Pre-authentication access control bypass in IBM i Navigator (7.3, 7.4, 7.5, and 7.6) lets a remote attacker alter server-side session security state by sending a crafted HTTP request to any Navigator URL before authenticating. The weakness is an improper authentication/access-control flaw (CWE-287) rated CVSS 6.5, with low confidentiality and integrity impact and no direct code execution or full account takeover; the practical risk is concentrated on Navigator interfaces that are reachable from untrusted networks. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated HTTP access to the Business Interlink component in Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 can expose a limited subset of accessible application data and trigger partial denial of service. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), requiring no credentials or user interaction; no public exploit code or active exploitation has been identified at time of analysis.
Authenticated data disclosure in Oracle REST Data Services (ORDS) 24.2.0 through 26.2.1 lets a low-privileged attacker with HTTP network access read critical data - potentially all data accessible through ORDS - via the GraphQL component (CVSS 3.1 base 6.5, C:H/I:N/A:N). Exploitation requires a valid low-privileged account and a reachable, GraphQL-enabled ORDS endpoint, and is confined to confidentiality impact with no integrity or availability effect. No public exploit code has been identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update.
Critical data exposure in Oracle Siebel CRM's Open UI component affects versions 17.0 through 26.9, where an authenticated low-privileged attacker with HTTP access can read critical or all user-accessible data. The flaw is low-complexity and needs no user interaction but requires a valid low-privilege account (CVSS 6.5 Medium, confidentiality-only); no public exploit identified at time of analysis.
Improper access control in Oracle One-to-One Fulfillment, part of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged authenticated user with HTTP network access read critical data or all data accessible to the component. The assessed CVSS 3.1 score is 6.5 with confidentiality-only impact; integrity and availability are not affected, and no user interaction is required. No public exploit was identified at time of analysis, and active exploitation is not confirmed by CISA KEV in the provided data.
Low-privileged authenticated users of Oracle Email Center, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can read critical Email Center data they should not be able to reach, giving them complete read access to all data the component exposes (CVSS 3.1 base score 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw is remotely reachable over HTTP with low attack complexity and no user interaction, but the attacker must already hold valid low-privilege credentials in the application, so it is an authorization/access-control weakness rather than pre-authentication compromise. Impact is strictly confidentiality - no integrity or availability effect - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthorized access to critical data in Oracle Partner Management, a module of Oracle E-Business Suite, affects versions 12.2.3 through 12.2.15, where a low-privileged authenticated user with HTTP network access can read data well beyond their intended authorization scope, including potentially all Partner Management data reachable through the Internal Operations component. The CVSS 3.1 base score of 6.5 reflects confidentiality-only impact (C:H/I:N/A:N) with low attack complexity, no user interaction, and a PR:L prerequisite, so the practical threat comes from internal users, partner accounts, or holders of compromised low-privilege credentials rather than anonymous internet attackers. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied.
Oracle Payroll 12.2.3 through 12.2.15 can disclose sensitive payroll records to an authenticated low-privileged E-Business Suite user who can reach the Internal Operations component over HTTP. The flaw is rated CVSS 6.5 with high confidentiality impact and no integrity or availability impact; exploitation requires valid credentials (PR:L) but no user interaction. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
Oracle Database Server RDBMS 23.4.0 through 23.26.3 can expose critical data to low-privileged authenticated users who can reach the database over HTTP, a moderate-priority confidentiality flaw scored CVSS 6.5. Exploitation requires a valid low-privilege account and network reachability, so it is not unauthenticated; no public exploit identified at time of analysis. Oracle's 'None privilege' wording conflicts with the PR:L vector and should be reconciled before scoping default-configuration exposure.
Information disclosure in Oracle Trusted Answer Search 26.1 allows a low-privileged authenticated remote attacker with HTTP access to read critical or all accessible data through the PL/SQL package component. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with impact limited to confidentiality-no integrity or availability effect. Only version 26.1 is listed as affected; no public exploit code or active exploitation was identified at time of analysis.
