Low-privileged attackers who can reach Oracle Enterprise Manager for Siebel over HTTP can escalate to full takeover of the product's Configuration Management component in versions 13.5 and 24.1, per Oracle's October 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning no user interaction and low attack complexity, but a valid low-privileged account is a hard prerequisite. No public exploit code and no confirmed active exploitation were identified at time of analysis; EPSS and KEV data were not available in the supplied intelligence, so real-world risk currently rests on the intrinsic severity and the niche deployment footprint of the Siebel management plug-in.
Authenticated low-privileged attackers can take over Oracle Enterprise Manager Base Platform 13.5 and 24.1 through the Agent Next Gen component over HTTP. The flaw is easily exploitable (CVSS 8.8, AC:L/UI:N) once any low-privilege account is obtained and the management interface is reachable, with high confidentiality, integrity, and availability impact. No public exploit was identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the remediation reference.
Google Chrome before 156.0.8078.47 contains an improper input validation flaw that can let a remote attacker who convinces a victim to load a crafted HTML page potentially execute arbitrary code inside the browser sandbox. The issue is network-reachable, low-complexity, and requires no privileges, but exploitation depends on user interaction (visiting the malicious or compromised page); resulting execution is confined to the renderer/browser sandbox unless chained with a separate sandbox escape. No public exploit code or CISA KEV entry was identified at time of analysis.
A use-after-free in Chrome's TrustedWebActivities component on Android allows remote code execution inside the renderer sandbox when a victim loads a crafted HTML page in Chrome for Android versions prior to 156.0.8078.47. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects an unauthenticated, network-reachable flaw that nevertheless requires user interaction - the victim must navigate to or render attacker-controlled content - so no zero-click path is present in the available data. Successful exploitation yields high-confidentiality, high-integrity code execution confined to the sandboxed renderer process; escaping the sandbox to compromise the underlying Android device would require chaining a separate sandbox-escape vulnerability. No public exploit code has been identified at time of analysis, and Google rates the issue Chromium security severity Medium despite the 8.8 base score.
Chrome for Android before 156.0.8078.47 carries a high-priority WebGL use-after-free that can let a remote, unauthenticated attacker execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. The CVSS 8.8 vector requires user interaction (UI:R) but no privileges (PR:N), and the Unchanged scope plus the vendor's 'inside the sandbox' wording mean full device compromise would need a separate sandbox-escape chain. No public exploit identified at time of analysis, and Google has released 156.0.8078.47 as the vendor fix.
Improper input validation in Chrome's WebShare component allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the renderer sandbox in any build prior to 156.0.8078.47, triggered when a victim opens a crafted HTML page. The primary limiting factor is user interaction (UI:R) - the victim must navigate to attacker-controlled content - and the resulting code execution stays confined to the sandbox, so host compromise would additionally require chaining a separate sandbox-escape flaw that is outside this CVE. Chromium's own security team rates the issue Medium despite a CVSS 3.1 base score of 8.8; no public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch (156.0.8078.47) is available.
Memory corruption in Google Chrome's browser component allows a remote attacker who convinces a victim to load a crafted HTML page to potentially execute arbitrary code inside the Chrome sandbox on any desktop build prior to 156.0.8078.47. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) confirms no authentication or privileges are needed, but user interaction is mandatory, so this is not a zero-click issue. Impact is materially limited by the fact that code execution is confined inside the sandbox (S:U) and would need chaining with a separate sandbox-escape bug for host compromise; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and Google assigned Chromium severity Medium despite the 8.8 CVSS base score.
Use-after-free in Google Chrome's WebProtect component affects builds prior to 156.0.8078.47 and lets an unauthenticated remote attacker execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The impact is confined to the sandboxed browser process unless a separate sandbox-escape flaw is chained, and user interaction is required. No public exploit identified at time of analysis, and Google has released a fixed build.
Use-after-free in Google Chrome's WebAppInstalls component, affecting versions prior to 156.0.8078.47, lets an unauthenticated remote attacker execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page; the CVSS vector requires user interaction (UI:R) and does not require privileges (PR:N). The 8.8 CVSS rating contrasts with Google's Low Chromium severity because the code execution is confined to the renderer sandbox and full host compromise would require a separate sandbox escape. No public exploit was identified at time of analysis, and Google has released Chrome 156.0.8078.47 as the fixed build.
Use-after-free in Google Chrome's WebUI layer allows a remote attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page, affecting all Chrome builds prior to 156.0.8078.47 on desktop and ChromeOS. Successful exploitation requires user interaction (UI:R) but no authentication or privileges (PR:N), and the resulting code execution is confined to the renderer sandbox, so full host compromise would require chaining with a separate sandbox-escape flaw. Rated 8.8 (High by Chromium standards), the bug carries no public exploit code and no confirmed active exploitation (no CISA KEV entry) at time of analysis, and Google has shipped a fixed build.
