish-shell activator allows an attacker who controls the environment directory path, the --prompt argument, or the VIRTUALENV_PROMPT variable to escape the single-quoted fish literal in the generated activate.fish and execute arbitrary commands when the victim sources that file. All virtualenv releases prior to 21.14.2 that emit a fish activator are affected; bash, zsh and other activators are not. Exploitation requires local user interaction (sourcing the file) and a crafted value containing a backslash immediately before a quote, so this is a conditionally gated local code-injection flaw rather than a remotely reachable issue; no public exploit code or CISA KEV entry was identified at time of analysis, and the vendor-released fix is version 21.14.2.
Local privilege escalation in Apple macOS Sequoia before 15.8 and Tahoe before 26.7 allows an app already running on the host to gain elevated privileges, rated CVSS 3.1 7.8 (CWE-269, Improper Privilege Management). Exploitation requires local code execution as an unprivileged app (AV:L, PR:L) and no user interaction; it is not remotely reachable and patched systems are unaffected. No public exploit code or CISA KEV entry was identified at time of analysis.
Local code injection in IBM Sterling Connect:Direct for Unix's apnotify utility can let an authenticated low-privileged user trigger a stack-based buffer overflow and potentially execute code with the host privileges of the utility. The flaw affects versions 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 and requires local access plus the ability to invoke apnotify with crafted input; there is no remote or unauthenticated path. No public exploit identified at time of analysis, and CISA KEV status is not indicated, so risk is concentrated on shared Unix hosts with untrusted local accounts.
Command injection in PyPA virtualenv before 21.14.9 lets an attacker who controls the destination path of a virtual environment execute arbitrary commands with the victim's privileges the next time the victim runs a generated POSIX console-script launcher. The flaw arises because virtualenv's ScriptMakerCustom and pip seeding pass an incompletely quoted interpreter path to distlib's ScriptMaker, which emits a /bin/sh wrapper whose double-quoted interpreter path still expands command substitutions and backticks whenever the path contains a space or tab, or yields a shebang longer than 127 bytes. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:N/UI:R), reflecting that the attacker needs local influence over the environment destination and the victim must manually run the launcher - environment creation and activation alone do not trigger execution.
Local code execution in thefuck 3.32 allows an attacker with a low-privileged local account to run arbitrary Python code by planting or modifying a rule file in a directory searched by get_rules_import_paths, which Rule.from_path later imports when the victim invokes thefuck. The flaw is CWE-94 code injection with CVSS 3.1 score 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring local write access to a rules path; code runs with the privileges of the user running thefuck, so privilege escalation depends on a higher-privileged user executing the tool against an attacker-writable location. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is 0.16% (5th percentile).
Local privilege escalation to full takeover of Oracle Communications Billing and Revenue Management (BRM) is possible on the Platform component of versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. An attacker who already holds interactive logon access to the BRM host with low-level privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N, base 7.8) can achieve high confidentiality, integrity and availability impact - Oracle describes the outcome as 'takeover' of the product - with low attack complexity and no user interaction. The attack is not remotely reachable: no path exists for an unauthenticated network attacker, so exposure depends entirely on how tightly shell/local access to BRM infrastructure is controlled; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.
Local low-privilege users with a logon to the infrastructure hosting Oracle HTTP Server 12.2.1.4.0 can exploit the OSSL module to take full control of the HTTP Server, with high confidentiality, integrity, and availability impact. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) confirms the attack is local, requires an authenticated low-privileged account, needs no user interaction, and has low complexity once that access exists. No public exploit identified at time of analysis, and no confirmed active exploitation was provided in the intelligence.
Takeover of Oracle Concurrent Processing is possible for any low-privileged user who can log on to the Oracle E-Business Suite application tier, affecting versions 12.2.3 through 12.2.15. The CVSS 3.1 vector (AV:L/PR:L/UI:N, C:H/I:H/A:H) confirms the flaw is local rather than network-reachable: an attacker must already hold a valid low-privileged account on the host running Concurrent Processing, after which no user interaction is needed and the component's confidentiality, integrity, and availability are fully compromised. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle has addressed the issue in its October 2026 Critical Patch Update, so exposure is limited to unpatched systems and realistic risk is concentrated on insiders or attackers performing post-compromise lateral movement within the EBS environment.
Local privilege escalation in Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 lets an attacker who already holds a valid low-privileged logon on the OSB host take full control of the backup server through the Device Management and Support component. Because the vector requires local access (AV:L) and an existing account (PR:L), the realistic exposure is limited to environments where untrusted users can log on to the OSB infrastructure, but successful exploitation yields complete confidentiality, integrity, and availability impact (CVSS 7.8). No public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Oracle Autonomous Health Framework 26.3 through 26.8 allows an authenticated, low-privileged user with a logon on the AHF host to take over the product's Trace File Analyzer component, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8). The flaw cannot be reached remotely or without credentials: exploitation depends entirely on the attacker already holding a local account on the infrastructure where AHF executes, so least-privilege OS accounts and tight host access control directly shrink the exposed population. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied; the Oracle advisory is the authoritative remediation source.
