A denial-of-service flaw in Oracle Outside In Clean Content SDK 8.5.8 (part of Oracle Fusion Middleware) lets remote attackers crash or hang the parsing engine by submitting a malformed document. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, A:H), no authentication or user interaction is required once a crafted file reaches the parser, but the real gate is deployment exposure: the SDK is a library, so only services that ingest and convert untrusted documents are meaningfully reachable. Impact is availability-only - complete denial of service with no confidentiality or integrity loss; no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated network attackers can cause a complete denial of service-hang or repeatable crash-against Oracle Solaris 11.4 by reaching an HTTP-handling service that routes into the vulnerable Kernel component. The flaw is rated CVSS 7.5 with availability-only impact (C:N/I:N/A:H) and, per the vector, requires no privileges or user interaction; it cannot be used for data theft or code execution. No public exploit or CISA KEV entry is identified in the provided data, so the practical risk is bounded by whether the exposed HTTP service is reachable from untrusted networks.
Unauthenticated network attackers can cause a hang or frequently repeatable crash of Oracle Solaris 11.4 by reaching the Kernel component through an HTTP-exposed path, producing a complete denial of service with no confidentiality or integrity impact. The CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code or CISA KEV entry was identified at time of analysis. Practical exposure is limited to systems where the vulnerable HTTP-handling path is reachable from untrusted networks.
Denial of service in Oracle Outside In Technology 8.5.8 allows unauthenticated, network-accessible attackers to hang or repeatedly crash the Outside In Core document parsing/conversion path, producing complete availability loss for applications that expose those functions over HTTP. The flaw is an embedded SDK issue, so real-world exposure is limited to products that pass untrusted files into Outside In for preview or conversion; confidentiality and integrity are unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote attackers can hang or repeatedly crash services that embed Oracle Outside In Technology 8.5.8 (Outside In Core) by delivering a crafted malformed document to its file-parsing engine, producing a CVSS 7.5 availability-only denial of service (AV:N/AC:L/PR:N/UI:N/A:H, no confidentiality or integrity impact). Because Outside In is a parsing SDK rather than a network service, real exposure is limited to applications that expose its document-conversion/filtering functionality to attacker-supplied files over HTTP; deployments that only process trusted internal documents are not practically reachable. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied in the feed data, so the practical risk is bounded to availability disruption of document-processing pipelines.
Unauthenticated attackers able to reach an Oracle Service Bus HTTP listener can hang or repeatedly crash the Core component in versions 12.2.1.4.0 and 14.1.2.0.0, producing a complete denial of service (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Triggering it demands no credentials, no user interaction and little complexity, so the real gating factor is network exposure - internet-facing or partner-reachable Service Bus instances are the ones at risk, while segmented internal deployments are materially harder to hit. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; Oracle ships fixes through its October 2026 Critical Patch Update.
Unauthenticated network attackers can cause MySQL Router 26.7.0 to hang or repeatedly crash, resulting in complete denial of service for the routing tier. The CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with availability-only impact and no effect on confidentiality or integrity. No public exploit code or confirmed active exploitation was identified at time of analysis, and exposure is reduced where Router listeners are firewalled from untrusted networks.
Denial of service in Oracle Helidon 4.0.0 through 4.5.5 and 27.0.0 can let a network attacker hang or repeatedly crash a Helidon process through the helidon-webclient-http2 component, with CVSS 3.1 score 7.5 reflecting availability-only impact. The issue is unauthenticated and requires no user interaction, but it is bounded: the application must actually use the HTTP/2 WebClient path and be able to reach or be reached by a malicious HTTP/2 peer. No public exploit code or CISA KEV entry is identified in the available data, so this is a serious but conditional availability risk rather than confirmed active exploitation.
Oracle BI Publisher exposes sensitive data to unauthenticated network attackers through its Web Server component, affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0. Successful exploitation yields complete confidentiality impact over HTTP with no user interaction, matching a CVSS 7.5 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated data disclosure in the Oracle Mobile Field Service Admin UI component of Oracle E-Business Suite 12.2.3 through 12.2.15 allows any attacker who can reach the HTTP interface to read critical data without credentials or user interaction. Oracle rates it 7.5 (High) with a confidentiality-only profile (C:H, I:N, A:N), so exploitation yields data exposure rather than modification or disruption, and the practical exposure depends almost entirely on whether the Admin UI is internet-facing or segmented. No public exploit code or confirmed active exploitation was identified at time of analysis; Oracle's October 2026 CPU advisory is the reference for fixes.
