Authenticated attackers with high database privileges can exploit the Server: XML component in MySQL Server 8.4.x, 9.7.x, and 26.7.x, as well as MySQL Cluster 8.0.x, 8.4.x, 9.7.x, and 26.7.x, over the network to modify or delete critical data and to hang or repeatedly crash the service. The flaw has low attack complexity and requires no user interaction, but the PR:H prerequisite limits practical risk to insiders, compromised privileged accounts, or post-authentication attack chains; confidentiality is not affected. No public exploit code or CISA KEV entry was identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster JSON processing allows a low-privileged authenticated attacker with network access to hang or repeatedly crash the database service (CVSS 3.1 score 6.5, availability-only). Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. The CVSS vector confirms PR:L authentication is required, and no public exploit was identified at time of analysis; no CISA KEV status was supplied.
A low-privileged authenticated attacker with network access can repeatedly crash or hang the MySQL Server or MySQL Cluster service by abusing flaw handling in the Server: Pluggable Auth component, yielding complete denial of service against the database. Affected releases are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, as documented in the Oracle Critical Patch Update for October 2026. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); no public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, and EPSS data was not provided.
Denial of service in Oracle MySQL Server and MySQL Cluster allows low-privileged authenticated users with network access to hang or repeatedly crash the service via the C API component. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. No public exploit identified at time of analysis, and impact is limited to availability with a CVSS 3.1 base score of 6.5.
Denial of service in Oracle MySQL Server (C API component) and MySQL Cluster allows an authenticated low-privileged attacker with network access to hang or repeatedly crash the database, causing complete availability loss. Affected branches include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; CVSS 3.1 is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). No public exploit was identified at time of analysis, and exploitation requires valid low-privileged credentials and network reachability.
MySQL Cluster 9.7.3 can be driven into a hang or repeatable full crash through its NDB Operator component by an attacker who holds a valid low-privilege account and can reach the operator's HTTP endpoint over the network. The flaw is an availability-only issue: there is no data disclosure or modification, but a successful attack takes the cluster's management plane down and can be repeated to sustain the outage. Oracle addressed it in its October 2026 Critical Patch Update, and no public exploit code or confirmed active exploitation was identified at time of analysis; the realistic threat is a malicious or compromised authenticated tenant/operator user rather than an anonymous internet attacker.
Authenticated low-privileged HTTP requests to Oracle Siebel CRM Deployment's Server Infrastructure component can hang or repeatedly crash the service, producing a complete denial of service across all supported releases 17.0 through 26.9 (CVSS 3.1 base 6.5). The attack is network-reachable and low-complexity with no user interaction, but it requires valid low-privileged credentials (PR:L), so risk is bounded to authenticated users, compromised accounts, and malicious insiders rather than anonymous internet attackers. Impact is availability-only - no data disclosure or modification - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Oracle WebCenter Content's Content Server component lets an authenticated low-privileged attacker with network HTTP access hang or repeatedly crash the application, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 score is 6.5 with availability-only impact (A:H; no confidentiality or integrity effect), and no public exploit code or CISA KEV entry was identified at time of analysis. This is a moderate availability risk rather than a top-tier emergency, but it is easily triggered once valid low-privileged credentials exist.
Denial of service in Oracle MySQL Server and MySQL Cluster allows a low-privileged authenticated remote attacker to hang or repeatedly crash the database by sending crafted SQL that reaches the Server: Parser component. MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1 are affected. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); no public exploit code or CISA KEV entry is identified in the provided data.
Denial of service in Oracle MySQL Server and MySQL Cluster allows a low-privileged authenticated account with network access to hang or repeatedly crash the database service through the Server: XML component. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. The issue is availability-only (CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); no public exploit code or CISA KEV entry was identified at time of analysis, so practical risk is moderate and driven by exposure of MySQL accounts and ports.
Denial of service in MySQL Server and MySQL Cluster (Server: Optimizer component) allows an authenticated low-privilege attacker with network access to cause a hang or frequently repeatable crash of the database service, resulting in complete loss of availability for the affected instance. Affected releases include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. No public exploit identified at time of analysis, and risk is concentrated on multi-tenant, shared, or externally reachable instances where untrusted or compromisable low-privilege accounts exist.
