Low-privileged users who already hold interactive logon to the host running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can, under narrowly specific conditions, read and modify a limited subset of the application's data through the Business Logic Infra SEC component. Impact is confined to partial confidentiality and integrity loss (CVSS 3.1 base 3.6, AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) with no availability effect, and exploitation is neither remote nor unauthenticated. No public exploit code or confirmed active exploitation was identified at time of analysis, and the overall risk picture is genuinely low priority.
A low-privileged, locally authenticated user on a server hosting Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) can exploit a flaw in the Enterprise Infrastructure SEC component to read a limited subset of application data and to insert, update, or delete a limited set of records they should not be able to touch. Oracle rates exploitation as difficult (AC:H) and the attack is strictly local (AV:L) with no user interaction, yielding a CVSS 3.1 base score of 3.6; the realistic attacker population is therefore insiders or intruders who already hold a foothold and a valid low-privileged account on the E1 host. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this is a hardening and patch-cadence item rather than an urgent exposure.
Oracle Agile EDM 6.2.1 contains a local, high-complexity weakness in its Engineering Communication Interface that allows an attacker with valid low-privileged logon to the application host to read and alter a limited subset of Agile EDM data. The vendor rates exploitation as difficult and the CVSS 3.1 score is 3.6 with only low confidentiality and integrity impact; no public exploit was identified at time of analysis and there is no CISA KEV confirmation. Because the attacker must already have local credentials and interactive host access, this is a low-priority issue for most environments.
Low-privileged users who can log on interactively to a host running Oracle JD Edwards EnterpriseOne Tools can abuse the Monitoring and Diagnostics SEC component to modify or delete some restricted EnterpriseOne data and to degrade service availability. Only Tools releases 9.2.0.0 through 9.2.26.5 are affected, and the CVSS 3.1 base score is 3.6 (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L), reflecting a local, high-complexity path that yields limited integrity and availability impact with no confidentiality exposure. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; exploitation requires an attacker to already hold a valid low-privileged account with logon access to the EnterpriseOne infrastructure, so the realistic threat is insider misuse or post-compromise lateral activity rather than remote attack. All available signals point to a low-priority issue best handled through routine quarterly patch cycles.
Oracle Java SE and GraalVM deployments are exposed to limited integrity and availability impact through the Serviceability component. An unauthenticated attacker who can log on locally to the affected host-or who persuades another user to run a sandboxed Java Web Start application or sandboxed applet that feeds untrusted data to the vulnerable APIs-can cause unauthorized data modification and partial denial of service. Affected builds include Oracle Java SE 8u503, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27, plus specified GraalVM releases; no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Low-privileged local users on infrastructure running Oracle TimesTen In-Memory Database 26.1 through 26.1.1.3.0 can read and modify a limited subset of database-accessible data, with no availability impact, according to a CVSS 3.1 base score of 3.6. Exploitation requires a local logon and high-complexity conditions outside the attacker's control, so remote exploitation is not possible and the issue is low severity; no public exploit identified at time of analysis and it is not in CISA KEV.
Integrity-only tampering in the Oracle Purchasing module of Oracle E-Business Suite (12.2.3 through 12.2.15) lets a low-privileged, authenticated user reach the Internal Operations component over HTTP and, if a separate and typically more privileged user is induced to interact, perform unauthorized updates, inserts, or deletes against a limited subset of Purchasing data. There is no confidentiality or availability impact and the CVSS 3.1 base score is 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N), so both prior authentication and victim interaction are prerequisites - no public exploit identified at time of analysis, and no CISA KEV listing. This is a genuinely low-priority issue despite being network-exploitable, and the practical risk is concentrated in environments where low-privileged Purchasing accounts are widely distributed or weakly governed.
Memory corruption in Apple macOS - versions prior to Golden Gate 27, Tahoe 26.7, and Sequoia 15.8 - lets an attacker in physical proximity to a Mac trigger improper input handling that corrupts process memory, with unauthenticated and no-user-interaction prerequisites once proximity is achieved (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base score 3.5). Impact is bounded to partial confidentiality and integrity with no availability loss, reflecting that the corruption occurs within a single process scope rather than yielding full system compromise. Risk signals are uniformly low: EPSS is 0.17% (6th percentile), CISA SSVC records exploitation as 'none' and automatable as 'no', no public exploit code has been identified at time of analysis, and the vendor has released fixed versions. The practical barrier is the AV:P vector - the flaw cannot be reached over a network - so exposure is limited to scenarios where an adversary gains close physical access to the target Mac.