Authenticated low-privileged users of Oracle Primavera Unifier can read data they are not entitled to through a flaw in the product's Logging component, allowing disclosure of critical or potentially all application-accessible data. The issue affects the 21.12, 22.12, 23.12, 24.12 and 25.12 release trains up to their respective 21.12.17, 22.12.15, 23.12.16, 24.12.16 and 25.12.9 builds and is reachable over HTTP with no user interaction and no administrative rights required, scoring 6.5 under CVSS 3.1 with confidentiality-only impact. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; with EPSS data unavailable, practical risk is concentrated in deployments that expose Unifier to large or semi-trusted low-privilege user populations rather than in internet-wide opportunistic exploitation.
Information disclosure in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 lets a low-privileged, authenticated remote attacker with HTTP access read sensitive Analytics Server data, with a CVSS 3.1 base score of 6.5; integrity and availability are unaffected. No public exploit identified at time of analysis, and no CISA KEV entry is provided, so this is a moderate-severity exposure rather than an emergency. Risk rises where BI EE is internet-facing or hosts multi-tenant data with weak account segregation.
Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 can disclose critical or all application-accessible data to an authenticated low-privileged attacker who can reach the BI Publisher Security component over HTTP. CVSS 6.5 reflects network attack, low complexity, required low privileges, no user interaction, and confidentiality-only impact with unchanged scope. No public exploit code or CISA KEV entry was identified at time of analysis, so this should be handled as a routine-but-real patching item.
Authenticated data exposure in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a low-privileged user with HTTP access read critical data through the Report Distribution component. CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confines impact to confidentiality, and a valid account is required. No public exploit was identified at time of analysis.
Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 expose a confidentiality-only flaw in the Web Server component that lets an authenticated low-privileged attacker with HTTP reachability read critical data or all BI Publisher-accessible data. The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects low attack complexity and no user interaction, but the PR:L prerequisite means valid credentials are required, and there is no integrity, availability, or scope impact. No public exploit code or confirmed active exploitation was identified at time of analysis.
Information disclosure in Oracle PeopleSoft Enterprise SCM Strategic Sourcing 9.2 allows a low-privileged authenticated bidder or supplier account to read critical data beyond its intended scope through the Bidder Registration component over HTTP. Exploitation is straightforward (AC:L, UI:N) but gated by the need for a valid account, and the impact is confidentiality-only - data can be read, not altered or disrupted. No public exploit code or confirmed active exploitation has been identified at time of analysis; Oracle lists the fix in its October 2026 Critical Patch Update.
Low-privileged authenticated users can read critical or all accessible data in PeopleSoft Enterprise SCM Strategic Sourcing 9.2 through an HTTP-reachable flaw, according to Oracle's October 2026 Critical Patch Update. The CVSS 6.5 rating is confidentiality-only (C:H/I:N/A:N) and requires a valid low-privilege account (PR:L), so it is not exploitable by unauthenticated remote attackers; no public exploit code or confirmed active exploitation is identified in the available intelligence, making this a moderate-priority issue rather than an emergency.
Unauthorized disclosure of critical JD Edwards EnterpriseOne Orchestrator data is possible in versions 9.2.0.0 through 9.2.26.5 when a low-privilege authenticated attacker can reach the Orchestrator over HTTP. The flaw is rated CVSS 6.5 with confidentiality-only impact; integrity and availability are unaffected, and no user interaction is needed. No public exploit code or CISA KEV confirmation was present in the supplied intelligence, so risk is moderate and contingent on prior valid Orchestrator access.
Oracle E-Business Suite iSupport 12.2.3 through 12.2.15 allows an authenticated low-privileged user with HTTP access to the Service Requests component to read critical data and potentially all iSupport-accessible records, producing a confidentiality-only impact at CVSS 3.1 6.5. No public exploit was identified at time of analysis, and exposure is highest where the iSupport portal is internet-facing or broadly accessible to external or customer accounts.
Information disclosure in Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 allows an authenticated low-privileged user with HTTP access to the nVision component to read data beyond their intended privileges, up to all PeopleTools-accessible data. The flaw is rated CVSS 6.5 with confidentiality-only impact and requires a valid account, so it is not exploitable pre-authentication. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and the primary remediation is Oracle's October 2026 Critical Patch Update.
JD Edwards EnterpriseOne 9.2 allows a low-privileged authenticated user with SMTP reachability to read critical Operational Sourcing data, creating a confidentiality-only exposure of business records. The flaw is rated CVSS 6.5 and requires valid low-level credentials; no public exploit has been identified at time of analysis, and there is no indication of active exploitation.
