Unauthenticated network attackers can read critical data from Oracle Siebel CRM Integration's Open Integration component in versions 25.12 through 26.9 over HTTP, with CVSS 3.1 base score 7.5 reflecting high confidentiality impact and no integrity or availability impact. Exploitation requires only that the integration HTTP endpoint be reachable, since the assessed vector is PR:N/UI:N with low attack complexity. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Unauthenticated network attackers can read critical data from Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 via the Oracle Net communication layer (CVE-2026-91308), which Oracle rates as easily exploitable and assigns CVSS 3.1 7.5 HIGH. The flaw is a confidentiality-only authentication bypass in the Installation Security component: PR:N/UI:N with C:H, while integrity and availability are unaffected. No CISA KEV entry or public exploit code was identified in the supplied intelligence at time of analysis, so risk is highest where the Oracle Net listener is reachable from untrusted networks.
Unauthenticated network attackers can access critical data in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 by exploiting an Installation Security flaw reachable over Oracle Net. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N) describes a low-complexity confidentiality-only issue with no integrity or availability impact. No public exploit code was identified at time of analysis, and the primary exposure constraint is whether Oracle Net/listener access is reachable from untrusted networks.
Unauthenticated HTTP requests against the Acollect component of Oracle Agile PLM 2.6 can return critical product-lifecycle data, letting any network-positioned attacker read everything the application can access without credentials or user interaction. The impact is confidentiality-only (C:H/I:N/A:N) at CVSS 7.5, so the flaw enables bulk data disclosure rather than tampering or disruption, and exploitation becomes trivial the moment the HTTP interface is reachable. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but with PR:N/AC:L characteristics, internet-facing or partner-exposed instances should be treated as high-priority exposure.
Code execution in Advantech ADAM-3600 can be achieved by an authenticated attacker with high privileges who supplies crafted input to the device's logs settings functionality, triggering a stack-based buffer overflow. The flaw is network-reachable but requires valid administrative or operator access and high attack complexity, so real-world risk is moderate-priority and concentrated in OT environments where the management interface is exposed or privileged credentials are compromised. No public exploit code or confirmed active exploitation was identified at time of analysis, and Advantech's security advisory should be consulted for fixed firmware.
Oracle Payroll in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by a low-privileged, authenticated attacker who reaches the Internal Operations component over HTTP, although Oracle rates exploitation as difficult because success depends on conditions outside the attacker's control. The CVSS 7.5 vector shows high confidentiality, integrity, and availability impact, but no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) are present in the supplied intelligence, making this a genuine but second-tier priority. Organizations not running EBS 12.2.x with the Payroll module are not affected.
Authenticated low-privileged attackers with HTTP network access can compromise Oracle Payroll in Oracle E-Business Suite 12.2.3 through 12.2.15 through a high-complexity flaw in the Internal Operations component, potentially achieving takeover with high confidentiality, integrity, and availability impact. Exploitation requires a valid low-privileged account and non-default preconditions (AC:H), and no public exploit was identified at time of analysis. The vendor rates the issue difficult to exploit, making it a genuine but second-tier priority compared with unauthenticated or actively exploited EBS flaws.
Oracle Payroll in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by a low-privileged, authenticated attacker who can reach the component's Internal Operations interface over HTTP. Oracle describes the issue as difficult to exploit (AC:H) despite high confidentiality, integrity, and availability impact, and the CVSS 3.1 base score is 7.5. No public exploit code or confirmed active exploitation is identified at time of analysis, so the realistic threat profile is a motivated authenticated insider or an attacker who has already obtained low-privileged EBS credentials.
Oracle Capacity in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by a low-privileged, authenticated attacker who reaches the Internal Operations component over HTTP, with high confidentiality, integrity, and availability impact (CVSS 7.5). Exploitation is rated difficult (AC:H) because it depends on non-default preconditions that are not publicly documented. No public exploit identified at time of analysis, and no CISA KEV entry or EPSS score was supplied; defenders should prioritize instances exposing the Capacity module to untrusted networks and verify the October 2026 Oracle CPU guidance.