Local, high-privilege tampering and partial denial of service in Oracle JD Edwards EnterpriseOne Tools (E1 Dev Platform Tech - UNIX component), affecting versions 9.2.0.0 through 9.2.26.5. An attacker who already holds a logon account with high privileges on the UNIX host running EnterpriseOne Tools can, with low complexity and no user interaction, make unauthorized updates, inserts, or deletions to data reachable through the product and degrade its availability. Scored only 3.4 (C:N/I:L/A:L) with a local attack vector and PR:H, this is a low-priority issue rather than a remotely reachable one; no public exploit was identified at time of analysis and the CVE is not listed in CISA KEV, so practical risk is confined to privileged insiders or attackers who have already compromised a privileged host account.
Oracle Applications Manager, the management and diagnostics console bundled with Oracle E-Business Suite 12.2.3 through 12.2.15, contains an HTTP-reachable weakness in its Diagnostics component that allows a high-privileged attacker to read a limited subset of Applications Manager data and cause a partial denial of service. The CVSS 3.1 base score is 3.3 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L), meaning the attacker must already hold an authenticated administrative account on the product and must meet conditions outside their direct control for the attack to succeed. No public exploit code has been identified at time of analysis, and Oracle addresses the issue through its October 2026 Critical Patch Update.
Path traversal in the djust MCP server's find_handlers_for_template tool (affected versions 0.9.0 through before 1.0.10, 1.1.x before 1.1.7, 1.2.x before 1.2.4, and 1.3.0.dev before 1.3.0rc8) allows a local MCP client to supply an arbitrary absolute template_path, which the tool reads without confining resolution to the project or configured template directories. Rather than full file disclosure, the tool acts as a file existence/readability oracle and leaks only substrings matching the dj-click, dj-submit, dj-change, dj-input, dj-keydown, or dj-keyup attribute pattern - a narrow, pattern-filtered exposure reflected in the low CVSS 3.3 score (AV:L/PR:L, C:L only). Exploitation requires an already-connected local stdio MCP session running as the same OS user with no network listener, so the attacker effectively already holds the victim's privileges; no public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
An out-of-bounds read in Apple Xcode's binary-parsing tools affects Xcode installs earlier than 27 and can terminate the affected tool when it processes a maliciously crafted binary, producing a local denial-of-service condition. The authoritative assessment is local access with no privileges required but user interaction required, and impact limited to availability (C:N/I:N/A:L); there is no network-exposed unauthenticated path and no confirmed data disclosure. No public exploit was identified at time of analysis, EPSS is 0.15% (3rd percentile), and SSVC lists exploitation as none, so this is a low-priority developer-workstation issue.
Local user-assisted denial of service in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 allows an unauthenticated-at-the-application-layer attacker who already holds a local logon on the hosting infrastructure to degrade availability, but only if another legitimate user performs an interaction. The CVSS 3.1 score is 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), with no confidentiality or integrity impact; no public exploit code was identified at time of analysis, and Oracle's October 2026 Critical Patch Update is the vendor remediation reference.
Local users holding a valid low-privileged login on the infrastructure hosting Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.9) can read a limited subset of application data they should not be entitled to see. The flaw is confined to a local attack vector with required authentication (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base score 3.3), so it offers no network or unauthenticated path and cannot modify data or disrupt service. There is no public exploit identified at time of analysis and no KEV listing, making this a genuinely low-priority issue whose realistic exposure is limited to insiders or attackers who already hold a foothold on the host. Note that the feed-supplied 'Authentication Bypass' tag is not supported by the assessed vector, which explicitly requires credentials.
Unauthorized read access to a subset of data accessible to Oracle JDeveloper is possible for authenticated low-privileged attackers who already have interactive logon to the host running affected versions 12.2.1.4.0 or 14.1.2.0.0. The vector is strictly local (AV:L, PR:L, UI:N) with confidentiality-only impact (C:L) and no integrity or availability effect, so there is no remote or unauthenticated path. No public exploit identified at time of analysis, and the issue is low priority given the mandatory local access and valid credentials.