Oracle JD Edwards EnterpriseOne 9.2 exposes Sales Order Entry data to low-privileged users who should not be able to read it, through the JDENET communication service. An attacker who already holds a valid non-privileged EnterpriseOne account and can reach JDENET over the network can bypass intended access restrictions and read critical or complete Sales Order Entry data, with no user interaction and low attack complexity (CVSS 3.1: 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Impact is confidentiality-only - no integrity or availability effect - and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a moderate-priority data-exposure issue that becomes materially riskier when JDENET is internet-exposed or broadly reachable.
Low-privileged authenticated users of Oracle WebCenter Content: Imaging 12.2.1.4.0 and 14.1.2.0.0 can read critical or all application-accessible data through the Core component over HTTP. The flaw is remotely reachable with low attack complexity and no user interaction, but requires a valid low-privileged account; impact is confidentiality-only, with no integrity or availability effect. No public exploit or CISA KEV entry was identified at time of analysis, so this should be handled in the normal Oracle Critical Patch Update cycle.
WebCenter Content: Imaging 12.2.1.4.0 and 14.1.2.0.0 can disclose critical or all Imaging-accessible data to a low-privileged, authenticated attacker over HTTP through the Core component. The CVSS vector requires a valid low-privilege account (PR:L), low attack complexity, and no user interaction, with impact limited to confidentiality. No public exploit was identified at time of analysis, and this is a moderate-risk, confidentiality-only issue that warrants prompt but not emergency patching.
Confidentiality exposure in Oracle Agile PLM 9.3.6 lets a low-privileged authenticated user reach the Folders, Files & Attachments component over HTTP and read critical data, including potentially all PLM data accessible to that account; no user interaction or elevated privileges are required. The CVSS 3.1 score is 6.5 with high confidentiality impact only, and the authoritative assessment limits exploitation to holders of a valid low-privileged account. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a moderate authenticated-access risk rather than an unauthenticated emergency.
Low-privileged authenticated users of Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Applications DBA data through the Internal Operations component because of an access-control weakness exposed over HTTP. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so impact is confidentiality-only: no modification, no denial of service, and no user interaction. Exploitation requires a valid low-privilege EBS account and network reachability; no public exploit was identified at time of analysis and there is no CISA KEV listing.
Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allow authenticated low-privilege users to read confidential Content Server data over HTTP, with CVSS 3.1 base score 6.5 reflecting high confidentiality impact and no integrity or availability effect. Exploitation requires a valid low-privilege account plus network access to the Content Server component; no user interaction or special configuration is indicated. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided.
Oracle HRMS (US) 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker with HTTP network access to the Internal Operations component to read critical HR data without user interaction. The assessed CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact only, and no public exploit has been identified at time of analysis. This moderate-risk issue warrants normal Oracle Critical Patch Update cadence rather than emergency response.
Unauthorized read access to HR data in Oracle HRMS (US) 12.2.3 through 12.2.15 is possible through an access-control weakness in the Internal Operations component of Oracle E-Business Suite, allowing a low-privileged authenticated user with HTTP network reach to retrieve records well beyond their intended authorization scope. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning impact is confined to confidentiality - no data modification or service disruption - and exploitation still requires valid credentials, which is the primary limiting factor. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not available in the supplied intelligence, so it should be treated as a moderate-priority patching item rather than an emergency.
Unauthorized access to critical Oracle HRMS (US) data is possible for low-privileged authenticated attackers who can reach the Internal Operations component over HTTP in Oracle E-Business Suite 12.2.3 through 12.2.15. Successful exploitation yields high confidentiality impact only, with no integrity or availability effect, and requires a valid EBS account but no user interaction and low attack complexity. At time of analysis, no public exploit identified, and no KEV or EPSS data was provided.
Low-privileged Oracle E-Business Suite users can read critical HRMS (US) data through the Internal Operations component, a confidentiality-only exposure reachable over HTTP. Oracle HRMS (US) releases 12.2.3 through 12.2.15 are affected by this easily exploited flaw (CVSS 3.1: 6.5, AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N), meaning any valid authenticated EBS account can trigger it against a default configuration without user interaction. No public exploit code and no CISA KEV listing were identified at time of analysis, so the practical barrier remains obtaining valid EBS credentials - the attacker pool is limited to credentialed insiders or someone who has already compromised an account, and no data modification or service disruption is possible.