Oracle Essbase 21.8.3.0.0 can be hung or repeatedly crashed by unauthenticated remote attackers who can reach the Security component over TCP, producing a complete denial of service with no confidentiality or integrity impact. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), so no credentials or user interaction are required according to the supplied assessment. No public exploit identified at time of analysis, and no CISA KEV entry is present; exposure is highest for internet-reachable or broadly accessible Essbase deployments.
Full application takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible through its Product Quality Management component, with high confidentiality, integrity, and availability impact. The attack path requires network access to the HTTP interface and valid low-privileged credentials, and Oracle rates exploitation as difficult (AC:H), so risk is concentrated in exposed, access-controlled deployments where an attacker already has a foothold. No public exploit was identified at time of analysis; this is a genuine but second-tier priority rather than an emergency patch item.
Takeover of Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 is possible for authenticated low-privileged attackers with network access via HTTP, according to Oracle's October 2026 Critical Patch Update. The Content Portal Suite component flaw is rated CVSS 7.5 with high attack complexity and no user interaction, giving high confidentiality, integrity, and availability impact; it is serious but not top-tier urgent. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.
Authenticated attackers with only low privileges can achieve full takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through the Fabric Layer over HTTP, with high impact to confidentiality, integrity, and availability. Exploitation is rated difficult (CVSS AC:H) because specific conditions outside the attacker's control must align, and a valid low-privileged SOA Suite account is required (PR:L). No public exploit code or CISA KEV entry was identified in the available intelligence at time of analysis.
Takeover of Oracle Outside In Technology 8.5.8 can occur when a victim-side application processes a crafted document through the Outside In PDF Export SDK. The flaw is network-reachable but requires human interaction and high attack complexity, and no public exploit has been identified at time of analysis. This is a moderate-priority issue concentrated in deployments that feed untrusted files into Outside In.
Oracle PeopleSoft PeopleTools 8.61 through 8.63 can be fully taken over by an unauthenticated attacker who has access to the same physical or adjacent network segment as the host running the PsAdmin component. The flaw is rated CVSS 7.5 with high confidentiality, integrity and availability impact, but exploitation is explicitly difficult (AC:H) and requires network adjacency (AV:A), so it is not reachable from arbitrary internet locations; no public exploit code has been identified and it is not confirmed actively exploited (no CISA KEV listing). Oracle addressed it in the October 2026 Critical Patch Update, so priority should be moderate - patch on a normal cycle and treat segment isolation as the main exposure control.
Unauthenticated attackers positioned on the same physical network segment as a JD Edwards EnterpriseOne Tools host can potentially achieve full takeover of the product (confidentiality, integrity and availability all High) by exploiting a flaw in the Installation Security component of supported releases 9.2.0.0 through 9.2.26.5. The vendor-supplied CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N) means exploitation is not possible from the internet and is further gated by high attack complexity, so real-world priority is materially lower than the 7.5 base score suggests. No public exploit code, CISA KEV entry, or EPSS score was present in the available intelligence at time of analysis, and Oracle addresses the issue through its October 2026 Critical Patch Update advisory.
Stormshield Network Security's Autoupdate routine can accept unauthenticated dynamic data files because of a logic error in its signature-verification check, allowing an adjacent-network attacker who interposes on the update channel to undermine the integrity of dynamic content. Exploitation requires that Autoupdate be in use and that the attacker can supply or tamper with update files reaching the appliance, with no credentials or user interaction needed but high attack complexity due to the need to interpose on or race the update fetch. No public exploit code or CISA KEV active-exploitation signal was identified at time of analysis.
Java sandbox boundary flaw in Oracle Java SE 8u503 and 8u503-perf client deployments can let a low-privileged local attacker obtain high confidentiality and integrity impact, with scope change to additional products, but only in legacy sandboxed Java Web Start or applet scenarios that execute untrusted code. The 7.5 HIGH score is tempered by the local attack vector, high attack complexity, and required low-privileged logon; server deployments running only trusted administrator-installed code are explicitly out of scope. No public exploit identified at time of analysis, and exploitation is not confirmed in CISA KEV.
