Oracle HRMS (India) Indian Payroll, as shipped with Oracle E-Business Suite 12.2.3 through 12.2.15, exposes a low-complexity HTTP-reachable path that lets a low-privileged authenticated user read data well beyond their intended scope, up to everything the HRMS (India) schema surfaces. The flaw is a confidentiality-only issue (CVSS 6.5, C:H/I:N/A:N) gated behind a valid EBS account (PR:L) with no user interaction required, which keeps unauthenticated external attackers out of reach. No public exploit code or confirmed active exploitation was identified at time of analysis, and the risk is best characterized as a moderate-priority authenticated information-disclosure problem concentrated in tenants that hand low-privilege EBS accounts to untrusted populations.
Unauthorized read access to critical HR data in Oracle HRMS (Norway) is possible for a low-privileged authenticated attacker who can reach the Internal Operations component over HTTP. The flaw affects Oracle E-Business Suite 12.2.3 through 12.2.15 deployments that include the Norwegian HRMS localization, and successful exploitation yields high confidentiality impact without integrity or availability effects. No public exploit was identified at the time of analysis, and the CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Authenticated information disclosure in the Product Diagnostic Tools component of Oracle Order Management (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged user reach data they should not see over plain HTTP, with no user interaction and low attack complexity. Because the CVSS vector carries PR:L with C:H and no integrity or availability impact, the practical outcome is read-only exposure of critical application data rather than tampering or denial of service - the authentication requirement is the main barrier an outside attacker must clear. Oracle addressed the flaw in its October 2026 Critical Patch Update; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Sensitive-data exposure in Oracle Order Management 12.2.3 through 12.2.15 lets a low-privileged authenticated user read critical or all Order Management-accessible data through the Product Diagnostic Tools component. The CVSS 6.5 rating reflects a network-reachable, low-complexity flaw with high confidentiality impact and no integrity or availability effect, gated by the need for a valid low-privileged EBS account (PR:L). No public exploit code or confirmed active exploitation was identified at time of analysis, and this is assessed as a moderate-priority issue.
Oracle Order Management 12.2.3 through 12.2.15 can expose critical business data to an authenticated low-privilege user through the Product Diagnostic Tools component, yielding read-only confidentiality impact with a CVSS 3.1 base score of 6.5. The attacker needs network HTTP access and valid low-privilege EBS credentials, and no public exploit code was identified at time of analysis; no CISA KEV entry was provided.
Authenticated low-privilege users of Oracle Product Hub 12.2.3 through 12.2.15 can exploit the Internal Operations component over HTTP to read critical Product Hub data without modifying it or causing denial of service. The CVSS 3.1 score is 6.5 with a confidentiality-only impact, and exploitation requires a valid low-privilege account rather than anonymous access. No public exploit code was identified at time of analysis, and no CISA KEV status is indicated in the supplied data.
Oracle E-Business Suite iSupplier Portal 12.2.3 through 12.2.15 contains a confidentiality-only flaw in the Internal Operations component that lets a low-privileged, authenticated attacker with HTTP network access read critical data or all data accessible through the portal. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), with no integrity or availability impact; the main barrier is obtaining a valid supplier or portal credential. No public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated information disclosure in Oracle Order Management 12.2.3 through 12.2.15 allows low-privilege users with network HTTP access to read critical data exposed by the Product Diagnostic Tools component. The CVSS 3.1 score is 6.5 with PR:L, AC:L, UI:N, and only confidentiality impact (C:H/I:N/A:N), so an attacker must already hold valid E-Business Suite credentials and cannot modify or disrupt the service through this issue. No public exploit identified at time of analysis, and no KEV or EPSS data was supplied.
Sensitive-data disclosure in the MWA Terminal Server component of Oracle Mobile Application Server (part of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged authenticated user reach data they should not be able to read, potentially including all information accessible to the component. Exploitation requires a valid EBS account plus network access to the MWA Terminal Server over HTTP, needs no user interaction, and succeeds with low attack complexity (CVSS 3.1 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) - confidentiality only, with no integrity or availability impact. The exposure is bounded by the authentication prerequisite and by whether the optional mobile/barcode component is actually deployed and exposed; no public exploit code has been identified and the issue is not confirmed actively exploited (CISA KEV), so it is primarily an insider or post-compromise credential-abuse risk addressed in the Oracle Critical Patch Update of October 2026.
