Unauthenticated remote attackers can exploit an authentication bypass in the Security component of Oracle Essbase 21.8.3.0.0 over HTTP, gaining unauthorized access to critical data and limited ability to modify it, with potential impact extending to connected Oracle products due to a scope change. The vulnerability carries a CVSS 9.3 base score; no public exploit identified at time of analysis, and no CISA KEV entry confirms active exploitation. Risk is highest for instances with internet-facing or otherwise network-reachable Essbase HTTP services, while segmented or access-restricted deployments are less exposed.
Authenticated OS command injection in the boa web management interface of the TOTOLINK X2000R router allows anyone holding administrative credentials to run arbitrary commands on the device by sending a crafted HTTP request to the formPasswordSetup endpoint. Only units running firmware V1.0.0-B20250421.1327 are affected, and the CVSS vector (PR:H) confirms the flaw sits behind a high-privileged login, so it is an access-gated post-authentication escalation to full device compromise rather than a pre-auth router takeover. No public exploit code has been identified at time of analysis, and the vulnerability is not in CISA KEV; the real-world risk comes from internet-exposed management interfaces and from default or reused admin passwords.
OS command injection in the batchupg (batch upgrade) handler of TOTOLINK X2000R firmware build V1.0.0-B20250421.1327 lets an attacker who already holds a valid administrator session on the router's web management interface send a crafted HTTP request that executes arbitrary shell commands on the device, yielding a full compromise of confidentiality, integrity, and availability. The prerequisite of high-privileged web credentials (CVSS PR:H) sharply limits exposure - this is not reachable by an unauthenticated attacker - but the practical risk climbs sharply on units whose admin panel is exposed to the WAN or still uses default/weak credentials. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; the flaw was reported by Cisco Talos under TALOS-2026-2435.
Authenticated OS command injection in the boa web management interface of the TOTOLINK X2000R router (firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) allows an attacker holding a valid administrative session to send a crafted HTTP request to the formUpload() handler and have unsanitized input executed as a shell command, yielding arbitrary code execution on the device. Reported by Cisco Talos (TALOS-2026-2438) with a high severity score; exploitation requires PR:H admin privileges and network reachability to the management HTTP interface, so exposure is greatest where the admin UI is reachable from the WAN or default/weak credentials are in use. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no vendor-released fix version is referenced in the available data.
Authenticated command injection in TOTOLINK X2000R is a serious but privilege-gated flaw: an attacker who already holds administrative access to the router's web management interface can send a crafted HTTP request to the Boa formWsc handler and execute arbitrary OS commands via the peerRptPin parameter. The affected build is TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, and exploitation requires high privileges (PR:H) but no user interaction and low attack complexity once admin access is obtained. No public exploit was identified at time of analysis, and the practical barrier is credential acquisition, such as weak, default, or reused admin passwords or a chained authentication bypass.
Authenticated OS command injection in TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 allows an administrator-level attacker to execute arbitrary shell commands by sending a crafted HTTP request to the boa formWsc handler with a malicious targetAPSsid value. The issue is rated CVSS 9.1 and requires a valid high-privileged administrative session (PR:H); no public exploit code or CISA KEV entry was identified at time of analysis, so practical risk depends heavily on whether the router management interface is exposed.
Authenticated OS command injection in TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 allows a high-privileged administrative user to execute arbitrary OS commands by sending a crafted HTTP request to the boa formMapDelDevice handler with shell metacharacters in the macstr parameter (CVSS 9.1). Exploitation requires a valid administrative session and network reachability to the management interface, typically LAN-side unless WAN management is enabled; no public exploit code was identified at time of analysis.
Arbitrary shell command execution in Apache CouchDB 3.5.2 and earlier on all platforms allows an authenticated CouchDB server administrator to run commands as the CouchDB operating-system user by setting an unvalidated runtime configuration value. The flaw crosses from application administration into host command execution, so the main risk is privilege escalation from CouchDB admin to the underlying host or misuse of stolen admin credentials; exploitation requires high-privilege authentication (PR:H) and is not remote-unauthenticated. Vendor-released patch: 3.5.3; no public exploit identified at time of analysis.