Repeated-crash denial of service in Oracle MySQL Server (X Plugin component) and MySQL Cluster allows a low-privileged, network-positioned user to hang or fully take down the database service. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Oracle rates it CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning the attacker must already hold a low-privileged account but needs no user interaction; there is no confidentiality or integrity impact and no code execution path, and no public exploit or CISA KEV listing was identified at time of analysis.
Denial of service in Oracle MySQL Server and MySQL Cluster allows an authenticated low-privilege attacker to hang or repeatedly crash the database service over the network. The flaw affects the Server: Components Services component in MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1; it is rated CVSS 6.5 with availability-only impact. No public exploit was identified at time of analysis, and the main prerequisite is a valid low-privilege database account reachable over MySQL-supported protocols.
Low-privileged database users with network access can repeatedly crash or hang MySQL Server and MySQL Cluster through the Security: Audit subsystem, producing a complete denial of service against the instance. The flaw carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Exploitation is not known to be active and no public exploit code has been identified at time of analysis, but the only real prerequisite is a valid low-privileged account - no user interaction or elevated rights - so exposure is greatest where shared or untrusted application accounts can reach the listener. This is a moderate-priority availability flaw, not a critical breach risk: confidentiality and integrity are unaffected.
Denial of service in Oracle MySQL Server and MySQL Cluster allows a low-privileged authenticated database user to hang or repeatedly crash the service via network-accessible InnoDB operations. Affected branches include MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); no public exploit identified at time of analysis and no CISA KEV confirmation was present in the supplied intelligence.
Authenticated low-privileged users can crash or hang MySQL Server and MySQL Cluster 26.7.0 through 26.7.1 by sending crafted queries over the network that exercise the Server: GIS (spatial data) component, producing a complete denial of service. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so only availability is affected and valid credentials are required. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the reference point for fixes.
Denial of service in Oracle MySQL Server and MySQL Cluster lets authenticated low-privileged network attackers hang or repeatedly crash the database by exercising JSON functionality. The flaw is in the Server: JSON component and affects MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3, and 26.7.0-26.7.1. Exploitation requires a valid low-privileged MySQL account and network access over a supported client protocol; impact is availability-only, and no public exploit was identified at time of analysis.
Low-privileged authenticated attackers with network access can hang or repeatedly crash the MySQL Server and MySQL Cluster Optimizer component (CVE-2026-101608), causing complete denial of service. Affected builds are MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1, plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1; the CVSS 6.5 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects availability-only impact with no data disclosure or modification. A valid low-privilege account is the main barrier to exploitation, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Pre-authentication access control bypass in IBM i Navigator (7.3, 7.4, 7.5, and 7.6) lets a remote attacker alter server-side session security state by sending a crafted HTTP request to any Navigator URL before authenticating. The weakness is an improper authentication/access-control flaw (CWE-287) rated CVSS 6.5, with low confidentiality and integrity impact and no direct code execution or full account takeover; the practical risk is concentrated on Navigator interfaces that are reachable from untrusted networks. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated HTTP access to the Business Interlink component in Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 can expose a limited subset of accessible application data and trigger partial denial of service. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), requiring no credentials or user interaction; no public exploit code or active exploitation has been identified at time of analysis.
Authenticated data disclosure in Oracle REST Data Services (ORDS) 24.2.0 through 26.2.1 lets a low-privileged attacker with HTTP network access read critical data - potentially all data accessible through ORDS - via the GraphQL component (CVSS 3.1 base 6.5, C:H/I:N/A:N). Exploitation requires a valid low-privileged account and a reachable, GraphQL-enabled ORDS endpoint, and is confined to confidentiality impact with no integrity or availability effect. No public exploit code has been identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update.
Critical data exposure in Oracle Siebel CRM's Open UI component affects versions 17.0 through 26.9, where an authenticated low-privileged attacker with HTTP access can read critical or all user-accessible data. The flaw is low-complexity and needs no user interaction but requires a valid low-privilege account (CVSS 6.5 Medium, confidentiality-only); no public exploit identified at time of analysis.