Oracle General Ledger within Oracle E-Business Suite 12.2.3 through 12.2.15 can expose critical financial records to an authenticated low-privilege user who can reach the Internal Operations component over HTTP. The flaw scores 6.5 on CVSS 3.1 with confidentiality-only impact (C:H/I:N/A:N), requires a valid PR:L account and no user interaction, and does not affect integrity or availability. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the reference for fixes.
Oracle Applications Manager in Oracle E-Business Suite 12.2.3 through 12.2.15 allows any authenticated low-privileged user with HTTP network access to read critical data through the Oracle Diagnostics Interfaces component. Exploitation is low-complexity and requires no user interaction, but the need for a valid account limits exposure; impact is confidentiality-only (CVSS 6.5, C:H/I:N/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle US Federal Human Resources, a module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), allows a low-privileged authenticated user with HTTP network access to reach confidential HR data beyond their intended authorization through the Internal Operations component, resulting in a high-confidentiality impact (CVSS 6.5, C:H/I:N/A:N). Exploitation requires valid low-privileged application credentials (PR:L) and no user interaction, so the exposure is not anonymous Internet attack but rather privilege escalation-in-data-access by any account holder, including federated or externally provisioned identities. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update.
Oracle Purchasing 12.2.3 through 12.2.15 within Oracle E-Business Suite can expose critical purchasing data to a low-privileged authenticated user who can reach the PO View Document component over HTTP, yielding a confidentiality-only CVSS 3.1 score of 6.5. Exploitation requires a valid EBS account (PR:L) and no user interaction; the impact is limited to reading Oracle Purchasing data, with no integrity or availability effect. No public exploit or CISA KEV entry is identified at time of analysis, so this is a moderate-priority patching item rather than an actively exploited emergency.
Low-privileged Oracle E-Business Suite users can access critical Order Management data through the Product Diagnostic Tools component in versions 12.2.3 through 12.2.15. The issue is network-reachable over HTTP with low complexity and no user interaction, but requires a valid low-privilege account and affects confidentiality only. No public exploit code or confirmed active exploitation was identified at time of analysis.
Low-privileged authenticated users of Oracle Siebel CRM Cloud Applications 22.3 through 26.9 can read critical or all accessible data through the Siebel Cloud Manager LDAP interface, with confidentiality as the only scored impact and no integrity or availability effect. The issue is medium severity (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) and requires a valid low-privileged account, so it is not an unauthenticated flaw. No public exploit code or CISA KEV entry was identified at time of analysis.
Authenticated low-privilege users can access critical or all accessible data in Oracle PeopleSoft Enterprise PeopleTools 8.61-8.63 through the SQR component over HTTP, yielding a CVSS 3.1 score of 6.5 from confidentiality impact alone. The flaw does not affect integrity or availability, and no public exploit identified at time of analysis; exploitation requires a valid low-privileged account and reachable SQR functionality.
Low-privilege authenticated users can read critical data from PeopleSoft Enterprise PeopleTools 8.61 through 8.63 through the Report Distribution component over HTTP. The issue scores CVSS 6.5 with confidentiality-only impact (C:H/I:N/A:N), requires valid low-privilege credentials (PR:L) and no user interaction, and is not exploitable by a fully unauthenticated outsider. No public exploit was identified at time of analysis, and no CISA KEV entry was provided.
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 expose confidentiality-sensitive data through a flaw in the product's Security Framework, reachable over HTTP by an unauthenticated attacker (CVSS 3.1 base score 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). The attacker must persuade a JDeveloper user - a person other than the attacker - to interact with attacker-controlled content, which is the single factor that keeps the flaw from being trivially remote-exploitable. Successful exploitation yields unauthorized access to critical data or complete access to all data the JDeveloper instance can reach, with no integrity or availability impact; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 can disclose critical portal-accessible data to an unauthenticated, network-positioned attacker who convinces a separate user to interact with a crafted HTTP request against the Runtime Tools component. Rated CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), the flaw is purely a confidentiality problem - there is no integrity or availability impact - and the mandatory victim-interaction step is the main practical barrier to exploitation. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a moderate-priority issue that warrants timely patching rather than emergency response.