Oracle Solaris 11.4 contains a local information-disclosure weakness in its Libraries component that allows an attacker with an existing low-privileged logon to read a limited subset of system-accessible data. The assessed CVSS vector is strictly local (AV:L), requires low privileges (PR:L), needs no user interaction, and has confidentiality-only impact (C:L), with no integrity or availability effect. The referenced vendor advisory is Oracle's October 2026 Critical Patch Update, and no public exploit code has been identified at time of analysis.
Unauthorized read access to a subset of PeopleSoft PeopleTools data is possible for low-privileged users who can log on locally to the infrastructure running the XML Publisher component in versions 8.61 through 8.63. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) requires an existing low-privileged credential and local access, with no integrity or availability impact. No public exploit identified at time of analysis, and KEV status is not indicated.
A locally exploitable information-disclosure flaw in Oracle Communications BRM - Elastic Charging Engine (versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0) lets an attacker who already holds a low-privileged logon on the host read a subset of data the ECE component would otherwise keep out of reach. The CVSS 3.1 base score is only 3.3 (AV:L/PR:L/AC:L/UI:N/C:L/I:N/A:N), so there is no write or availability impact and no path to full compromise from the network - realistic exposure is limited to insiders or an adversary who has already landed on the server. No public exploit code and no confirmed active exploitation were identified at time of analysis; Oracle addresses the issue in its October 2026 Critical Patch Update.
Local sandbox restrictions in Apple macOS can be bypassed by an app running under a user account to read the user's Contacts data, and Apple fixed the permissions issue in macOS Golden Gate 27. The CVSS 3.3 vector is local, low-complexity, and requires low privileges, with confidentiality impact limited to contact information and no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is 0.14% at the 3rd percentile, making this a low-priority issue across nearly every signal.
Oracle Communications Unified Inventory Management (versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1) contains a low-severity confidentiality flaw in its Security component that lets a low-privileged attacker who already holds a valid local logon to the hosting infrastructure read a subset of application data. The attack is local only (AV:L, PR:L, UI:N) with no integrity or availability impact, so exposure is confined to insiders or attackers who have already established a foothold on the host. No public exploit code or CISA KEV active-exploitation signal was identified at time of analysis, and EPSS-style risk is correspondingly modest given the mandatory local access and pre-existing account.
Oracle Communications Unified Inventory Management (UIM) versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1 expose a low-severity confidentiality weakness that lets an attacker who already holds a low-privileged logon on the UIM host read a subset of data the application would otherwise restrict. Per the independent assessment this is a genuinely low-priority issue: the local-access prerequisite (CVSS AV:L/PR:L) and the read-only, partial confidentiality impact (C:L, no integrity or availability effect) confine realistic exploitation to insiders or attackers who have already established a foothold on the infrastructure. There is no evidence of active exploitation (no CISA KEV listing), no public exploit code identified at time of analysis, and the reported tags reference authentication bypass, though the assessed vector and Oracle's scoring describe a local, authenticated information-read condition rather than a remotely reachable bypass.
Low-privileged local users of Oracle Communications Unified Inventory Management 7.5.0 through 8.0.1 can read a subset of application data they should not be able to access, with no write or availability impact. The issue is rated CVSS 3.1 base 3.3 and requires an attacker to already have a valid low-privileged logon on the host running UIM (AV:L/PR:L), so remote unauthenticated exploitation is not possible. No public exploit code or active exploitation has been identified at time of analysis.
Partial denial of service in Oracle JD Edwards EnterpriseOne Tools (Installation Security component) affects versions 9.2.0.0 through 9.2.26.5 and requires an attacker who already holds a low-privileged logon on the infrastructure where the product executes. Successful exploitation degrades availability only - confidentiality and integrity are unaffected - and because the vector is local (AV:L) with low attack complexity (AC:L) and no user interaction (UI:N), the CVSS 3.1 base score stays at 3.3. No public exploit identified at time of analysis, there is no CISA KEV entry, and no EPSS score was supplied; the Oracle October 2026 Critical Patch Update provides the fix.
Symlink or junction replacement of the `<path>.rw` lock tree in Python's filelock 4.1.0 through 4.2.0 lets a second, co-located local user redirect the lock-record writes that SoftReadWriteLock and AsyncSoftReadWriteLock perform after acquisition - most notably periodic heartbeat rewrites of holder records - into directories writable by the lock-owning user. The root cause is a time-of-check/time-of-use gap: the classes cached the successful ownership check made at first acquisition and re-resolved the `gen` and `holders` names by path on every later record operation, so a tree swapped in during that window is followed. Impact is limited to integrity (CVSS 3.1 base 3.3, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) and requires an existing local account plus a lock path whose parent directory that account can modify; there is no remote vector, no public exploit identified at time of analysis, and no CISA KEV listing. The issue is fixed in filelock 4.2.1.