Out-of-bounds write in Eclipse NetX Duo's X.509 certificate-chain verification lets unauthenticated remote attackers corrupt static memory by presenting a certificate with an RSA modulus larger than the 4096-bit NX_CRYPTO_MAX_RSA_MODULUS_SIZE buffer dimension. The flaw is reachable pre-authentication on TLS/DTLS clients validating a malicious server chain and on servers configured for client-certificate authentication, because the peer-supplied issuer is resolved before the trusted store. No public exploit was identified at time of analysis, but the issue is rated critical (CVSS 4.0 9.3; independently assessed CVSS 3.1 9.8).
Missing authorization in Unblu Spark's Collaboration Server (versions 7.0 through 8.36.1-hotfix.0) lets any authenticated low-privilege user read and modify configuration data belonging to other users and accounts - and, in Unblu Cloud, other customers' tenants - crossing a security boundary. The server omits ownership checks on configuration-cascade operations, and when non-default configuration validation settings are in effect a registered user can also write configuration properties outside their permitted scope; exploitation needs a valid session but no user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis, but the cross-tenant read/write impact and critical severity (CVSS 4.0 9.3; the independent CVSS 3.1 assessment is also critical) make this a high-priority fix.
Authenticated path traversal in the boa formUploadFile handler of TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 allows an attacker with valid web-management credentials to write arbitrary files and potentially achieve code execution. The issue is high severity but gated by mandatory authentication to the router's HTTP administration interface, so realistic risk is concentrated on devices with exposed admin access or weak/default credentials. No public exploit was identified at time of analysis, and no CISA KEV active-exploitation confirmation is available.
Authenticated stack-based buffer overflow in the TOTOLINK X2000R router's boa formIpQos handler lets an attacker with administrator credentials send a crafted HTTP request containing a malicious 'mac' parameter to overwrite a stack buffer and achieve arbitrary code execution. The flaw affects firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and requires a valid high-privilege management session plus reachability of the boa web interface. No public exploit code or confirmed active exploitation has been identified at time of analysis, and practical risk is concentrated where default or weak admin credentials and WAN-exposed management interfaces are present.
Authenticated administrative users of TOTOLINK X2000R firmware build B20250421.1327 can trigger a stack-based buffer overflow through crafted HTTP requests to the batchupg endpoint, potentially achieving arbitrary code execution. The CVSS vector requires high privileges (PR:H), meaning valid admin credentials are the primary prerequisite, and reachability depends on the management interface being accessible to the attacker. No public exploit code was identified at time of analysis, and no pre-authentication exploitation path is indicated.
Authenticated attackers can trigger a heap-based buffer overflow in the boa web server's formUpload() handler on TOTOLINK X2000R routers running firmware V1.0.0-B20250421.1327, potentially leading to arbitrary code execution. The vulnerability requires valid administrative credentials (PR:H) but no user interaction, and the management interface must be network-reachable. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated attackers who can reach the boa web administration interface on TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 can trigger a stack-based buffer overflow by sending a crafted HTTP request to formUpload(), with potential for arbitrary code execution and high confidentiality, integrity, and availability impact. The issue is access-gated: exploitation requires high-privilege router administrator credentials (PR:H) and low complexity once authenticated (AC:L/UI:N), so realistic risk depends on whether the management UI is exposed and protected by default or weak credentials. No public exploit code or CISA KEV active-exploitation listing was identified in the provided data.
A stack-based buffer overflow in the Mcli handler of the TOTOLINK X2000R router's web management interface lets an attacker who supplies a specially crafted HTTP request overwrite stack memory and potentially achieve arbitrary code execution on the device. Only firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 has been confirmed affected, and exploitation requires valid administrative credentials (PR:H in the CVSS vector), so the practical attack path is an authenticated one against an exposed management interface. Vendor severity is rated 9.1 and the flaw was reported by Cisco Talos as TALOS-2026-2439; no public exploit code or confirmed active exploitation was identified at time of analysis, though risk rises sharply on deployments where the admin UI is reachable from the WAN or protected by default/reused credentials.