A low-privileged attacker with a local logon to the infrastructure hosting Oracle VM VirtualBox 7.2.20 can achieve full takeover of the hypervisor, consistent with a guest-to-host escape profile, provided a person other than the attacker performs an action on the VM and additional high-complexity conditions are met. Successful exploitation yields high confidentiality, integrity and availability impact and, because of the scope change, can significantly affect products beyond VirtualBox itself, including the host and co-hosted workloads. Oracle scores this 7.5 High; no public exploit code and no confirmed active exploitation have been identified at time of analysis, and the local-only vector plus mandatory second-party interaction substantially limit real-world exposure.
Denial of service in the MCP TypeScript SDK affects HTTP-reachable servers running @modelcontextprotocol/sdk 1.3.0 through 1.31.0 or @modelcontextprotocol/server 2.0.0 through 2.2.0, allowing unauthenticated remote attackers to exhaust Node.js heap memory with a single tools/call request containing very large arrays or records. The default 4 MiB request-size limit is large enough to carry an exhausting payload, causing the process to abort with a JavaScript heap out-of-memory error. Vendor patches are available in 1.32.0 and 2.3.0, but the new maxToolInputElements guard is opt-in and disabled by default; no public exploit code was identified at time of analysis, and stdio-only servers are not affected.
Unauthenticated HTTP requests to ApostropheCMS import-export module routes before version 3.7.0 can force the server to initialize uploads, store chunks, and perform temporary processing, consuming disk, memory, and processing resources and degrading availability; ApostropheCMS core prior to 4.33.0 bundles the vulnerable module. The flaw is rated CVSS 7.5 with availability-only impact, requires the import-export module to be installed and its routes network-reachable, and has no public exploit identified at time of analysis.
Unauthenticated task-read disclosure in the A2A Java SDK before 1.3.0.Final lets any network caller retrieve another caller's task status, context ID, message history, and artifacts by supplying a task ID. The default no-argument InMemoryTaskStore constructor leaves authorizationProvider null, so InMemoryTaskStore.get(String taskId) returns stored tasks without any owner or caller check unless a TaskAuthorizationProvider is wired through the AuthorizationRequestHandlerDecorator - a wiring that manual DefaultRequestHandler.builder().build() setups and integrations such as Spring commonly skip. Because the default/reference transport endpoints also perform no authentication, the exposure is reachable without an account in multi-caller deployments; exploitation additionally requires the attacker to know or guess a valid task ID, and no public exploit code has been identified at time of analysis.
Unauthenticated remote attackers can exhaust Eclipse ioFog Controller 3.8.0 through 3.9.1 by sending small JSON bodies to POST, PUT, or PATCH routes that perform template substitution, stalling or aborting the control-plane process before bearer-token and RBAC checks run. The bearer check does not reject missing or invalid tokens and the DoS rate limit covers only login routes, so a reachable templating route is enough to disrupt the agent API and in-process WebSocket relays. No public exploit was identified at time of analysis, and the impact is limited to availability with no confidentiality or integrity effect; reporting is consistent with a genuine, impact-limited availability threat.
Unauthenticated information disclosure in Apache Cocoon can expose diagnostic interfaces, cache-triggering operations, verbose debug logging, and profile information to any user who can reach those endpoints; all versions are affected. The project is retired and no vendor fix is planned, so exposure is limited to deployments that leave diagnostic/debug endpoints accessible beyond trusted networks. No public exploit code or CISA KEV entry was identified at time of analysis.
Authorization bypass in OpenChoreo (1.0.0 through 1.0.5, 1.1.0 through 1.1.6, and 1.2.0 through 1.2.4) lets an authenticated user holding workflowrun:update on one project or component rewrite the ownership labels of a different WorkflowRun in the same namespace. Because the PUT .../workflowruns/{runName} handler derives its authorization hierarchy from the openchoreo.dev/project and openchoreo.dev/component labels in the request body while loading the target run from the URL path, an attacker who names a victim run in the path and submits labels for a scope they control is subsequently treated as authorized to read build logs and Kubernetes events, delete the run, modify pending spec.workflow.parameters, or drive the run into a permanent ComponentValidationFailed state. CVSS 3.1 scores this 7.4 with scope change (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L), but exposure is limited to deployments where multiple projects or components share a single namespace; it is not anonymously reachable and not cross-tenant, and no public exploit code was identified at time of analysis. Vendor-released patches exist in 1.0.6, 1.1.7, and 1.2.5.