Unauthenticated SQL injection in the EventON - Subscriber WordPress plugin (all versions up to and including 1.4.5) allows remote attackers to append arbitrary SQL clauses to the plugin's existing database queries through the 'email' parameter, enabling extraction of sensitive data such as user credentials, password hashes, and other site secrets. The defect is a classic CWE-89 input-handling failure - the parameter is neither escaped nor bound via prepared statements - and scores 7.5 with high confidentiality impact but no integrity or availability effect, reflecting a read-only exfiltration path. No public exploit code or confirmed active exploitation was identified at time of analysis, although the unauthenticated network vector, low attack complexity, and absence of user interaction make the flaw an attractive target for automated scanning against any internet-facing site with the add-on active.
Unauthenticated remote attackers can read critical data from Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 over HTTP, with the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, base 7.5) indicating a low-complexity, no-prerequisites confidentiality breach with no integrity or availability impact. The flaw is classified by the reporter under an authentication-bypass tag, meaning access controls on a WebCenter Sites interface can be sidestepped rather than brute-forced, exposing all data the application can reach. No public exploit code was identified at time of analysis and the CVE is not in CISA KEV, so there is no confirmed active exploitation, though the combination of unauthenticated network reachability and high confidentiality impact makes this a genuine priority for internet-facing deployments rather than an inflated score.
Unauthenticated HTTP requests to Oracle WebCenter Sites can disclose critical content and site data in versions 12.2.1.4.0 and 14.1.2.0.0 because of an authentication bypass, rated CVSS 7.5 with confidentiality-only impact. Exploitation requires only network reachability to the WebCenter Sites interface - no credentials or user interaction - but the flaw does not permit data modification or service disruption. No public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated remote attackers can read critical data from Oracle Siebel CRM Deployment (Server Infrastructure component) in supported versions 17.0 through 26.9 via HTTP, with low attack complexity and no user interaction, yielding a CVSS 3.1 score of 7.5 (High) and confidentiality-only impact. No public exploit identified at time of analysis, and no CISA KEV active exploitation is reported. Remediate by applying Oracle's October 2026 Critical Patch Update referenced in the vendor advisory.
Unauthenticated remote attackers can read critical data from Oracle Siebel CRM Deployment (Server Infrastructure component) in supported versions 17.0 through 26.9 by sending HTTP requests, due to an authentication bypass flaw (CVSS 3.1 base score 7.5). The vulnerability is network-reachable with low complexity and no user interaction, but impacts only confidentiality (C:H/I:N/A:N), so it enables data disclosure rather than data modification, denial of service, or code execution. No public exploit code or active exploitation (CISA KEV) was identified at time of analysis; exposure is limited to deployments whose Siebel HTTP endpoint is reachable from the attacker's network position.
Unauthenticated information disclosure in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 allows a network attacker to read critical data through the Installation Security component, with a CVSS 3.1 base score of 7.5. The flaw is low complexity and requires no credentials or user interaction, but impact is limited to confidentiality, with no integrity or availability effect. No public exploit was identified at time of analysis, and practical risk is concentrated on instances reachable over HTTP from an attacker's network position because JD Edwards EnterpriseOne is typically an internally deployed ERP.
Unauthenticated HTTP access to the Oracle SOA Suite Fabric Layer can disclose critical data in Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0. The flaw is network-reachable with low complexity and requires no privileges or user interaction (CVSS 3.1 base 7.5, confidentiality-only), and no public exploit code was identified at time of analysis. Real-world exposure is limited to deployments whose SOA Suite HTTP interface is reachable by untrusted networks.