Authentication bypass in Advantech ADAM-3600 enables unauthenticated network attackers to abuse the password-reset mechanism and gain unauthorized access, with high confidentiality, integrity, and availability impact; CVSS 4.0 scores this 9.2, while our independent CVSS 3.1 assessment rates it high with AC:H because a specific precondition in the reset flow must be met (AT:P). No public exploit code has been identified at time of analysis, and exploitation depends on network reachability to the controller's management/reset interface; OT segmentation substantially reduces exposure. This is a high priority for affected ICS/OT environments where ADAM-3600 devices are internet-facing or reachable from compromised IT segments.
Unauthenticated remote code execution is possible against the Advantech ADAM-3600 through a stack-based buffer overflow in its login handling. The device is rated Critical (vendor CVSS 4.0 score 9.2; assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H), but reliable exploitation is constrained by high attack complexity and by whether the login service is reachable from untrusted networks. No public exploit was identified at time of analysis.
Authenticated administrator-level attackers can achieve arbitrary code execution on Totolink X2000R routers running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 by sending a crafted HTTP request with an overlong static_gw parameter to the boa formIpv6Setup static network configuration endpoint. The stack-based buffer overflow (CWE-121) requires a valid admin session (CVSS PR:H), so exposure of the web management interface and weak or default credential hygiene are the practical enablers. This is a high-severity issue, but no public exploit was identified at time of analysis, and other firmware or hardware revisions are not confirmed affected from the available data.
Authenticated remote code execution affects TOTOLINK X2000R routers running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, where an oversized static_ipv6 parameter sent to the boa formIpv6Setup handler overflows a stack buffer and can lead to arbitrary code execution. Exploitation requires valid administrative credentials on the router's web management interface (CVSS PR:H), which is typically reachable only from the LAN unless remote administration is enabled; default or weak admin passwords on consumer routers reduce that barrier. No public exploit code was identified at time of analysis.
Stack-based buffer overflow in the TOTOLINK X2000R router's boa web management server allows an authenticated administrator to achieve arbitrary code execution by sending a crafted HTTP request to the formIpv6Setup endpoint carrying an oversized dhcp_dns2 parameter. Only firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 is confirmed affected, and the attack requires a valid high-privilege session (CVSS 3.1 base 9.1, AV:N/AC:L/PR:H/UI:N) on the device's web interface, meaning real-world exploitation generally depends on default-credential reuse or chaining with a separate authentication bypass. No public exploit code or confirmed active exploitation was identified at time of analysis, and no vendor-released fix is confirmed in the available data.
Arbitrary code execution in the TOTOLINK X2000R router (firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) requires an attacker to first authenticate to the boa administrative web interface, then send a crafted HTTP request whose dhcp_dns1 parameter overflows a fixed-size stack buffer in the formIpv6Setup handler. Successful exploitation corrupts stack memory and can redirect execution to attacker-controlled data, giving code execution on the device with the web server's privileges. The CVSS vector (PR:H) and the Talos report both confirm that valid high-privilege admin credentials are a hard prerequisite, so the practical threat is concentrated on devices whose management interface is exposed to untrusted networks or left on default/weak credentials; no public exploit code or active exploitation was identified at time of analysis.
Stack-based buffer overflow in TOTOLINK X2000R router firmware (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) allows a high-privileged authenticated management user to trigger arbitrary code execution by sending a crafted HTTP request to the boa formFilter endpoint with an oversized vpnPassword parameter. The CVSS vector confirms network reachability, low attack complexity, high privileges required, and no user interaction; risk is concentrated on devices with exposed web administration and weak or default admin credentials. No public exploit was identified at time of analysis.
Authenticated remote code execution affects TOTOLINK X2000R routers running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, where the boa web management interface's formFilter handler processes the vpnUser HTTP parameter into a fixed-size stack buffer without adequate bounds checking. An attacker who first obtains administrative credentials (PR:H) can send an oversized vpnUser value to overflow the stack and potentially execute arbitrary code; exposure is limited by the need for valid admin authentication and reachability of the management interface. The authoritative assessment uses CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, and no public exploit identified at time of analysis.
Authenticated stack-based buffer overflow in the boa formUploadFile handler on TOTOLINK X2000R routers can allow arbitrary code execution when a specially crafted HTTP request is sent to the web management interface. The issue affects the specific firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and requires administrative credentials (PR:H) plus network reachability to the management UI, which is normally LAN-restricted. No public exploit has been identified at time of analysis, and the vendor/Talos CVSS is 9.1.