Unauthenticated remote attackers can corrupt or destroy data and trigger repeatable crashes of MySQL Server and MySQL Cluster through the Server: Replication component, affecting Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 and Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Oracle rates it 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H), explicitly calling it difficult to exploit, so success likely hinges on specific replication state, timing or race conditions rather than a single crafted request, and there is no confidentiality impact - the exposure is unauthorized creation, deletion or modification of critical data plus a hang or frequently repeatable full denial of service. No public exploit code or confirmed active exploitation was identified at time of analysis, and this is best treated as a genuine but second-tier priority concentrated on database nodes whose ports are network-reachable.
Oracle Agile Product Lifecycle Management for Process 6.2.4 exposes an unauthenticated HTTP attack surface in its Product Quality Management component that permits high-impact confidentiality and integrity compromise, with CVSS 3.1 scored at 7.4 (HIGH). Per Oracle's advisory, exploitation is rated difficult (AC:H) because success requires conditions outside the attacker's control, but no privileges (PR:N) or user interaction (UI:N) are needed once those conditions align, and there is no availability impact. No EPSS score, CISA KEV listing, or public exploit code was identified at time of analysis, so exposure is driven by whether the PLM HTTP interface is reachable from untrusted networks rather than by observed attack activity.
Unauthenticated, remote exploitation of the Oracle Concurrent Processing component in Oracle E-Business Suite 12.2.3 through 12.2.15 can expose and corrupt critical application data, with high confidentiality and integrity impact but no availability impact. Oracle characterizes the flaw as difficult to exploit (CVSS:3.1 AV:N/AC:H/PR:N/UI:N, base score 7.4) because success depends on conditions outside the attacker's control, such as a specific application state or timing, rather than a single deterministic HTTP request. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied, so triage priority should be driven mainly by whether the EBS web tier is reachable from untrusted networks.
Unauthenticated network attackers can read and modify critical data in Oracle Mobile Field Service (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 through the Admin UI over HTTP, with no user interaction required. Oracle rates attack complexity as high ("difficult to exploit"), indicating specific preconditions constrain reliable exploitation. No public exploit identified at time of analysis.
Unauthenticated network attackers can read and modify critical data in Oracle Mobile Field Service, the field-service module of Oracle E-Business Suite 12.2.3 through 12.2.15, by targeting the Admin UI over HTTP. Oracle rates the issue CVSS 3.1 7.4 with high confidentiality and integrity impact, but attack complexity is high, meaning successful exploitation depends on conditions outside the attacker's control. No public exploit code or CISA KEV entry was identified at time of analysis, so risk is concentrated on internet-reachable EBS instances that actually deploy this module.
Unauthenticated network attackers can read and modify critical data in Oracle Mobile Field Service within Oracle E-Business Suite 12.2.3 through 12.2.15 through the Admin UI, but exploitation is rated difficult because high attack complexity means success depends on server-state or environmental conditions outside the attacker's direct control. Oracle's October 2026 Critical Patch Update references remediation, and no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated network attackers can potentially read and modify critical data handled by Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 through the LDAP Gateway component, with no user interaction required. Oracle rates the flaw as 'difficult to exploit' (CVSS 7.4, AC:H), meaning the attacker must satisfy preconditions outside their direct control before a reliable attack is possible; confidentiality and integrity of all connector-accessible data are both fully impacted, while availability is unaffected. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a genuine but second-tier priority that should be remediated in the normal Critical Patch Update cycle.
Unauthenticated, remote attackers can read and modify critical data in the Server Infrastructure component of Oracle Siebel CRM Deployment across supported versions 17.0 through 26.9, with a CVSS 3.1 base score of 7.4 (High) driven entirely by high confidentiality and integrity impact. Oracle rates the flaw as 'difficult to exploit' (AC:H), meaning success depends on conditions outside the attacker's control - server state, timing, or an unspecified precondition - which tempers the headline score and argues for a lower real-world priority than the 7.4 suggests; no public exploit code and no KEV listing were identified at time of analysis. Authentication and user interaction are not required (PR:N, UI:N), and the advisory metadata tags the issue as an authentication bypass, so exposure should be scoped by network reachability to the deployment server rather than by credential controls. The fix is delivered through Oracle's October 2026 Critical Patch Update.