Arbitrary code execution inside the Google Chrome renderer sandbox is possible when a victim loads a crafted HTML page in any desktop Chrome build prior to 156.0.8078.47. The CVSS vector requires user interaction (UI:R) but no authentication (PR:N), and successful exploitation is contained by the renderer sandbox; host compromise would require a separate sandbox-escape flaw. Chromium's Low severity rating conflicts with the 8.8 CVSS score, no public exploit was identified at time of analysis, and a vendor patch is available in 156.0.8078.47.
Authenticated low-privileged attackers can take over Oracle Applications Manager in Oracle E-Business Suite 12.2.3 through 12.2.15 over HTTP, with high confidentiality, integrity, and availability impact. The flaw is network-reachable, requires no user interaction, and has low attack complexity, but it is not unauthenticated: an attacker must already hold a valid low-privileged account on the EBS instance. No public exploit was identified at time of analysis, and no CISA KEV entry or EPSS score was supplied; the main barrier to mass exploitation is the authentication prerequisite.
Oracle ZFS Storage Appliance Kit 8.8 can be taken over by a low-privileged, authenticated attacker who can reach the appliance's HTTP management interface, with full confidentiality, integrity, and availability impact. Exploitation is network-reachable, low complexity, and requires no user interaction, but valid low-privilege credentials are required; no public exploit was identified at time of analysis. The authentication prerequisite and the appliance's typical placement on internal management networks are the main practical constraints.
Authenticated low-privileged users can take over Oracle Agile Product Lifecycle Management for Process 6.2.4 through the Product Quality Management component, achieving full confidentiality, integrity, and availability compromise (CVSS 8.8). Oracle describes the flaw as easily exploitable and requiring no user interaction, so a valid low-tier account or compromised low-privileged credentials is the main prerequisite. No public exploit code or confirmed active exploitation was identified at time of analysis.
Privilege escalation in Oracle Database 23ai (versions 23.4.0 through 23.26.3) allows a low-privileged database account holding the DBMS_VECTOR privilege to take over the RDBMS over Oracle Net, with full confidentiality, integrity, and availability impact (CVSS 3.1 base score 8.8). The attack is network-reachable and requires no user interaction, but is gated by the DBMS_VECTOR grant that ships with the Oracle AI Vector Search feature, so environments that do not use vector search or that tightly control this privilege are not exposed to arbitrary low-privileged users. No public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis; Oracle disclosed it in its October 2026 Critical Patch Update.
Authenticated low-privilege users of Oracle PeopleSoft Enterprise SCM Strategic Sourcing 9.2 can achieve full takeover of the Strategic Sourcing component over HTTP, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). Exploitation requires only network reachability to the application tier and a valid low-privilege PeopleSoft account - no user interaction and no elevated privileges - so any provisioned user who can reach the Strategic Sourcing interface could attempt it. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vulnerability is addressed in Oracle's October 2026 Critical Patch Update advisory, and risk is concentrated in internet-exposed or broadly provisioned instances.
Low-privileged authenticated remote attackers can achieve full takeover of applications that embed Oracle Outside In Clean Content SDK 8.5.8 by sending crafted content over HTTP, with high confidentiality, integrity, and availability impact (CVSS 8.8). The flaw affects Oracle Fusion Middleware's Outside In Technology component, and real exposure depends on whether an integrating product accepts attacker-supplied files and passes them to the SDK. All available intelligence is vendor-sourced from Oracle's October 2026 Critical Patch Update; no public exploit code or confirmed active exploitation was identified at time of analysis.
JD Edwards EnterpriseOne Tools versions 9.2.0.0 through 9.2.26.5 contain a takeover-class vulnerability in the Enterprise Infrastructure SEC component that a low-privileged, network-positioned attacker can exploit over HTTP with no user interaction, yielding full confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8). Oracle's CPU October 2026 advisory frames it as easily exploitable, but the PR:L vector means valid low-privilege credentials are a prerequisite, so exposure is concentrated among insiders or attackers who already hold a foothold or stolen account. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied; an attacker who clears the authentication bar can compromise the JD Edwards EnterpriseOne Tools deployment itself.
Low-privileged authenticated users can achieve full takeover of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.5) by sending crafted HTTP requests to the Monitoring and Diagnostics SEC component, gaining high impact across confidentiality, integrity, and availability (CVSS 3.1 base score 8.8). No user interaction or elevated privileges are required - only a valid low-tier account and network reachability to the EnterpriseOne Tools HTTP interface - making any compromised or over-provisioned service account a viable launch point. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the low attack complexity and the pre-authentication-free path from a standard account to full compromise warrant prompt patching.
Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 can be fully taken over by a low-privileged authenticated attacker who reaches the OIM Legacy UI over HTTP. The flaw is network-reachable, low complexity, and requires no user interaction, but it is not unauthenticated: any valid low-privilege account is enough. No public exploit was identified at the time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the available vendor reference.
Oracle SOA Suite Fabric Layer can be taken over by low-privileged remote attackers with network access, affecting releases 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 score of 8.8 reflects full confidentiality, integrity, and availability impact; exploitation requires a valid low-privilege account (PR:L), but no user interaction and low attack complexity make it straightforward once credentials or a session are obtained. Available intelligence does not identify public exploit code or CISA KEV active exploitation at time of analysis.