Stack-based buffer overflow in the boa web server's formTR069Config handler on TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 lets an authenticated attacker send a specially crafted HTTP request that overflows a fixed-size stack buffer and can lead to arbitrary code execution on the router. The flaw is network-reachable with low attack complexity, but exploitation requires valid management credentials (CVSS PR:H), making exposure of the administrative interface and credential hygiene the decisive risk factors. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; the 9.1 CRITICAL base score reflects full confidentiality, integrity and availability impact once the authentication barrier is crossed.
Authenticated remote code execution is possible in TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 through a stack-based buffer overflow in the boa formMapDelDevice hostname handling. An attacker must already hold administrative credentials on the device's web management interface and send a crafted HTTP request with an oversized hostname value; no public exploit code was identified at time of analysis. The published CVSS 9.1 uses a changed-scope (S:C) vector, while our independent assessment treats scope as unchanged (S:U) and stresses that practical risk is conditional on exposed management access and unchanged/default admin credentials.
Stack-based buffer overflow in the boa HTTP management interface of TOTOLINK X2000R firmware (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) allows an authenticated administrator to trigger memory corruption via an overlong 'macstr' parameter to formMapDelDevice, potentially achieving arbitrary code execution. The flaw is network-reachable and low-complexity but requires valid high-privilege credentials (CVSS PR:H), so it is not an unauthenticated remote takeover despite the 9.1 base score. No public exploit code or active exploitation is identified in the provided data; exposure is highest where the management interface is reachable from untrusted networks such as WAN/remote management.
Stack-based buffer overflow in the boa web server's formParentControl url handler on TOTOLINK X2000R firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 lets an authenticated attacker send a crafted HTTP request that can corrupt stack memory and potentially achieve arbitrary code execution. The source advisory rates it CVSS 3.1 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), while independent assessment treats the prerequisite as authenticated access (PR:L) with unchanged scope; the main exposure driver is internet-reachable router management with valid or weak/default credentials. No public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated stack-based buffer overflow in the TOTOLINK X2000R router (firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) allows a user holding administrator credentials on the boa web management interface to send a crafted HTTP request to the formParentControl handler with an oversized 'deviceName' parameter and achieve arbitrary code execution on the device. Talos rates the issue 9.1, while our reassessment keeps the high confidentiality/integrity/availability impact but scores scope as unchanged (S:U) rather than changed; the dominant limiting factor is PR:H, so real-world risk concentrates on routers reachable from the WAN with default or reused admin passwords or where an authentication bypass can be chained. No public exploit code was identified at the time of analysis and the CVE is not listed in CISA KEV, so there is no confirmation of active exploitation.
Authenticated stack-based buffer overflow in the TOTOLINK X2000R router's boa web management interface allows an attacker with admin-level credentials to achieve arbitrary code execution by sending a crafted HTTP request to the formIpv6Setup PPPoE handler, specifically through an oversized pppoe_dns2 parameter. The vulnerability affects firmware build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 and is gated by PR:H, so it is not an unauthenticated remote takeover; exposure is materially lower when the web UI is not reachable from the WAN. No public exploit code or confirmed active exploitation was identified at time of analysis, though the published CVSS score is 9.1 and the assessed vector confirms high confidentiality, integrity, and availability impact.
Arbitrary code execution in TOTOLINK X2000R firmware (TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) is possible through a stack-based buffer overflow in the boa web server's formIpv6Setup PPPoE handler when the pppoe_dns1 parameter receives an overlong value. The attack requires an authenticated HTTP request with valid management credentials (CVSS PR:H) and network reachability to the router's management interface, which is typically LAN-side. No public exploit was identified at time of analysis; Talos rates the issue 9.1 critical under a scope-changed vector, while the independent assessment scopes the impact to the device (S:U) and still considers it high severity.