Oracle JD Edwards EnterpriseOne Tools releases 9.2.0.0 through 9.2.26.5 expose an unauthenticated, network-reachable weakness in the Interoperability 'SEC' component that can let a remote attacker read, create, delete, or modify critical data over HTTPS, with no user interaction required and no availability impact. Oracle characterizes the flaw as 'difficult to exploit' (CVSS 3.1 7.4, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning success depends on conditions outside the attacker's full control rather than a single deterministic request. No public exploit code has been identified at time of analysis, and the issue is addressed through the Oracle Critical Patch Update referenced in the advisory (October 2026).
Unauthenticated network attackers who can reach the Interoperability SEC component of JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 over TLS can read and modify critical business data, although Oracle rates the attack as difficult (AC:H) because an unspecified precondition must be satisfied. No public exploit code or confirmed active exploitation has been identified at time of analysis. Oracle's October 2026 Critical Patch Update advisory is the reference for remediation.
Unauthenticated attackers with network access to Oracle E-Business Suite's Shipping Execution module can bypass authentication in the Workflow Events component to read and modify critical shipping data. The flaw affects E-Business Suite 12.2.3 through 12.2.15 and carries a CVSS 3.1 base score of 7.4 with high confidentiality and integrity impact but no availability impact; the high attack complexity (AC:H) reflects difficult-to-satisfy exploitation preconditions rather than a lack of severity. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated network attackers can read and modify critical data in Oracle E-Business Suite's Mobile Application Server (MWA Terminal Server) versions 12.2.3 through 12.2.15, with a CVSS 3.1 score of 7.4. Oracle rates the issue difficult to exploit because of high attack complexity, and no public exploit code or CISA KEV active-exploitation signal was identified at time of analysis. Exposure is greatest where the MWA Terminal Server is reachable beyond trusted internal or warehouse-handheld networks.
Oracle MySQL Router 26.7.0 exposes an HTTPS-facing weakness (component Router: General) that can be attacked without credentials (PR:N, UI:N), letting a network-positioned adversary read and tamper with data the Router can reach - scored CVSS 7.4 with High confidentiality and integrity impact but no availability impact. Oracle characterizes exploitation as 'difficult' (AC:H), meaning success depends on timing, internal state, or non-default configuration rather than a single deterministic request, which tempers real-world risk despite the high impact rating. No public exploit code and no CISA KEV entry were identified at time of analysis, and no vendor fix version is documented in the available data beyond the October 2026 Oracle CPU reference.
Unauthorized reads and modifications of critical Primavera Unifier data are possible for unauthenticated, network-positioned attackers in versions 21.12.0 through 21.12.17, though exploitation is rated high-complexity (AC:H) and depends on conditions outside the attacker's control. The CVSS 3.1 score of 7.4 reflects high confidentiality and integrity impact with no availability impact. No public exploit identified at time of analysis; active exploitation is not confirmed.
Unauthenticated network attackers can read and modify critical data in Oracle Communications Billing and Revenue Management 15.x through the Platform component's TLS interface, but Oracle rates the issue difficult to exploit because success depends on high-complexity preconditions (AC:H). The flaw affects 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0 with CVSS 3.1 score 7.4 (C:H/I:H/A:N); no public exploit identified at time of analysis. Internet-facing BRM Platform TLS endpoints are the primary risk multiplier.
Unauthenticated network attackers can read and modify critical data in Oracle Siebel CRM End User through the Portal Framework over HTTPS in versions 17.0 through 26.9. The CVSS 7.4 rating reflects high attack complexity, meaning successful exploitation depends on conditions outside the attacker's control and mass exploitation is less likely; no public exploit code or CISA KEV active exploitation has been identified at time of analysis. Confidentiality and integrity are affected, availability is not, and impact remains within Siebel CRM End User-accessible data.
Unauthenticated remote attackers who can reach the Siebel HTTP interface can read, create, delete, or modify critical data held in Oracle Siebel CRM Deployment versions 17.0 through 26.9, although Oracle rates the issue as difficult to exploit (AC:H), meaning successful abuse depends on conditions outside the attacker's direct control such as specific server configuration, state, or timing rather than a single deterministic request against a default install. Confidentiality and integrity of Deployment-accessible data are both fully compromised, while availability is unaffected and no scope change to other systems occurs. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a genuine but second-tier priority to be scheduled alongside the October 2026 Oracle Critical Patch Update rather than treated as an emergency.