Improper access control in Oracle One-to-One Fulfillment, part of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged authenticated user with HTTP network access read critical data or all data accessible to the component. The assessed CVSS 3.1 score is 6.5 with confidentiality-only impact; integrity and availability are not affected, and no user interaction is required. No public exploit was identified at time of analysis, and active exploitation is not confirmed by CISA KEV in the provided data.
Low-privileged authenticated users of Oracle Email Center, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can read critical Email Center data they should not be able to reach, giving them complete read access to all data the component exposes (CVSS 3.1 base score 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw is remotely reachable over HTTP with low attack complexity and no user interaction, but the attacker must already hold valid low-privilege credentials in the application, so it is an authorization/access-control weakness rather than pre-authentication compromise. Impact is strictly confidentiality - no integrity or availability effect - and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthorized access to critical data in Oracle Partner Management, a module of Oracle E-Business Suite, affects versions 12.2.3 through 12.2.15, where a low-privileged authenticated user with HTTP network access can read data well beyond their intended authorization scope, including potentially all Partner Management data reachable through the Internal Operations component. The CVSS 3.1 base score of 6.5 reflects confidentiality-only impact (C:H/I:N/A:N) with low attack complexity, no user interaction, and a PR:L prerequisite, so the practical threat comes from internal users, partner accounts, or holders of compromised low-privilege credentials rather than anonymous internet attackers. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied.
Oracle Payroll 12.2.3 through 12.2.15 can disclose sensitive payroll records to an authenticated low-privileged E-Business Suite user who can reach the Internal Operations component over HTTP. The flaw is rated CVSS 6.5 with high confidentiality impact and no integrity or availability impact; exploitation requires valid credentials (PR:L) but no user interaction. No public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
Oracle Database Server RDBMS 23.4.0 through 23.26.3 can expose critical data to low-privileged authenticated users who can reach the database over HTTP, a moderate-priority confidentiality flaw scored CVSS 6.5. Exploitation requires a valid low-privilege account and network reachability, so it is not unauthenticated; no public exploit identified at time of analysis. Oracle's 'None privilege' wording conflicts with the PR:L vector and should be reconciled before scoping default-configuration exposure.
Information disclosure in Oracle Trusted Answer Search 26.1 allows a low-privileged authenticated remote attacker with HTTP access to read critical or all accessible data through the PL/SQL package component. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with impact limited to confidentiality-no integrity or availability effect. Only version 26.1 is listed as affected; no public exploit code or active exploitation was identified at time of analysis.
Authenticated low-privileged users of Oracle Primavera Unifier can read data they are not entitled to through a flaw in the product's Logging component, allowing disclosure of critical or potentially all application-accessible data. The issue affects the 21.12, 22.12, 23.12, 24.12 and 25.12 release trains up to their respective 21.12.17, 22.12.15, 23.12.16, 24.12.16 and 25.12.9 builds and is reachable over HTTP with no user interaction and no administrative rights required, scoring 6.5 under CVSS 3.1 with confidentiality-only impact. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; with EPSS data unavailable, practical risk is concentrated in deployments that expose Unifier to large or semi-trusted low-privilege user populations rather than in internet-wide opportunistic exploitation.
Information disclosure in Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 lets a low-privileged, authenticated remote attacker with HTTP access read sensitive Analytics Server data, with a CVSS 3.1 base score of 6.5; integrity and availability are unaffected. No public exploit identified at time of analysis, and no CISA KEV entry is provided, so this is a moderate-severity exposure rather than an emergency. Risk rises where BI EE is internet-facing or hosts multi-tenant data with weak account segregation.
Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 can disclose critical or all application-accessible data to an authenticated low-privileged attacker who can reach the BI Publisher Security component over HTTP. CVSS 6.5 reflects network attack, low complexity, required low privileges, no user interaction, and confidentiality-only impact with unchanged scope. No public exploit code or CISA KEV entry was identified at time of analysis, so this should be handled as a routine-but-real patching item.