Stack-based buffer overflow in the boa web server of the TOTOLINK X2000R router (firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327) allows an attacker holding valid administrative credentials to achieve arbitrary code execution by sending a crafted HTTP request that oversizes the static_dns2 parameter to the formIpv6Setup handler. The flaw carries a CVSS 3.1 base score of 9.1, but exploitation is gated by PR:H - the attacker must first authenticate to the web management interface and have network reachability to it, so unauthenticated or internet-wide mass exploitation is not indicated by the available data. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no vendor-released patch has been identified; risk is concentrated on devices whose administrative interface is WAN-exposed or protected by default or weak credentials.
Authenticated remote code execution affects TOTOLINK X2000R routers running firmware TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327 through a stack-based buffer overflow in the boa HTTP server's formIpv6Setup handler. An attacker who already holds administrative credentials can send a crafted HTTP request with an oversized static_dns1 parameter to corrupt stack memory and potentially execute arbitrary code. The flaw is rated CVSS 9.1 but requires high-privilege access to the management interface; no public exploit was identified at time of analysis, and no CISA KEV entry was provided.
Critical data disclosure and denial of service in Oracle Mobile Field Service (Oracle E-Business Suite 12.2.3 through 12.2.15) allow unauthenticated network attackers to read sensitive application data and cause a hang or frequently repeatable crash via crafted HTTP requests. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), reflecting complete confidentiality and availability impact with no integrity impact. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authentication bypass in Networknt light-4j 2.1.5 before 2.4.0 lets unauthenticated attackers impersonate LDAP/AD-delegated users by sending a Basic Authorization header with a known username and an empty password. The flaw is only reachable where BasicAuthHandler uses LDAP/AD delegation and the backing directory treats a non-empty username with an empty password as a successful bind; static/config-file Basic auth and bearer-token deployments are not affected, and directories that reject empty-password binds neutralize the attack. Vendor-released patch: 2.4.0; no public exploit identified at time of analysis.
Unauthenticated network attackers can corrupt or destroy data and trigger a hang or repeated crash in Oracle Outside In Technology 8.5.8 through the Outside In Clean Content SDK when an embedding application parses attacker-supplied documents. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), with high integrity and availability impact but no confidentiality impact; no public exploit code was identified at time of analysis. Real-world exposure depends on whether a product embedding the SDK accepts untrusted files for ingestion, conversion, indexing, or preview.
Remote unauthenticated attackers who can reach the Adapters component of Oracle SOA Suite 12.2.1.4.0 or 14.1.2.0.0 over HTTP can modify or delete critical data and cause a hang or frequently repeatable crash, producing a CVSS 9.1 integrity and availability impact. No public exploit identified at time of analysis and no CISA KEV entry is present in the supplied data, but the low-complexity, no-privilege vector makes patching and reducing network exposure high priorities.
Unauthenticated network attackers can read, create, delete, or modify critical data in Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 through the Core component's HTTP interface. The 9.1 CVSS score reflects high confidentiality and integrity impact with no availability impact, low complexity, and no user interaction. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided; exposure is primarily determined by whether WebLogic HTTP/T3 listeners are reachable from untrusted networks.
Unauthenticated, network-reachable attackers can read and modify critical data in Oracle Product Workbench, the WebUI component of Oracle E-Business Suite, across versions 12.2.3 through 12.2.15. The flaw carries a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), meaning no credentials or user interaction are required beyond HTTP reachability to the Product Workbench WebUI endpoint. At the time of analysis, no public exploit code has been identified and the issue is not listed in CISA KEV, but Oracle's 'easily exploitable' rating and the complete absence of an authentication prerequisite make internet-exposed EBS deployments a priority.
Unsigned firmware images are accepted and flashed by the boa-based firmware update handler on TOTOLINK X2000R routers running build TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327, allowing an attacker who already holds administrative web-interface credentials to install arbitrary firmware. The flaw is an improper verification of cryptographic signature (CWE-347): the device performs no meaningful code-signing check on the uploaded image, so a crafted binary can yield persistent, privileged control of the router. Talos rates it CVSS 3.1 base 9.1, though the practical barrier is the PR:H administrative prerequisite; no public exploit code or CISA KEV entry is associated with this CVE at time of analysis.
Unauthenticated network attackers can read and modify critical data through the LDAP Gateway component of Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0, which permits LDAP operations without enforcing authentication. With a CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:N/UI:N, C:H/I:H), exploitation requires only reachability to the exposed LDAP listener and no user interaction. Oracle's October 2026 Critical Patch Update references the fix; no public exploit code or confirmed active exploitation was identified at time of analysis, so risk is concentrated in environments where the LDAP Gateway is network-accessible.