Information disclosure in Oracle Solaris 11.4's Image Packaging System (IPS) allows unauthenticated remote attackers with HTTP network access to read critical data or all data accessible to the system; CVSS 3.1 is 7.5 with confidentiality-only impact. Oracle's October 2026 CPU identifies the affected component and version, but no public exploit code or CISA KEV entry is present in the supplied intelligence, so there is no public exploit identified at time of analysis. Exposure is limited to deployments where the IPS/pkg HTTP interface is reachable by untrusted networks.
Unauthenticated remote attackers can disclose critical data from Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 by reaching the Authentication Engine over HTTP; the issue is rated CVSS 7.5 with high confidentiality impact and no integrity or availability effect. Exploitation requires only network reachability to the OAM authentication endpoint, making internet-exposed or broadly reachable deployments the priority. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied.
Unauthenticated network attackers can obtain unauthorized read access to critical data accessible through Oracle MySQL Connector/Python 26.7.0, the only affected release. Rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only), the flaw is remotely reachable at low complexity without privileges or user interaction, but impact is bounded to data disclosure and to deployments where the connector is network-exposed. No public exploit code or confirmed active exploitation was identified at time of analysis; Oracle's October 2026 Critical Patch Update is the reference advisory.
Unauthenticated, network-reachable attackers can access critical or all Oracle Shipping Execution data in Oracle E-Business Suite versions 12.2.3 through 12.2.15 by targeting the Workflow Events component over HTTP. The flaw is rated 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), with high confidentiality impact and no integrity or availability impact; no public exploit code or CISA KEV entry was identified at time of analysis. Exposure is limited mainly by whether the EBS web tier is reachable from untrusted networks.
Unauthenticated, remote attackers can read critical data from Oracle Communications Billing and Revenue Management (BRM) Server versions 15.0.0.0.0, 15.0.1.0.0.0, 15.1.0.0.0, and 15.2.0.0.0 over HTTP, with CVSS 3.1 score 7.5 driven solely by confidentiality impact. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates no credentials or user interaction are required, and there is no integrity or availability impact. No public exploit was identified at time of analysis, and no KEV or EPSS signal was supplied; real-world risk depends heavily on whether the BRM Server HTTP interface is reachable from untrusted networks.
Unauthenticated remote attackers who can reach the HTTP interface of Oracle Communications Unified Inventory Management (versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1) can read critical data without supplying any credentials, because of a flaw in the product's Security component. The exposure is purely confidentiality-focused (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) - no integrity or availability impact and no host-level privilege escalation - so a successful attack amounts to full disclosure of inventory data the application can access. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical barrier to abuse is network exposure: UIM is a back-office telecom OSS platform normally kept on internal management networks rather than the public internet.
Unauthenticated network attackers can read sensitive Oracle Applications Manager data in Oracle E-Business Suite 12.2.3 through 12.2.15 through the Oracle Diagnostics Interfaces component. The vulnerability is remotely reachable over HTTP with low attack complexity and no credentials or user interaction required, yielding a CVSS 3.1 score of 7.5 with confidentiality-only impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and exposure is primarily limited by whether the Applications Manager interface is network-accessible.
Unauthenticated data disclosure in Oracle BI EE 8.2.0.0.0 and 26.01.0.0.0 allows a remote attacker with HTTP access to the Analytics Server to read critical data or all data accessible through the product, with a CVSS 3.1 base score of 7.5 and confidentiality-only impact. No special conditions are required beyond network reachability, so exposure is bounded mainly by whether the Analytics Server HTTP interface is Internet-facing, VPN-restricted, or behind a WAF/reverse proxy. No public exploit identified at time of analysis.
Unauthenticated information disclosure in the Oracle Siebel CRM Deployment Cloud Gateway lets any remote attacker who can reach the gateway over HTTP read critical data and, per Oracle, potentially all data accessible through that deployment; supported versions 17.0 through 26.9 are affected. The CVSS 3.1 score is 7.5 with confidentiality-only impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning no user interaction, no privileges, and no integrity or availability effect. Oracle's October 2026 Critical Patch Update advisory is the cited vendor reference and is the source of the fix; no public exploit code has been identified at time of analysis, and the flaw is not listed as confirmed actively exploited (CISA KEV).