Path traversal (CWE-22) in uploadfs, the file storage library bundled with ApostropheCMS, allows parent-directory segments in attacker-supplied paths to escape the configured upload directory prior to version 1.28.0, affecting file reads, writes, and deletions on the host filesystem through the local backend. The flaw is not exploitable against the library in isolation: it only triggers when a host application explicitly routes unsanitized, attacker-controlled path strings into uploadfs read, write, or delete operations, which is why the vendor scores it as high-complexity with privileged access requirements (AC:H/PR:H). There is no public exploit identified at time of analysis and no CISA KEV listing; this is a low-priority, high-conditionality issue rather than a broadly dangerous flaw.
Unauthenticated tampering with import jobs in ApostropheCMS: the @apostrophecms/import-export module before 3.7.1 exposes POST /api/v1/@apostrophecms/import-export/clean-export without any authentication or authorization check, so any site visitor holding the standard CSRF cookie can invoke cleanExport and discard a pending import's uploaded files and mark that import job completed. Impact is narrow rather than severe - the operation targets a pending import by its random ID, which is only disclosed to the uploading user, so an attacker must already know or observe that identifier, and the site must have the optional import-export module installed with an import in flight. There is no data disclosure and no availability impact; no public exploit identified at time of analysis, and vendor fixes are available in 3.7.1.
Partial denial of service in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 is possible when a low-privileged authenticated attacker reaches the Analytic Server component over HTTP, although high attack complexity makes reliable exploitation difficult. The CVSS 3.1 base score is 3.1, with impact limited to availability (A:L) and no confidentiality or integrity effect; no public exploit identified at time of analysis. This is a genuinely low-priority issue and the available signals are consistent rather than conflicting.
A partial denial of service can be triggered in the Sound component of Oracle Java SE (8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) by an unauthenticated, network-positioned attacker who convinces a user to load and run untrusted code inside the Java sandbox. Oracle explicitly scopes the issue to client-side deployments using sandboxed Java Web Start applications or applets; servers that only execute administrator-installed trusted code are not affected, and the only achievable outcome is a partial loss of availability, with no confidentiality or integrity impact. The attack is rated high-complexity (AC:H) and requires victim interaction (UI:R), and no public exploit identified at time of analysis; given the deprecated applet/Web Start attack surface and the availability-only impact, this is a low-priority issue despite the ubiquity of the platform.
Information disclosure in Oracle JavaFX - and in the Oracle Java SE 8u503 and GraalVM Enterprise Edition 21.3.19.1.1 releases that ship it - allows an unauthenticated, network-positioned attacker to read a limited subset of data, but only when a human victim loads and runs attacker-supplied code inside a sandboxed Java applet or Java Web Start application. The CVSS 3.1 score is 3.1 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N), reflecting high attack complexity and mandatory user interaction; the issue does not affect server deployments that execute only administrator-installed trusted code. No public exploit code or active exploitation (CISA KEV) was identified at time of analysis, and the near-total retirement of the applet/Web Start model keeps real-world exposure very small.
Siebel CRM End User versions 17.0 through 26.9 contain an integrity-only flaw in the Open UI component that can let unauthenticated network attackers modify limited records if a legitimate user is induced to interact with attacker-controlled content. The CVSS 3.1 score is 3.1 with high attack complexity and a user-interaction requirement, and the supplied intelligence shows no public exploit code or CISA KEV confirmation. Practical risk is low because exploitation depends on tricking an active Siebel user and on conditions outside the attacker's control, with no confidentiality or availability impact.
Oracle WebCenter Content 14.1.2.0.0 (Content Server component of Oracle Fusion Middleware) allows a low-privileged authenticated user with network access over HTTP to read a limited subset of content the account should not be able to see, but only when a high-complexity condition is satisfied - Oracle itself classifies the issue as 'difficult to exploit.' The impact is confidentiality-only (CVSS 3.1 base score 3.1, AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), with no write, integrity, or availability effect, and exploitation requires a pre-existing valid account despite a third-party tag labeling it an authentication bypass. No public exploit code or confirmed active exploitation (CISA KEV) was identified in the available intelligence at time of analysis, and this is a genuinely low-priority issue across nearly every risk signal.