Unauthenticated disclosure of critical Oracle Applications Framework data in Oracle E-Business Suite 12.2.3 through 12.2.15 lets a network-positioned attacker reach OAF HTTP endpoints and read data the victim user is authorized to see, but only after that user is induced into a human interaction such as following an attacker-supplied link. The CVSS 3.1 score of 6.5 reflects confidentiality-only impact (C:H/I:N/A:N) with no integrity or availability effect, and no public exploit code has been identified at time of analysis. Real-world risk sits below the headline score because the mandatory UI:R step blocks automated or wormable exploitation and the attacker must be able to reach the OAF interface while a legitimate user can be persuaded to interact.
Oracle Outside In Technology 8.5.8 (Outside In Core) can expose critical data to unauthenticated remote attackers who persuade a user to open, preview, or submit a crafted document for parsing; the assessed CVSS 3.1 score is 6.5 with confidentiality-only impact and mandatory user interaction. No public exploit code or CISA KEV entry is identified in the provided data, and EPSS is not supplied; this is a moderate-priority data-disclosure issue that depends on the malicious file reaching an application that invokes Outside In parsing.
Unauthenticated network attackers can cause partial integrity and availability impact in Oracle Java SE (8u503, 8u503-perf, 11.0.32.1), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1), and Oracle GraalVM Enterprise Edition (21.3.19.1.1) by supplying malicious input to Utility-component APIs. The CVSS 3.1 score is 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L; no public exploit was identified at time of analysis. Practical exploitation depends on an application exposing the affected APIs to untrusted data, or on legacy sandboxed Java Web Start/applet deployments that execute untrusted code.
Unauthenticated HTTP requests against Oracle Helidon 4.0.0 through 4.5.5 and 27.0.0 can alter or delete some Helidon-accessible data and partially degrade service availability, with the fault residing in the helidon-common-concurrency-limits component. The disclosed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, base 6.5) means no credentials or user interaction are needed, but impact is capped at low integrity and low availability with no confidentiality loss and no scope change, so the risk derives from the easy attack profile rather than severe consequences. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Oracle addresses it through its October 2026 Critical Patch Update.
Unauthenticated HTTP access to PeopleSoft Financials 9.1 with the Brazil localization (FIN Common Objects) can allow remote attackers to make limited unauthorized updates, inserts, or deletes and cause a partial denial of service, with no confidentiality impact. Oracle rates this CVSS 3.1 base 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), and no public exploit identified at time of analysis. Exposure is limited to organizations running the affected Brazil Common Objects module on a PeopleSoft web tier reachable by the attacker.
Oracle Java SE, together with the GraalVM for JDK and GraalVM Enterprise Edition distributions, contains a Networking component vulnerability that allows unauthenticated network attackers to make limited unauthorized changes to accessible data and to cause a partial denial of service, without any confidentiality loss or code execution. The affected builds are Java SE 8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27, GraalVM for JDK 17.0.20.1 and 21.0.12.1, and GraalVM Enterprise Edition 21.3.19.1.1. No public exploit code or confirmed active exploitation is identified at time of analysis; practical risk is concentrated in services that pass attacker-controlled data into the affected networking APIs and in legacy sandboxed applet or Web Start deployments.
Attacker-influenced DNS responses can corrupt outbound traffic from Helidon's WebClient when the round-robin DNS resolver is in use, allowing a network-positioned attacker to perform limited unauthorized modification of data and cause partial denial of service in Helidon 4.0.0 through 4.5.5 and 27.0.0. The flaw is remotely reachable without credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, base 6.5), but only for deployments that actually enable the helidon-webclient-dns-resolver-round-robin component and only where the attacker can shape the DNS answers that client receives, such as a rogue DNS server or an on-path/DNS-spoofing position. There is no confidentiality impact and no public exploit identified at time of analysis, so this should be treated as a routine, scheduled-patch priority rather than an emergency.