Oracle HRMS (Republic of Korea) payroll localization for E-Business Suite 12.2.3 through 12.2.15 permits a low-privileged, network-positioned attacker with a valid EBS account to read sensitive data beyond their intended authorization scope through the Korean Payroll component, yielding a high confidentiality impact with no integrity or availability effect (CVSS 6.5). Exploitation requires only low-privileged authenticated HTTP access, no user interaction, and low attack complexity, but is practically gated by whether an organization actually deploys the Korea-specific payroll localization outside South Korean deployments. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS-style risk is tempered by the module's narrow deployment footprint.
Oracle HRMS (India) Indian Payroll, as shipped with Oracle E-Business Suite 12.2.3 through 12.2.15, exposes a low-complexity HTTP-reachable path that lets a low-privileged authenticated user read data well beyond their intended scope, up to everything the HRMS (India) schema surfaces. The flaw is a confidentiality-only issue (CVSS 6.5, C:H/I:N/A:N) gated behind a valid EBS account (PR:L) with no user interaction required, which keeps unauthenticated external attackers out of reach. No public exploit code or confirmed active exploitation was identified at time of analysis, and the risk is best characterized as a moderate-priority authenticated information-disclosure problem concentrated in tenants that hand low-privilege EBS accounts to untrusted populations.
Unauthorized read access to critical HR data in Oracle HRMS (Norway) is possible for a low-privileged authenticated attacker who can reach the Internal Operations component over HTTP. The flaw affects Oracle E-Business Suite 12.2.3 through 12.2.15 deployments that include the Norwegian HRMS localization, and successful exploitation yields high confidentiality impact without integrity or availability effects. No public exploit was identified at the time of analysis, and the CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Authenticated information disclosure in the Product Diagnostic Tools component of Oracle Order Management (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged user reach data they should not see over plain HTTP, with no user interaction and low attack complexity. Because the CVSS vector carries PR:L with C:H and no integrity or availability impact, the practical outcome is read-only exposure of critical application data rather than tampering or denial of service - the authentication requirement is the main barrier an outside attacker must clear. Oracle addressed the flaw in its October 2026 Critical Patch Update; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Sensitive-data exposure in Oracle Order Management 12.2.3 through 12.2.15 lets a low-privileged authenticated user read critical or all Order Management-accessible data through the Product Diagnostic Tools component. The CVSS 6.5 rating reflects a network-reachable, low-complexity flaw with high confidentiality impact and no integrity or availability effect, gated by the need for a valid low-privileged EBS account (PR:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and this is assessed as a moderate-priority issue.
Oracle Order Management 12.2.3 through 12.2.15 can expose critical business data to an authenticated low-privilege user through the Product Diagnostic Tools component, yielding read-only confidentiality impact with a CVSS 3.1 base score of 6.5. The attacker needs network HTTP access and valid low-privilege EBS credentials, and no public exploit code was identified at time of analysis; no CISA KEV entry was provided.
Authenticated low-privilege users of Oracle Product Hub 12.2.3 through 12.2.15 can exploit the Internal Operations component over HTTP to read critical Product Hub data without modifying it or causing denial of service. The CVSS 3.1 score is 6.5 with a confidentiality-only impact, and exploitation requires a valid low-privilege account rather than anonymous access. No public exploit code was identified at time of analysis, and no CISA KEV status is indicated in the supplied data.
Oracle E-Business Suite iSupplier Portal 12.2.3 through 12.2.15 contains a confidentiality-only flaw in the Internal Operations component that lets a low-privileged, authenticated attacker with HTTP network access read critical data or all data accessible through the portal. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with no integrity or availability impact; the main barrier is obtaining a valid supplier or portal credential. No public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated information disclosure in Oracle Order Management 12.2.3 through 12.2.15 allows low-privilege users with network HTTP access to read critical data exposed by the Product Diagnostic Tools component. The CVSS 3.1 score is 6.5 with PR:L, AC:L, UI:N, and only confidentiality impact (C:H/I:N/A:N), so an attacker must already hold valid E-Business Suite credentials and cannot modify or disrupt the service through this issue. No public exploit identified at time of analysis, and no KEV or EPSS data was supplied.