Unauthenticated attackers can read sensitive data from Oracle Siebel CRM End User versions 17.0 through 26.9 by exploiting an authentication bypass in the UIF Open UI component over HTTP. The CVSS 7.5 vector shows network reachability with low complexity, no privileges, and no user interaction, but impact is confined to confidentiality (C:H/I:N/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated remote attackers who can reach an Oracle Siebel CRM Deployment server over HTTP can read critical data or the full set of data accessible to that deployment, affecting versions 17.0 through 26.9 of the Server Infrastructure component. The flaw scores CVSS 3.1 7.5 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, meaning no credentials, no user interaction and no special configuration are prerequisites, and impact is limited to confidentiality - no integrity or availability effect is described. Oracle published the fix in its October 2026 Critical Patch Update; no public exploit code has been identified at time of analysis, and no EPSS score was supplied with the available intelligence.
Exposes critical data in Oracle Siebel CRM Deployment 17.0 through 26.9 to unauthenticated remote attackers through the TLS-exposed Server Infrastructure component, carrying a CVSS 3.1 score of 7.5 (High). Impact is confidentiality-only: attackers can read critical or all deployment-accessible CRM data but cannot modify data or disrupt service. No public exploit identified at time of analysis, and no CISA KEV entry was provided.
Unauthenticated HTTP requests to the SQR component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can return critical application data to anyone who can simply reach the web tier, a confidentiality-only but high-severity exposure scored CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N). Oracle addressed the flaw in its October 2026 Critical Patch Update; no public exploit code and no CISA KEV entry were identified in the data reviewed, so real-world risk hinges on whether the PeopleSoft Internet Architecture and SQR endpoints are internet-reachable or segmented behind VPNs, reverse proxies, or internal networks. This is a credible operational priority rather than an inflated high-CVSS artifact, because the attacker needs no credentials, no user interaction, and no non-default configuration once the endpoint is reachable.
Unauthenticated HTTP requests to the Report Distribution component in PeopleSoft Enterprise PeopleTools 8.61-8.63 can read critical PeopleSoft data, with Oracle scoring the flaw CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The weakness is described by Oracle as easily exploitable and affects confidentiality only, with no integrity or availability impact; no public exploit code or CISA KEV entry is identified at time of analysis, so risk is mid-tier and driven by the clean remote unauthenticated vector rather than confirmed exploitation.
Oracle Payroll, as shipped within Oracle E-Business Suite 12.2.3 through 12.2.15, can be fully taken over by an attacker who already holds a low-privilege account on the EBS instance and can reach the Payroll 'Internal Operations' component over HTTP, with high confidentiality, integrity, and availability impact (CVSS 3.1 base score 7.5). The high attack complexity rating (AC:H) reflects Oracle's assessment that exploitation is difficult and depends on non-default timing, server state, or configuration preconditions, so it is not reliably repeatable against an arbitrary target. The authentication prerequisite (PR:L) rules out anonymous attackers, and no public exploit code has been identified at time of analysis - this is not a CISA KEV entry and does not appear to be under confirmed active exploitation, placing it in a second-tier remediation priority behind internet-exposed, unauthenticated flaws.
Takeover of the Oracle Payroll component within Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for low-privileged attackers who already hold a valid EBS account and can reach the Internal Operations component over HTTP. Successful exploitation yields high confidentiality, integrity, and availability impact (CVSS 3.1 base score 7.5), but Oracle rates the flaw difficult to exploit because attack complexity is high and specific preconditions must align. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addressed the issue in its October 2026 Critical Patch Update.
Oracle One-to-One Fulfillment 12.2.3 through 12.2.15 can be taken over by an authenticated low-privileged attacker with network access to the Documents component, resulting in full confidentiality, integrity, and availability impact. Exploitation is rated difficult (AC:H) and requires valid credentials (PR:L), so opportunistic attacks are unlikely; no public exploit code or CISA KEV entry was identified at time of analysis. Signals lean toward a moderate, not urgent, priority.