Denial of service in Oracle Outside In Technology 8.5.8 (Outside In Core) lets unauthenticated remote attackers hang or repeatedly crash applications that parse attacker-supplied documents, with the CVSS 3.1 score of 6.5 reflecting an availability-only impact. The vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) requires network reachability plus human interaction from someone other than the attacker - typically a user opening, previewing, or uploading a crafted file into a service built on the Outside In SDK. No public exploit code exists and there is no CISA KEV listing at time of analysis, so the realistic exposure is confined to environments that embed Outside In Core in an internet-facing or multi-tenant document-processing path. Patch availability is indicated only through the Oracle Critical Patch Update advisory; no exact fixed version is stated in the available data.
Authenticated integrity compromise of Oracle WebCenter Content: Imaging 14.1.2.0.0 is achievable over the network through the product's SOAP web-service interface, where a low-privileged account can create, delete, or modify critical Imaging data without any user interaction. Confidentiality and availability are untouched - the entire CVSS 3.1 base score of 6.5 derives from a High integrity impact with PR:L, AC:L, and AV:N, meaning the only real barrier is holding valid low-tier credentials. There is no CISA KEV listing and no public exploit identified at time of analysis, so risk is concentrated in environments where the Imaging SOAP endpoint is broadly reachable by multi-tenant or delegated users rather than in mass internet-wide scanning.
Integrity compromise in Oracle JD Edwards EnterpriseOne Homebuilder 9.2 lets a low-privileged, authenticated attacker reach the Homebuilder Management component over JDENET and create, delete, or modify critical business data at will. Only version 9.2 is listed as affected, and the flaw is rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) - no confidentiality or availability impact, but total loss of integrity for data the account can reach. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and the attacker must already hold valid credentials, so this is not anonymously exploitable.
Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) contain an input-handling weakness in the 2D component that a remote, unauthenticated attacker can reach over the network through multiple protocols, resulting in unauthorized creation, deletion or modification of critical data plus a partial denial of service. Oracle rates the flaw 'difficult to exploit' (CVSS 3.1 6.5, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L), so success depends on conditions the attacker cannot directly control - in practice the target must route attacker-supplied data into the 2D APIs, or run untrusted code inside the Java sandbox via applets or Web Start. No public exploit code or active exploitation was identified at time of analysis, and this is a patch-on-normal-cycle issue rather than an emergency.
Unauthenticated network attackers can cause a hang or frequently repeatable crash of Oracle MySQL Server and MySQL Cluster and make limited unauthorized data changes through the Server: Pluggable Auth component. Affected releases are MySQL Server 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1, plus MySQL Cluster 8.0.0 through 8.0.49, 8.4.0 through 8.4.12, 9.7.0 through 9.7.3, and 26.7.0 through 26.7.1. Oracle rates exploitation as difficult (CVSS 6.5, AC:H), and no public exploit identified at time of analysis; risk is highest where MySQL network ports are exposed to untrusted networks.
Unauthorized creation, deletion, or modification of data in Oracle BIEE's BI Search component affects versions 8.2.0.0.0 and 12.2.1.4.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) describes an unauthenticated network attacker who must convince another user to interact with crafted HTTP content; impact is integrity-only, with no confidentiality or availability loss. This is a moderate-priority issue rather than a top-tier one, and no public exploit code was identified at time of analysis.
Authenticated low-privileged attackers with network reachability to the JDENET service can crash or repeatedly hang Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 (E1 Dev Platform Tech on UNIX), producing a complete denial of service. The CVSS 3.1 score is 6.5, with impact confined to availability (A:H) and no confidentiality or integrity effect; exploitation requires valid low-privileged credentials (PR:L) and no user interaction (UI:N). No public exploit code identified at time of analysis, and the CVE is not reported in CISA KEV; EPSS was not supplied.