Sensitive-data disclosure in the MWA Terminal Server component of Oracle Mobile Application Server (part of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged authenticated user reach data they should not be able to read, potentially including all information accessible to the component. Exploitation requires a valid EBS account plus network access to the MWA Terminal Server over HTTP, needs no user interaction, and succeeds with low attack complexity (CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) - confidentiality only, with no integrity or availability impact. The exposure is bounded by the authentication prerequisite and by whether the optional mobile/barcode component is actually deployed and exposed; no public exploit code has been identified and the issue is not confirmed actively exploited (CISA KEV), so it is primarily an insider or post-compromise credential-abuse risk addressed in the Oracle Critical Patch Update of October 2026.
Oracle General Ledger within Oracle E-Business Suite 12.2.3 through 12.2.15 can expose critical financial records to an authenticated low-privilege user who can reach the Internal Operations component over HTTP. The flaw scores 6.5 on CVSS 3.1 with confidentiality-only impact (C:H/I:N/A:N), requires a valid PR:L account and no user interaction, and does not affect integrity or availability. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the reference for fixes.
Oracle Applications Manager in Oracle E-Business Suite 12.2.3 through 12.2.15 allows any authenticated low-privileged user with HTTP network access to read critical data through the Oracle Diagnostics Interfaces component. Exploitation is low-complexity and requires no user interaction, but the need for a valid account limits exposure; impact is confidentiality-only (CVSS 6.5, C:H/I:N/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle US Federal Human Resources, a module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), allows a low-privileged authenticated user with HTTP network access to reach confidential HR data beyond their intended authorization through the Internal Operations component, resulting in a high-confidentiality impact (CVSS 6.5, C:H/I:N/A:N). Exploitation requires valid low-privileged application credentials (PR:L) and no user interaction, so the exposure is not anonymous Internet attack but rather privilege escalation-in-data-access by any account holder, including federated or externally provisioned identities. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update.
Oracle Purchasing 12.2.3 through 12.2.15 within Oracle E-Business Suite can expose critical purchasing data to a low-privileged authenticated user who can reach the PO View Document component over HTTP, yielding a confidentiality-only CVSS 3.1 score of 6.5. Exploitation requires a valid EBS account (PR:L) and no user interaction; the impact is limited to reading Oracle Purchasing data, with no integrity or availability effect. No public exploit or CISA KEV entry is identified at time of analysis, so this is a moderate-priority patching item rather than an actively exploited emergency.
Low-privileged Oracle E-Business Suite users can access critical Order Management data through the Product Diagnostic Tools component in versions 12.2.3 through 12.2.15. The issue is network-reachable over HTTP with low complexity and no user interaction, but requires a valid low-privilege account and affects confidentiality only. No public exploit code or confirmed active exploitation was identified at time of analysis.
Low-privileged authenticated users of Oracle Siebel CRM Cloud Applications 22.3 through 26.9 can read critical or all accessible data through the Siebel Cloud Manager LDAP interface, with confidentiality as the only scored impact and no integrity or availability effect. The issue is medium severity (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and requires a valid low-privileged account, so it is not an unauthenticated flaw. No public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated low-privilege users can access critical or all accessible data in Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 through the SQR component over HTTP, yielding a CVSS 3.1 score of 6.5 from confidentiality impact alone. The flaw does not affect integrity or availability, and no public exploit identified at time of analysis; exploitation requires a valid low-privileged account and reachable SQR functionality.
Low-privilege authenticated users can read critical data from PeopleSoft Enterprise PeopleTools 8.61 through 8.63 through the Report Distribution component over HTTP. The issue scores CVSS 6.5 with confidentiality-only impact (C:H/I:N/A:N), requires valid low-privilege credentials (PR:L) and no user interaction, and is not exploitable by a fully unauthenticated outsider. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 expose confidentiality-sensitive data through a flaw in the product's Security Framework, reachable over HTTP by an unauthenticated attacker (CVSS 3.1 base score 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). The attacker must persuade a JDeveloper user - a person other than the attacker - to interact with attacker-controlled content, which is the single factor that keeps the flaw from being trivially remote-exploitable. Successful exploitation yields unauthorized access to critical data or complete access to all data the JDeveloper instance can reach, with no integrity or availability impact; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.