Full compromise of the Integrated SOA Gateway - including confidentiality, integrity and availability of the SOA Provider component - is possible in Oracle E-Business Suite 12.2.3 through 12.2.15 by a low-privileged user who already holds a valid EBS account and can reach the gateway over HTTP. Oracle rates the flaw as 'difficult to exploit' (CVSS 3.1 7.5, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning conditions outside the attacker's control must align before a successful takeover, and no public exploit code or confirmed active exploitation was identified at time of analysis. The authentication prerequisite and high attack complexity are the main constraints defenders can rely on, so the practical priority is patching on the October 2026 CPU cycle rather than emergency response.
Takeover of Oracle iSetup is possible for a low-privileged authenticated attacker who can reach the General Ledger Update Transform and Reports component over HTTP in Oracle E-Business Suite 12.2.3 through 12.2.15. The 7.5 CVSS score reflects high confidentiality, integrity, and availability impact, but the high attack-complexity metric means attacker-uncontrollable preconditions must be satisfied; no public exploit code was identified at time of analysis and CISA KEV does not list it. Only EBS deployments running the iSetup module on the stated versions are affected.
Full compromise of Oracle iSetup - high confidentiality, integrity and availability impact - is achievable by a low-privileged, authenticated attacker who can reach the General Ledger Update Transform and Reports functionality over HTTP, with Oracle E-Business Suite 12.2.3 through 12.2.15 affected. Oracle rates exploitation as difficult (AC:H), meaning success depends on conditions outside the attacker's control such as a specific component state, timing window, or configuration, which materially narrows practical risk despite the 7.5 base score. No public exploit code or active exploitation was identified at time of analysis, and no EPSS score or CISA KEV listing was supplied, so this should be treated as a high-impact but opportunistic-targeting concern rather than an emergency patch-now event.
Privilege escalation and potential full compromise of the Oracle Application Object Library in Oracle E-Business Suite 12.2.3 through 12.2.15 allow a low-privileged authenticated attacker with HTTP network access to take over the affected component, with high confidentiality, integrity, and availability impact. This is a genuine but second-tier priority because exploitation is difficult (AC:H) and requires valid low-privileged EBS credentials (PR:L); no public exploit identified at time of analysis and no CISA KEV active-exploitation signal was provided.
Takeover of Oracle Materials Requirement Planning (MRP) in Oracle E-Business Suite 12.2.3-12.2.15 is possible for a low-privileged attacker with network access via HTTP to the Internal Operations component, though the high attack complexity makes exploitation difficult. Successful attacks provide high confidentiality, integrity, and availability impact; authentication requirements and environmental timing/state conditions limit the attack surface. No public exploit identified at time of analysis, and the primary vendor reference is Oracle's October 2026 Critical Patch Update advisory.
Authenticated low-privileged users with network HTTP access to Oracle Cost Management 12.2.3 through 12.2.15 can potentially take over the Cost Maintenance component, with high confidentiality, integrity, and availability impact (CVSS 7.5). Oracle rates the flaw difficult to exploit (AC:H), and exploitation requires a valid low-privileged E-Business Suite account plus reachable Cost Management deployment. No public exploit was identified at time of analysis, and the CVE is not listed in CISA KEV.
Takeover of Oracle Sales Foundation, a component of Oracle E-Business Suite, is possible for authenticated low-privileged attackers who can reach the Security API over HTTP in versions 12.2.3 through 12.2.15. Oracle rates this 7.5 with high attack complexity (AC:H) and explicitly describes it as difficult to exploit, so success likely hinges on configuration state, timing, or target-specific reconnaissance rather than a simple request. No public exploit code and no CISA KEV entry were identified at time of analysis, and the required low-privileged EBS account further narrows the realistic attacker population.
Code execution in Advantech ADAM-3600 industrial controllers can be achieved by exploiting a buffer overflow in the password verification routine, but an attacker must first hold guest-level credentials. The issue is network-reachable and high-complexity, with a CVSS 4.0 score of 7.5; our independent assessment uses CVSS 3.1 with PR:L, suggesting the real authentication barrier may be lower than the vendor vector's PR:H indicates. No public exploit identified at time of analysis.