Unauthenticated attackers with HTTPS reachability to the Installation Security component in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can read and modify critical EnterpriseOne Tools data; availability is not impacted. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N), and Oracle's October 2026 Critical Patch Update is the cited advisory. No public exploit code or CISA KEV entry was identified at time of analysis, so risk is highest for internet-exposed instances.
Unauthenticated HTTP access to JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can allow a remote attacker to read and alter critical application data, with CVSS 9.1 reflecting high confidentiality and integrity impact but no availability impact. The flaw is in the Enterprise Infrastructure SEC component and is rated PR:N/AC:L/UI:N, so the main practical barrier is network reachability to an affected instance; no public exploit was identified at time of analysis and no CISA KEV confirmation was provided. Oracle's October 2026 Critical Patch Update is the reference advisory for remediation.
Unauthenticated, network-reachable attacks against the BRM Server component of Oracle Communications Billing and Revenue Management 15.0.0.0.0 through 15.2.0.0.0 can read and modify critical billing data through the product's HTTP interface, a flaw Oracle rates as easily exploitable with CVSS 3.1 score 9.1 (C:H/I:H/A:N). The vector (AV:N/AC:L/PR:N/UI:N) means no credentials, user interaction, or special conditions are needed beyond network reachability of the HTTP interface; because BRM is typically a back-office telecom billing system, real-world risk hinges on whether that interface is exposed to an attacker-reachable segment. No CISA KEV listing or public exploit code was identified at time of analysis, and no EPSS score was provided, though the intrinsic severity and Oracle's 'easily exploitable' label warrant prompt patching.
Authentication bypass in Oracle Helidon 4.0.0 through 4.5.5 allows unauthenticated remote attackers to read and modify critical application data over HTTP when the helidon-microprofile-security component is used. Oracle rates the issue CVSS 9.1 with high confidentiality and integrity impact and no availability impact, and the vector shows no privileges or user interaction required. No public exploit identified at time of analysis, and the supplied data does not confirm active exploitation (CISA KEV), but the exposure is serious for network-reachable applications relying on the affected security component.
Authenticated high-privileged attackers with network access can achieve full takeover of Oracle Business Intelligence Enterprise Edition 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 through the Analytics Web Administration component, with scope change extending impact to connected products. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H); no public exploit identified at time of analysis.
Authentication, authorization, and rate-limiting middleware bypass in @fastify/middie 9.0.0 through 9.3.5 can let a single unauthenticated remote request reach a route handler while path-scoped middleware registered with use() is silently skipped. The flaw occurs when the middleware mount path joined to the plugin scope prefix diverges from the path Fastify's router serves, particularly when the scope prefix ends in a slash, when array mount paths are used, or when mount paths lack a leading slash. Risk is configuration-dependent: applications that rely on path-scoped middie middleware for security and use those mount-path patterns are exposed, while applications enforcing authorization in a post-routing Fastify hook are not; no public exploit identified at time of analysis, and the vendor patch is 9.3.6.
Oracle Agile Product Lifecycle Management for Process 6.2.4 exposes critical data to unauthenticated remote attackers through an HTTP-reachable Product Quality Management component, allowing high-impact confidentiality and integrity compromise with a CVSS 3.1 score of 9.1. The flaw is assessed as remotely exploitable with no privileges or user interaction, but no CISA KEV listing and no public exploit code were identified at time of analysis. No EPSS score or SSVC decision data was supplied, so exploitation probability is not quantified.
Low-privileged authenticated users can exploit the Federated Partitions component in Oracle Essbase 21.8.3.0.0 over HTTP to obtain broad read access to critical Essbase data, limited unauthorized insert/update/delete capability, and a partial denial of service. The critical 9.1 CVSS score is driven mainly by the scope change (S:C) and high confidentiality impact (C:H), meaning successful exploitation can also affect resources in connected products beyond Essbase itself. Attack complexity is low and no user interaction is required, but the flaw is not anonymously reachable - an attacker must already hold a valid low-privileged Essbase account (PR:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied with the source data.