Low-privileged authenticated users of Oracle E-Business Suite 12.2.3 through 12.2.15 can read a limited subset of Oracle Applications Manager Diagnostics data over HTTP, with no integrity or availability impact. The assessed vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) and Oracle's 'difficult to exploit' rating mean an attacker needs a valid low-privileged account plus additional preconditions, keeping realistic risk low. No public exploit code was identified at time of analysis.
Limited data disclosure in Oracle Concurrent Processing (Oracle E-Business Suite 12.2.3 through 12.2.15) allows an authenticated low-privileged attacker with HTTP access to read a subset of Concurrent Requests data. The CVSS 3.1 score is 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting high attack complexity and no integrity or availability impact; no public exploit identified at time of analysis.
Unauthorized read access to a subset of Siebel CRM Cloud Applications data is possible for low-privileged authenticated attackers with HTTP access to the Siebel Cloud Manager component in versions 22.3 through 26.9, but high attack complexity and limited confidentiality impact keep the CVSS 3.1 score at 3.1. No public exploit identified at time of analysis.
Limited confidentiality exposure in Oracle JavaFX 25.0.4 and 27 stems from a high-complexity flaw in the JavaFX component that a network-positioned, unauthenticated attacker can only trigger after a victim loads and runs attacker-supplied sandboxed Java Web Start or applet code; a successful attack yields read access to a subset of JavaFX-accessible data, with no integrity or availability impact. The assessed CVSS 3.1 base score of 3.1 reflects the combined drag of high attack complexity (AC:H), mandatory user interaction (UI:R), and single-scope low confidentiality impact. This is a client-side-only issue that does not affect server deployments running solely administrator-installed trusted code, and no public exploit identified at time of analysis.
Oracle Siebel CRM Integration (versions 17.0 through 26.9) exposes a limited confidential-data read flaw in its REST component that can be reached over HTTP by an unauthenticated remote attacker. Exploitation is difficult (AC:H) and requires a victim other than the attacker to be lured into some form of interaction (UI:R), and a successful attack only yields read access to a subset of data accessible through the integration layer, with no integrity or availability impact - reflected in a low CVSS 3.1 base score of 3.1. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, so all signals point to a low-priority issue best handled through the vendor's routine October 2026 Critical Patch Update cycle.
Unauthorized read access to a limited subset of Oracle REST Data Services data is possible in versions 24.2.0 through 26.1.0 for unauthenticated network attackers, but exploitation requires high attack complexity and interaction by a person other than the attacker. Oracle rates this as low severity (CVSS 3.1 base 3.1) with only confidentiality impact; there is no integrity or availability effect. No public exploit code was identified at time of analysis, and the CVE is not listed in CISA KEV.
Oracle Agile Engineering Data Management 6.2.1 contains an integrity-only flaw in its Engineering Communication Interface component that lets a low-privileged authenticated user with HTTP network access perform unauthorized update, insert, or delete operations on a subset of application data. The assessed CVSS 3.1 base score is 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) - high attack complexity means reliable exploitation requires non-trivial preconditions such as specific state, timing, or configuration - so real-world risk is confined largely to insiders or attackers who already hold valid application credentials. There is no public exploit identified at time of analysis, no CISA KEV listing, and no confidentiality or availability impact; this is a genuinely low-priority issue rather than a remotely weaponizable one.
Low-severity integrity tampering in Oracle JD Edwards EnterpriseOne Tools (Web Runtime SEC component) affects versions 9.2.0.0 through 9.2.26.5. An unauthenticated remote attacker can exploit this difficult-to-exploit flaw only if a victim is tricked into interacting with malicious content, resulting in unauthorized update, insert, or delete access to a subset of accessible data. No public exploit code or active exploitation has been identified; the CVSS 3.1 base score is 3.1.
Integrity manipulation in Oracle Solaris 11.4's Image Packaging System (IPS) requires a network attacker to influence TLS-delivered package content and a separate user to perform a packaging action that processes it. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N, score 3.1) limits impact to unauthorized update, insert, or delete access to some Solaris-accessible data, with no confidentiality or availability effect. No public exploit identified at time of analysis, and the supplied data does not confirm active exploitation.