Privilege escalation and application takeover in Oracle Agile Product Lifecycle Management for Process 6.2.4: an authenticated attacker holding only low-privileged credentials can reach the Product Quality Management component over HTTP and, if the difficult exploitation conditions are met, gain full control of the application with high confidentiality, integrity and availability impact. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), and the high attack complexity points to a narrow, condition-dependent trigger rather than a straightforward request. No public exploit code or confirmed active exploitation was identified at time of analysis, and only version 6.2.4 is listed as affected in Oracle's October 2026 Critical Patch Update.
Authenticated low-privileged users can take over Oracle E-Business Suite Workflow (versions 12.2.3 through 12.2.15) by attacking the Workflow Notification Mailer component over HTTP, with high impact across confidentiality, integrity, and availability (CVSS 3.1 base score 7.5). Oracle rates the flaw difficult to exploit, and the CVSS vector's high attack complexity (AC:H) indicates a specific server state or precondition must be met rather than a simple request being sufficient, although no user interaction is required. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Oracle addresses the issue in its October 2026 Critical Patch Update. This is a moderate-priority item for EBS estates that expose the notification mailer, not an emergency unauthenticated remote compromise.
Low-privileged authenticated attackers can achieve full takeover of the Oracle iProcurement application (E-Business Suite 12.2.3 through 12.2.15) by reaching the Requisition Management component over HTTP, with high impact to confidentiality, integrity, and availability. The flaw is rated high complexity (AC:H) - Oracle describes it as 'difficult to exploit', meaning success depends on conditions such as specific configuration, timing, or data state rather than a single deterministic request - and requires a valid low-privileged session, so anonymous users cannot trigger it. No public exploit code has been identified and there is no CISA KEV listing at time of analysis, but because a compromised account yields application-level takeover, any provisioned iProcurement user should be treated as a potential launch point.
Oracle SOA Suite's Fabric Layer can be taken over by a low-privileged attacker who already has authenticated network access via HTTP, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The high attack complexity (AC:H) means exploitation depends on conditions outside the attacker's direct control, and no public exploit was identified at time of analysis. The issue carries a 7.5 CVSS base score with high confidentiality, integrity, and availability impact.
Low-privileged authenticated attackers with HTTP network access can achieve full takeover of Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through a flaw in the Fabric Layer component, with high impact to confidentiality, integrity and availability (CVSS 3.1 base score 7.5). The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U) means a valid low-privileged account is required and Oracle rates the flaw as difficult to exploit, so attack complexity and account provisioning are the main real-world barriers rather than the score alone. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle tracks the fix through its October 2026 Critical Patch Update.
Takeover of the Pasta Printing Engine component within Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a low-privileged authenticated user who can reach the component over HTTP, with full impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.5). Oracle characterizes the flaw as difficult to exploit, and the AC:H metric indicates an additional precondition the attacker does not fully control - such as a specific timing window, race condition, or particular printing-component state - so reliable, single-shot exploitation is not implied; no public exploit code and no active exploitation (CISA KEV) were identified at time of analysis. This is a serious but not top-tier priority issue: exploitation is gated behind valid EBS credentials and applies only to 12.2.x deployments running the Pasta component, and no user interaction is required (UI:N).
Oracle Payroll in Oracle E-Business Suite 12.2.3 through 12.2.15 can be compromised by a low-privileged attacker with network access via HTTP, potentially resulting in takeover of the Payroll component with high confidentiality, integrity, and availability impact. The flaw resides in the Internal Operations component and has high attack complexity, so exploitation requires a valid low-privileged account plus conditions outside the attacker's control; no public exploit was identified at time of analysis. With a CVSS 3.1 score of 7.5, the risk is High but constrained by the authentication and complexity prerequisites.
A high-complexity privilege-escalation flaw in Oracle JD Edwards EnterpriseOne Tools (Enterprise Infrastructure SEC component, versions 9.2.0.0 through 9.2.26.5) lets a low-privileged, already-authenticated attacker reach the JDENET service over the network and take over the EnterpriseOne Tools environment, with full confidentiality, integrity, and availability impact (CVSS 7.5). Exploitation is explicitly difficult (AC:H) because success depends on timing, configuration, or environmental conditions outside the attacker's control, and it requires pre-existing low-privilege credentials plus network reachability to JDENET. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or CISA KEV signal was supplied; Oracle addresses it in its October 2026 Critical Patch Update.