Unauthenticated network attackers can create, delete, modify, or read critical data in Oracle E-Business Suite iProcurement versions 12.2.3 through 12.2.15 by reaching the Internal Operations component over HTTPS. Oracle rates the issue difficult to exploit because of high attack complexity, meaning successful exploitation likely requires a specific server-side condition rather than a single deterministic request. No public exploit code or confirmed active exploitation was identified at time of analysis.
JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 exposes an Interoperability SEC weakness over JDENET that can let unauthenticated network attackers read and alter critical application data. Oracle describes exploitation as difficult, with high attack complexity as the main barrier, and no public exploit identified at time of analysis or confirmed active exploitation (CISA KEV). Availability is not affected, but confidentiality and integrity impacts are high.
Unauthenticated data tampering and disclosure in the Workflow Events component of Oracle Shipping Execution (Oracle E-Business Suite 12.2.3 through 12.2.15) can be triggered by a network attacker over HTTP, yielding full confidentiality and integrity impact on the module's accessible data with a CVSS 3.1 base score of 7.4. Oracle explicitly characterizes the flaw as difficult to exploit (AC:H), so a successful attack depends on conditions outside the attacker's control rather than a single crafted request, and there is no availability impact - the realistic risk is data disclosure and modification, not service disruption. No public exploit code or confirmed active exploitation was identified at time of analysis, and given the high attack complexity this is best treated as a genuine but second-tier priority addressed through the October 2026 Critical Patch Update.
Oracle Solaris 11.4 exposes a local attack path through its Plugins component in which an attacker who already holds high-privileged logon access must also obtain interaction from a different user, after which the attacker can read and modify critical Solaris data and potentially affect other products because the scope changes. CVSS 3.1 scores this at 7.4 with high confidentiality and integrity impact but no availability impact, making it serious for privileged local environments while remaining constrained by the PR:H and UI:R prerequisites. No public exploit was identified at time of analysis, and the Oracle October 2026 Critical Patch Update advisory is the available remediation reference.
Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contains a Core component flaw that unauthenticated network attackers can reach through the TLS listener, allowing limited read, update/insert/delete, and partial denial-of-service impact (CVSS 7.3). Oracle describes the issue as easily exploitable with no user interaction; exposure is greatest for internet-facing or broadly reachable WebLogic instances, while segmented admin/TLS interfaces materially reduce risk. No public exploit identified at time of analysis.
Ghostscript as shipped with Red Hat Enterprise Linux 8-and, per CPE data, RHEL 6, 7, 9, and 10-may allow an attacker to escape -dSAFER protections when it processes a crafted PostScript file, enabling file access outside permitted paths or command execution with the Ghostscript process's privileges. The root cause is that Red Hat's 9.25-to-9.27 rebase omitted the CVE-2019-14869 correction, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected; the supplied CVSS base score is 7.3, while the independent assessment treats confidentiality and integrity impact as High (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). No CISA KEV entry is present in the supplied data and no public exploit identified at time of analysis; practical risk is conditional on a service or pipeline actually processing untrusted PostScript/EPS with an affected RHEL build.
Oracle Essbase 21.8.3.0.0 exposes an HTTP-reachable Security component flaw that unauthenticated remote attackers can use to read a subset of data, modify or delete some records, and partially disrupt availability. CVSS 3.1 rates it 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), with no public exploit identified at time of analysis. The practical risk is highest where Essbase HTTP services are reachable from untrusted networks, because no authentication, user interaction, or special conditions are required.
Oracle Agile Engineering Data Management 6.2.1 contains a high-impact confidentiality and integrity flaw in its Install component that unauthenticated attackers can exploit only from an adjacent network segment, and only if a non-attacker user performs a triggering action. Successful exploitation could let an attacker create, delete, or modify critical data and read all EDM-accessible data, but the adjacent-network and user-interaction prerequisites keep real-world risk below the 7.3 CVSS score for most deployments. No public exploit code or confirmed active exploitation was identified at time of analysis.