Denial of service in Oracle MySQL Server and MySQL Cluster 9.7.0 through 9.7.3 allows an authenticated low-privileged attacker with network access to crash or hang the database via crafted queries against the Server: Optimizer component. Oracle rates the issue as easily exploitable (CVSS 3.1: 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), with impact limited to availability. No public exploit code or CISA KEV entry was identified in the provided intelligence at time of analysis.
Oracle Agile PLM 9.3.6’s Application Server component exposes an HTTP-reachable, unauthenticated path that can yield full read access to PLM-accessible data plus limited insert/update/delete capability, rated CVSS 3.1 6.5. The vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) means no credentials or user interaction are required, but Oracle’s 'difficult to exploit' rating and AC:H indicate attackers must satisfy server-state or timing preconditions beyond their direct control. No public exploit code or CISA KEV entry was identified in the available intelligence at time of analysis, and availability is not impacted.
Unauthenticated HTTP access to Oracle Siebel CRM's Open UI in versions 17.0 through 26.9 can let an attacker read and modify a limited subset of application data, with CVSS 6.5 reflecting partial confidentiality and integrity impact and no availability effect. The flaw is remotely reachable without credentials or user interaction, so exposed Open UI endpoints are the main exposure point; Oracle's October 2026 Critical Patch Update advisory is the listed vendor reference, and no public exploit has been identified at time of analysis.
Partial confidentiality and integrity compromise is possible in Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) through the Libraries component, which can be driven to mishandle attacker-supplied data via multiple network protocols by a remote attacker who needs no credentials or user interaction. Successful exploitation yields unauthorized read access to a subset of data plus unauthorized update, insert or delete capability, with no availability impact (CVSS 3.1 base 6.5, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). The practical exposure depends on whether a deployed application passes untrusted input into the affected Libraries APIs (or, in the legacy case, runs sandboxed Web Start/applet code); no public exploit code is identified at time of analysis and the issue is not listed on CISA KEV, so the medium score reflects constrained, partial impact rather than absence of a network attack path.
Unauthenticated network attackers can access or modify data in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 through the Monitoring and Diagnostics SEC component, although high attack complexity makes reliable exploitation difficult. The issue is reachable over HTTP and carries a CVSS 3.1 score of 6.5 with high confidentiality and low integrity impact; no public exploit identified at time of analysis and no CISA KEV entry is present in the provided data.
Unauthorized data access and limited data modification are possible in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 through the Content Server component. Unauthenticated remote attackers with HTTP network reachability can exploit this difficult-to-execute flaw to read critical content and modify some data, with CVSS 6.5 reflecting high confidentiality and low integrity impact. No public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Authentication bypass in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets a remote, unauthenticated attacker reach critical application data over HTTP and make limited unauthorized changes to it. Oracle rates the flaw 'difficult to exploit' - the CVSS 6.5 score pairs a high attack-complexity rating (AC:H) with no authentication or user-interaction requirements (PR:N/UI:N), so practical risk is concentrated in internet-facing PeopleSoft portals that depend on the Security component for access control. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the referenced Oracle Critical Patch Update is the vendor's fix vehicle.
Authentication bypass in the WebLogic component of Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 lets unauthenticated, network-positioned attackers read critical application data and make limited unauthorized data changes over TLS. Oracle classifies the issue as difficult to exploit (CVSS AC:H), meaning success hinges on specific server state or configuration conditions rather than a single reliable request. No public exploit identified at time of analysis; the vendor advisory is Oracle's October 2026 Critical Patch Update.
Oracle Agile PLM 9.3.6 leaves critical product lifecycle data exposed through its Application Server component, which can be reached over a TLS connection by an unauthenticated attacker who can then read, and to a lesser degree modify, records the application can access (CVSS 3.1 base 6.5, C:H/I:L/A:N). Oracle classifies the flaw as difficult to exploit (AC:H), so success depends on conditions outside the attacker's control such as specific server state, timing, or deployment-specific knowledge rather than a single reliable request; no user interaction is required and impact stays within the application's own scope. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation is materially constrained for deployments where the Application Server is segmented away from untrusted networks. Oracle published the fix in its October 2026 Critical Patch Update.