Cross-origin request handling in Oracle Helidon 4.0.0 through 4.5.5 can let unauthenticated remote attackers cause limited unauthorized data modification on applications that expose CORS-enabled endpoints. Exploitation is difficult and depends on a victim's browser or user interaction, and the CVSS 3.1 score is 3.1 with only low integrity impact; confidentiality and availability are unaffected. No public exploit code or active exploitation is identified in the provided intelligence at time of analysis.
Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 contain a difficult-to-exploit flaw in the Core component that lets a network-positioned attacker who already holds high privileges on the ORDS instance, and who persuades a separate user to perform some interaction, obtain limited read and limited insert/update/delete access to a subset of ORDS-accessible data. There is no availability impact, and the combination of prior high privilege (PR:H), a second human participant (UI:R), and a high-complexity precondition (AC:H) makes successful exploitation unlikely and low-value. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; Oracle addresses it through its October 2026 Critical Patch Update advisory.
Oracle Purchasing 12.2.3 through 12.2.15 contains an integrity-only flaw in the Internal Operations component of Oracle E-Business Suite. A low-privileged authenticated attacker with HTTP network access could manipulate some accessible purchasing data, but the high attack complexity and limited integrity impact keep real-world risk low. No public exploit code or confirmed active exploitation was identified at time of analysis.
Low-severity confidentiality exposure in the Oracle PeopleSoft PeopleTools Portal component (versions 8.61 through 8.63) requires an authenticated, low-privileged attacker with HTTP network access and a separate victim's interaction to read a limited subset of application data. Oracle rates the attack as difficult (AC:H), and the mandatory authentication (PR:L), required second-party interaction (UI:R), and scope change (S:C) sharply limit realistic exploitation. No public exploit was identified at time of analysis, and the issue is not known to be actively exploited.
JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 permit a high-privileged attacker who already holds logon access to the host running the E1 Dev Platform Tech - Cloud component to perform unauthorized inserts, updates, or deletions of EnterpriseOne data and to partially degrade availability of the product. The flaw is scored CVSS 3.1 3.0 (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L), reflecting that it is local-only, requires high privileges, and is difficult to trigger because success depends on environmental conditions outside the attacker's control. There is no public exploit identified at time of analysis and no CISA KEV listing; realistic exposure is limited to trusted insiders or already-compromised privileged accounts on the application host.
Oracle Siebel CRM Marketing (versions 17.0 through 26.9) can be partially disrupted by a local, high-complexity attack that requires logon access to the host infrastructure but no Siebel application authentication. The assessed impact is limited to partial denial of service in the Marketing component, with no confidentiality or integrity effect. No public exploit code or active exploitation signal is present in the provided intelligence at time of analysis.
Partial denial of service of Oracle Siebel CRM's Marketing component (Siebel Apps - Marketing, versions 17.0 through 26.9) can be triggered by an attacker who already holds a logon to the server infrastructure hosting the application, and only under high-complexity, non-deterministic conditions. CVSS 3.1 scores this 2.9 with availability-only impact (A:L); confidentiality and integrity are unaffected. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied.
PeopleSoft Enterprise PeopleTools 8.61 through 8.63 exposes an integrity-only weakness in its Porting component that lets an attacker who already holds a logon on the host make unauthorized updates, inserts, or deletes against some PeopleTools-accessible data. The assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N, 2.9) is local, high-complexity, and requires an existing authenticated session on the infrastructure running PeopleTools, so exploitation is only realistic for someone with a foothold on the server; there is no confidentiality or availability impact. It is not in CISA KEV and no public exploit identified at time of analysis, making this a low-priority item despite public disclosure in Oracle's October 2026 Critical Patch Update.
A partial denial of service can be triggered in Oracle REST Data Services 24.2.0 through 26.1.0 through the Database Actions component, but only by an attacker who already holds high privileges within ORDS and can reach it over HTTP. The weakness is easily exploitable in terms of attack complexity (AC:L, no user interaction) yet the ceiling is availability-only and partial (A:L), with no confidentiality or integrity impact, yielding a CVSS 3.1 score of 2.7. No public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis.
Unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools data (versions 8.61 through 8.63, Report Distribution component) is possible when a high-privileged, authenticated attacker sends crafted HTTP requests; CVSS 3.1 score 2.7 reflects confidentiality-only impact. Exploitation requires an existing privileged PeopleTools account, sharply limiting exposure, and no public exploit code or confirmed active exploitation was identified at time of analysis.