Local takeover of Oracle Autonomous Health Framework (Trace File Analyzer component) in versions 26.3 through 26.8: any user with an existing low-privileged logon on the Oracle Database or Grid Infrastructure host can exploit the component to gain full control of AHF, with high confidentiality, integrity and availability impact (CVSS 3.1 base score 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is not remote and needs no victim interaction, so exposure is confined to hosts where untrusted local principals already hold accounts or a foothold - shared and multi-tenant database servers carry the real risk, while single-administrator, tightly controlled hosts are substantially lower risk. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; Oracle published it through its October 2026 Critical Patch Update.
Takeover of Oracle Business Intelligence Enterprise Edition 8.2.0.0.0 and 12.2.1.4.0 is possible when an attacker who already holds a local OS-level logon on the Analytics Server host can get a different user to open or process attacker-supplied content. The CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no OBIEE application credentials are needed, but host access and user interaction are hard prerequisites. No public exploit code or CISA KEV entry was identified at time of analysis.
Oracle BI EE 8.2.0.0.0 and 12.2.1.4.0 can be taken over through a low-complexity Platform Security flaw that an unauthenticated attacker triggers after obtaining interactive logon access to the host and persuading another user to perform an action. The local attack path (AV:L) and user-interaction requirement (UI:R) keep it from being remotely wormable against default internet-facing deployments, despite high confidentiality, integrity, and availability impact and a 7.8 CVSS score. No public exploit was identified at time of analysis, and CISA KEV does not list this CVE.
Local processing of attacker-supplied files by Oracle Outside In Technology 8.5.8 can lead to full compromise of the affected parsing instance, with high confidentiality, integrity, and availability impact. The flaw is rated CVSS 7.8 and requires local access plus a victim action to open or convert a crafted document, so only deployments that feed untrusted content into OIT are realistically exposed; no public exploit code or confirmed active exploitation was identified at time of analysis.
Local file-processing exploitation in Oracle Outside In Technology 8.5.8 (Outside In Image Export SDK) can let an attacker who can log on to the host take over the component when a crafted file is opened or processed by another user or automated workflow. The CVSS 3.1 score is 7.8 with high confidentiality, integrity, and availability impact; the vector is local (AV:L), requires user interaction (UI:R), and does not require privileges for the vulnerable component itself (PR:N). No public exploit was identified at time of analysis, and the provided data does not indicate CISA KEV status.
Full compromise of Oracle Outside In Technology 8.5.8's Image Export SDK requires local logon access plus a victim opening a malicious file, yielding high confidentiality, integrity, and availability impact at CVSS 7.8. The CVSS vector is AV:L/AC:L/PR:N/UI:R, so the attacker needs logon to the host where Outside In runs, needs no privileges, and must convince another person to open or process a crafted file. No CISA KEV entry or public exploit code was identified at time of analysis.
Local file-processing flaws in the Outside In Image Export SDK shipped with Oracle Outside In Technology 8.5.8 let an attacker who can log on to the host achieve full takeover of the affected SDK process by convincing another user or service to open a crafted file. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) confirms this is a local, unauthenticated attack that requires victim interaction rather than something reachable over the network, and only the Image Export SDK component of the 8.5.8 release is in scope. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a moderate-priority issue that is chiefly dangerous where the SDK is exposed to untrusted documents on shared or multi-tenant conversion hosts.
Full compromise of JD Edwards EnterpriseOne Tools can be achieved by an attacker who can log on locally to the host running the Tools installation, provided a separate user or administrator performs a required action. This affects Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 and is scored CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No public exploit identified at time of analysis, and no CISA KEV entry was supplied; the local-access plus human-interaction prerequisites substantially narrow practical risk compared with a network-reachable flaw.
Local compromise of the Applications DBA (AD Utilities) component in Oracle E-Business Suite 12.2.3 through 12.2.15 can let an attacker who already has logon access to the EBS host seize control of the Applications DBA component, with high confidentiality, integrity and availability impact (CVSS 3.1 base score 7.8). No authentication to the E-Business Suite application itself is needed (PR:N), but the attack is local (AV:L) and requires a separate privileged user such as a DBA to perform an action (UI:R), so the practical exposure is limited to hosts with multi-user interactive access. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; no EPSS score was supplied in the available data.
Command injection in virtualenv's bash activation script prior to 21.14.7 allows a crafted environment name or --prompt value to execute shell commands each time bash renders the prompt. The flaw arises because the script escapes the name for only one of bash's two PS1 processing passes, so a backslash before $(...) or backticks survives as command substitution; exploitation is local and requires the victim to activate the malicious environment while prompt modification is enabled. No public exploit identified at time of analysis, and virtualenv 21.14.7 contains the vendor fix.
Local takeover of Oracle Application Testing Suite 13.3.0.1 through its OpenScript component: any user who can log on to the host running the suite can leverage the flaw to gain full control of the product, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The prerequisite is meaningful - the attacker must already hold an authenticated local account on the ATS infrastructure host - but once that condition is met, exploitation is low-complexity and requires no user interaction. There is no remote or network-exploitable path, no public exploit identified at time of analysis, and exposure is effectively bounded to shared or multi-user test servers where lower-tier or untrusted accounts are permitted to log on.