Authenticated data exposure in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a low-privileged user with HTTP access read critical data through the Report Distribution component. CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confines impact to confidentiality, and a valid account is required. No public exploit was identified at time of analysis.
Oracle BI Publisher 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 expose a confidentiality-only flaw in the Web Server component that lets an authenticated low-privileged attacker with HTTP reachability read critical data or all BI Publisher-accessible data. The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects low attack complexity and no user interaction, but the PR:L prerequisite means valid credentials are required, and there is no integrity, availability, or scope impact. No public exploit code or confirmed active exploitation was identified at time of analysis.
Information disclosure in Oracle PeopleSoft Enterprise SCM Strategic Sourcing 9.2 allows a low-privileged authenticated bidder or supplier account to read critical data beyond its intended scope through the Bidder Registration component over HTTP. Exploitation is straightforward (AC:L, UI:N) but gated by the need for a valid account, and the impact is confidentiality-only - data can be read, not altered or disrupted. No public exploit code or confirmed active exploitation has been identified at time of analysis; Oracle lists the fix in its October 2026 Critical Patch Update.
Low-privileged authenticated users can read critical or all accessible data in PeopleSoft Enterprise SCM Strategic Sourcing 9.2 through an HTTP-reachable flaw, according to Oracle's October 2026 Critical Patch Update. The CVSS 6.5 rating is confidentiality-only (C:H/I:N/A:N) and requires a valid low-privilege account (PR:L), so it is not exploitable by unauthenticated remote attackers; no public exploit code or confirmed active exploitation is identified in the available intelligence, making this a moderate-priority issue rather than an emergency.
Unauthorized disclosure of critical JD Edwards EnterpriseOne Orchestrator data is possible in versions 9.2.0.0 through 9.2.26.5 when a low-privilege authenticated attacker can reach the Orchestrator over HTTP. The flaw is rated CVSS 6.5 with confidentiality-only impact; integrity and availability are unaffected, and no user interaction is needed. No public exploit code or CISA KEV confirmation was present in the supplied intelligence, so risk is moderate and contingent on prior valid Orchestrator access.
Oracle E-Business Suite iSupport 12.2.3 through 12.2.15 allows an authenticated low-privileged user with HTTP access to the Service Requests component to read critical data and potentially all iSupport-accessible records, producing a confidentiality-only impact at CVSS 3.1 6.5. No public exploit was identified at time of analysis, and exposure is highest where the iSupport portal is internet-facing or broadly accessible to external or customer accounts.
Information disclosure in Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 allows an authenticated low-privileged user with HTTP access to the nVision component to read data beyond their intended privileges, up to all PeopleTools-accessible data. The flaw is rated CVSS 6.5 with confidentiality-only impact and requires a valid account, so it is not exploitable pre-authentication. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and the primary remediation is Oracle's October 2026 Critical Patch Update.
JD Edwards EnterpriseOne 9.2 allows a low-privileged authenticated user with SMTP reachability to read critical Operational Sourcing data, creating a confidentiality-only exposure of business records. The flaw is rated CVSS 6.5 and requires valid low-level credentials; no public exploit has been identified at time of analysis, and there is no indication of active exploitation.
Oracle JD Edwards EnterpriseOne 9.2 exposes Sales Order Entry data to low-privileged users who should not be able to read it, through the JDENET communication service. An attacker who already holds a valid non-privileged EnterpriseOne account and can reach JDENET over the network can bypass intended access restrictions and read critical or complete Sales Order Entry data, with no user interaction and low attack complexity (CVSS 3.1: 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Impact is confidentiality-only - no integrity or availability effect - and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a moderate-priority data-exposure issue that becomes materially riskier when JDENET is internet-exposed or broadly reachable.
Low-privileged authenticated users of Oracle WebCenter Content: Imaging 12.2.1.4.0 and 14.1.2.0.0 can read critical or all application-accessible data through the Core component over HTTP. The flaw is remotely reachable with low attack complexity and no user interaction, but requires a valid low-privileged account; impact is confidentiality-only, with no integrity or availability effect. No public exploit or CISA KEV entry was identified at time of analysis, so this should be handled in the normal Oracle Critical Patch Update cycle.