Oracle Helidon 4.0.0 through 4.5.5 and 27.0.0 can be driven by unauthenticated network attackers to disclose a limited subset of Helidon-accessible data and cause partial denial of service in the helidon-webclient-websocket component. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L), and no public exploit was identified at time of analysis; exploitation requires the application to use the WebSocket client and to initiate connections toward endpoints an attacker can influence. This is a moderate-severity issue suited to normal patch-cycle remediation rather than emergency response.
Information disclosure in Oracle Siebel CRM Deployment (Server Infrastructure) versions 17.0 through 26.9 allows a low-privileged authenticated attacker with HTTP network access to read critical data accessible to the Siebel CRM Deployment component. The vendor CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so impact is limited to confidentiality with no integrity or availability effect; no public exploit was identified at time of analysis and no CISA KEV entry is present. Although the source tags call this an authentication bypass, the assessed vector requires a valid low-privileged Siebel account, making network exposure and account privilege the primary risk factors.
Oracle JD Edwards EnterpriseOne Tools builds 9.2.0.0 through 9.2.26.5 expose a confidentiality weakness in the Web Runtime SEC component reachable over the JDENET protocol, letting an authenticated low-privileged attacker read data well beyond their intended authorisation scope - up to all EnterpriseOne Tools-accessible data. Rated CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the bug is easy to trigger once valid credentials and network access to JDENET exist, and no user interaction is required. Exploitation status: no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was supplied in the available intelligence; the realistic risk is concentrated in deployments that expose JDENET broadly and permit loosely governed low-privilege ERP accounts.
Oracle Siebel CRM Cloud Applications 22.3 through 26.9 can expose sensitive tenant data, potentially all data accessible to that tenant, to an authenticated low-privilege user through the Siebel Cloud Manager component. The issue is remotely reachable over HTTP with low attack complexity and no user interaction, and impact is confidentiality-only (CVSS 3.1 base 6.5; PR:L). No public exploit identified at time of analysis.
Information disclosure in Oracle iSupport, the customer self-service module of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), lets a low-privilege account holder read data well beyond their intended scope - up to and including all data the iSupport Service Requests component can reach - over plain HTTP. Oracle's October 2026 Critical Patch Update credits the flaw with a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning no user interaction and no special conditions beyond a valid self-service login; there is no integrity or availability impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied, so the practical risk scales with how many low-privilege iSupport accounts exist and whether the portal is internet-facing - this is a moderate, authenticated data-exposure issue rather than an unauthenticated emergency.
Unauthenticated remote access to Oracle Siebel CRM Deployment Server Infrastructure in versions 17.0 through 26.9 can allow a network attacker to read a limited subset of deployment data and update, insert, or delete some records over HTTP. The CVSS 3.1 score is 6.5 with low confidentiality and integrity impact and no availability impact, and the available Oracle tagging identifies an authentication-bypass condition. No public exploit code or CISA KEV entry was identified at time of analysis, so this is a moderate patching priority rather than an emergency.
Unauthenticated attackers with network access over HTTP can exploit the LDAP component in Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 to read a subset of accessible data and to perform unauthorized inserts, updates, or deletes. The CVSS 3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), with no availability impact, and no public exploit was identified at time of analysis. Risk is concentrated on internet-facing or otherwise reachable PeopleTools web tiers; internal-only or segmented deployments are materially less exposed.
Oracle Java SE (8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1 and 27), Oracle GraalVM for JDK (17.0.20.1, 21.0.12.1) and Oracle GraalVM Enterprise Edition (21.3.19.1.1) expose a flaw in the Security component that lets a network-reachable, unauthenticated attacker achieve partial read and partial modify access to data accessible through those APIs, with no availability impact. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, score 6.5), exploitation requires no privileges and no user interaction, but the JVM must actually process attacker-influenced input through the affected APIs - typically a web service that supplies data to them - or, in the legacy client case, run untrusted code inside a sandboxed Java Web Start application or applet. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical attack surface is narrower than the score implies because Java Web Start and the browser applet plugin are absent from modern JDKs.