Takeover of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 can be achieved by a low-privileged attacker with an existing interactive logon on the OBIEE host, through the Presentation Services component. The local CVSS 3.1 vector (7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact, but the need for local access and valid low-privilege credentials keeps this a genuine, not emergency-grade, priority. No public exploit was identified at time of analysis, and no KEV confirmation is present in the provided data.
Local takeover of Oracle HTTP Server 12.2.1.4.0 is achievable by an authenticated low-privileged user who can log on to the host running the Web Listener, yielding high confidentiality, integrity and availability impact (CVSS 7.8). The AV:L/PR:L/UI:N vector confines realistic exploitation to insiders or attackers who already hold a foothold on the server, and only version 12.2.1.4.0 is listed as affected; no public exploit code exists and there is no CISA KEV entry, so the status is no public exploit identified at time of analysis.
Local privilege escalation in Oracle JD Edwards EnterpriseOne Tools (Installation Security component, versions 9.2.0.0 through 9.2.26.5) allows an attacker holding low-privileged logon access on the application host to take over the product, with high confidentiality, integrity, and availability impact (CVSS 7.8). Exploitation is not remote: it requires a local foothold and valid low-privileged credentials on the infrastructure where EnterpriseOne Tools runs, so the practical exposure is insider threat and post-exploitation escalation rather than an internet-facing emergency. No public exploit code has been identified at time of analysis.
Local privilege escalation in the Oracle Solaris 11.4 kernel lets an attacker who already holds a low-privileged logon on the host elevate to full control, compromising confidentiality, integrity, and availability. The flaw is local-only (AV:L) and requires a valid account (PR:L), but needs no user interaction and is low complexity, so a local user meeting the prerequisite can exploit it reliably. The provided intelligence does not confirm CISA KEV active exploitation or publicly available exploit code, so exploitation status is no public exploit identified at time of analysis.
Takeover of the Applications Platform Engineering component in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for an attacker who already holds a low-privileged local logon on the EBS host. The flaw sits in the 'Valid Session' component, is low-complexity with no user interaction, and yields high confidentiality, integrity, and availability impact (CVSS 7.8). Exploitation is gated by the AV:L/PR:L prerequisites, and no public exploit code was identified at time of analysis.
Takeover of Oracle JD Edwards EnterpriseOne Tools (Enterprise Infrastructure SEC component) is possible for an attacker who already holds a low-privileged authenticated logon on the host running the product, affecting versions 9.2.0.0 through 9.2.26.5. The flaw is local rather than network-reachable (AV:L), needs no user interaction, and has low attack complexity, so once the prerequisite account access exists the attacker can reliably gain high confidentiality, integrity, and availability impact, yielding a CVSS 3.1 base score of 7.8. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical gating factor is possession of local credentials on the EnterpriseOne server tier.
Local privilege escalation in Oracle Solaris 11.4 lets an attacker who already holds a low-privileged logon escalate to full control of the host through the Services component, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.8). Exploitation is local only (AV:L) and requires a valid low-privileged account (PR:L), but no user interaction (UI:N) and low complexity (AC:L) mean escalation is reliable once a foothold exists. No public exploit code or confirmed active exploitation was identified at time of analysis, and hosts where untrusted users have no shell access are not exposed.
Local privilege escalation in Oracle E-Business Suite (Oracle Application Object Library, DB Privileges component) allows a low-privileged user who can log on to the infrastructure hosting the application to compromise the product and achieve takeover of it, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8). Affected releases are 12.2.3 through 12.2.15; the AV:L/PR:L/UI:N vector means a remote unauthenticated attacker cannot reach the flaw directly - the attacker must already hold valid low-privilege credentials plus interactive logon to the EBS host, which realistically limits exposure to insiders or intruders who have established an initial foothold. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible but not emergency-level patching priority.
Local privilege escalation in Oracle VM VirtualBox 7.2.20 lets a user who already holds a low-privileged logon on the host take over the VirtualBox instance with low complexity and no user interaction, causing high confidentiality, integrity, and availability impact. The flaw scores 7.8 HIGH and is strictly local (AV:L), so it cannot be reached remotely without prior host access. No public exploit code or CISA KEV entry was identified at time of analysis; risk is concentrated on shared, multi-user, or untrusted local hosts running the affected release.
A local privilege-escalation flaw in the Enterprise Manager Install component of Oracle Enterprise Manager Base Platform lets a low-privileged user who can log on to the host running the platform escalate to full control of the EM Base Platform itself, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.8). Only versions 13.5 and 24.1 are affected, and exploitation is not possible over the network - CVSS vector AV:L/PR:L/UI:N means the attacker needs existing interactive logon plus at least low-privilege credentials on the EM infrastructure, and no user interaction or non-default configuration. There is no public exploit code and no confirmed active exploitation (not in CISA KEV) at time of analysis; fixes are published in Oracle's October 2026 Critical Patch Update advisory.