WebCenter Content: Imaging 12.2.1.4.0 and 14.1.2.0.0 can disclose critical or all Imaging-accessible data to a low-privileged, authenticated attacker over HTTP through the Core component. The CVSS vector requires a valid low-privilege account (PR:L), low attack complexity, and no user interaction, with impact limited to confidentiality. No public exploit was identified at time of analysis, and this is a moderate-risk, confidentiality-only issue that warrants prompt but not emergency patching.
Confidentiality exposure in Oracle Agile PLM 9.3.6 lets a low-privileged authenticated user reach the Folders, Files & Attachments component over HTTP and read critical data, including potentially all PLM data accessible to that account; no user interaction or elevated privileges are required. The CVSS 3.1 score is 6.5 with high confidentiality impact only, and the authoritative assessment limits exploitation to holders of a valid low-privileged account. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a moderate authenticated-access risk rather than an unauthenticated emergency.
Low-privileged authenticated users of Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Applications DBA data through the Internal Operations component because of an access-control weakness exposed over HTTP. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so impact is confidentiality-only: no modification, no denial of service, and no user interaction. Exploitation requires a valid low-privilege EBS account and network reachability; no public exploit was identified at time of analysis and there is no CISA KEV listing.
Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allow authenticated low-privilege users to read confidential Content Server data over HTTP, with CVSS 3.1 base score 6.5 reflecting high confidentiality impact and no integrity or availability effect. Exploitation requires a valid low-privilege account plus network access to the Content Server component; no user interaction or special configuration is indicated. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided.
Oracle HRMS (US) 12.2.3 through 12.2.15 allows a low-privileged authenticated attacker with HTTP network access to the Internal Operations component to read critical HR data without user interaction. The assessed CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting high confidentiality impact only, and no public exploit has been identified at time of analysis. This moderate-risk issue warrants normal Oracle Critical Patch Update cadence rather than emergency response.
Unauthorized read access to HR data in Oracle HRMS (US) 12.2.3 through 12.2.15 is possible through an access-control weakness in the Internal Operations component of Oracle E-Business Suite, allowing a low-privileged authenticated user with HTTP network reach to retrieve records well beyond their intended authorization scope. The flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning impact is confined to confidentiality - no data modification or service disruption - and exploitation still requires valid credentials, which is the primary limiting factor. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; EPSS data was not available in the supplied intelligence, so it should be treated as a moderate-priority patching item rather than an emergency.
Unauthorized access to critical Oracle HRMS (US) data is possible for low-privileged authenticated attackers who can reach the Internal Operations component over HTTP in Oracle E-Business Suite 12.2.3 through 12.2.15. Successful exploitation yields high confidentiality impact only, with no integrity or availability effect, and requires a valid EBS account but no user interaction and low attack complexity. At time of analysis, no public exploit identified, and no KEV or EPSS data was provided.
Low-privileged Oracle E-Business Suite users can read critical HRMS (US) data through the Internal Operations component, a confidentiality-only exposure reachable over HTTP. Oracle HRMS (US) releases 12.2.3 through 12.2.15 are affected by this easily exploited flaw (CVSS 3.1: 6.5, AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N), meaning any valid authenticated EBS account can trigger it against a default configuration without user interaction. No public exploit code and no CISA KEV listing were identified at time of analysis, so the practical barrier remains obtaining valid EBS credentials - the attacker pool is limited to credentialed insiders or someone who has already compromised an account, and no data modification or service disruption is possible.
Oracle HRMS (Republic of Korea) payroll localization for E-Business Suite 12.2.3 through 12.2.15 permits a low-privileged, network-positioned attacker with a valid EBS account to read sensitive data beyond their intended authorization scope through the Korean Payroll component, yielding a high confidentiality impact with no integrity or availability effect (CVSS 6.5). Exploitation requires only low-privileged authenticated HTTP access, no user interaction, and low attack complexity, but is practically gated by whether an organization actually deploys the Korea-specific payroll localization outside South Korean deployments. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS-style risk is tempered by the module's narrow deployment footprint.