Full takeover of Oracle SOA Suite is achievable by authenticated low-privilege attackers who can reach the Fabric Layer over HTTP in versions 12.2.1.4.0 and 14.1.2.0.0. The flaw is network-reachable, low-complexity, and requires no user interaction, with high confidentiality, integrity, and availability impact once a valid low-privilege account is obtained. No public exploit code or CISA KEV entry is identified in the supplied intelligence; vendor fixes are referenced through Oracle's October 2026 Critical Patch Update advisory.
Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 can be fully compromised by an authenticated low-privileged attacker who reaches the Fabric Layer over HTTP; successful exploitation affects confidentiality, integrity, and availability and can lead to takeover of the SOA Suite deployment (CVSS 8.8). The flaw is easily exploitable once a valid low-privileged account exists, so exposure is bounded by credential possession rather than anonymity. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Oracle Business Process Management Suite 12.2.1.4.0 and 14.1.2.0.0 ship a flaw in the BPM Composer component that lets any low-privileged, network-reachable account over HTTP take full control of the BPM Suite instance, with high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The gating factor is authentication: exploitation requires a valid low-privilege credential and no user interaction, so exposure is concentrated in deployments that broadly issue accounts or where credentials can be phished or reused. No public exploit code was identified at time of analysis, and the issue is fixed in Oracle's October 2026 Critical Patch Update; risk is elevated because the barrier to entry is a single ordinary user session rather than administrative access.
Authenticated low-privileged attackers can take over Oracle Service Bus 14.1.2.0.0 by reaching its HTTP interface, with high confidentiality, integrity, and availability impact (CVSS 8.8). Only the 14.1.2.0.0 Core component is listed as affected, and Oracle characterizes the flaw as easily exploitable; no public exploit identified at time of analysis and no CISA KEV entry was provided. The authentication requirement is the main barrier, so exposure is greatest where Service Bus HTTP endpoints are reachable by users who can obtain even minimal valid credentials.
Low-privileged authenticated attackers with network HTTP access can exploit the Oracle Service Bus Core component to achieve takeover of the service, with high confidentiality, integrity, and availability impact (CVSS 8.8). Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 are affected, and exploitation requires a valid account but no user interaction; no public exploit code was identified at time of analysis. The authentication prerequisite limits exposure compared with unauthenticated flaws, but default deployments reachable over HTTP remain at risk from any low-privilege user.
Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 expose a high-severity flaw in the Core component that lets a low-privileged, network-positioned attacker take over the service bus, with full impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). Exploitation is straightforward once credentials exist - no user interaction, low attack complexity, HTTP-reachable - but it is not unauthenticated: the attacker must already hold a valid low-privilege account on the target (PR:L). At time of analysis there is no CISA KEV listing and no public exploit code identified, so this is a credible high-priority patch target rather than an emergency, and the practical risk is dominated by how freely low-privilege accounts can be obtained and how exposed the HTTP interface is.
Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 allows an authenticated low-privileged attacker with network access to its HTTP interface to take over the service, with high confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation requires valid low-privileged credentials and reachability to a Service Bus HTTP endpoint, but no user interaction and low attack complexity; default supported configurations appear affected. No public exploit identified at time of analysis.
Takeover of Oracle GoldenGate is possible through its Admin Server Executable, where a low-privileged authenticated attacker with HTTPS network access can achieve high confidentiality, integrity, and availability impact (CVSS 8.8). Affected deployments are GoldenGate 19.1.0.0.0 through 19.32.0.0, 21.3 through 21.23, and 23.4 through 23.26.3.0.0, while instances patched to the October 2026 CPU fix level are not exposed. No public exploit code has been identified at time of analysis, but low attack complexity and network reachability make timely patching important.
Takeover of JD Edwards EnterpriseOne Tools is possible for low-privileged attackers who can reach the JDENET service on affected versions 9.2.0.0 through 9.2.26.5. The flaw is in the Interoperability SEC component and has a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring a valid low-level account or an existing authenticated foothold rather than anonymous access. No public exploit identified at time of analysis; Oracle's October 2026 Critical Patch Update advisory is the reference source.
Low-privileged users who can reach the JDENET service on Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can escalate to full takeover of the EnterpriseOne Tools instance, affecting confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the Database and Comm SEC component, requires only network reachability plus a valid low-privilege account, and needs no user interaction or elevated rights, making attack complexity low. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible high-priority issue but not a drop-everything emergency; the practical constraint on attackers is possession of credentials and exposure of JDENET.
Authenticated low-privileged attackers with HTTP access to the Oracle BI EE Analytics Server can take over affected 8.2.0.0.0 and 26.01.0.0.0 installations, with high confidentiality, integrity, and availability impact (CVSS 8.8). Exploitation requires a valid low-privilege account (PR:L) but no user interaction and low complexity; no public exploit was identified at time of analysis.
Low-privileged authenticated users can achieve full takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 through the OIM Legacy UI component, which is reachable over HTTP and requires no victim interaction. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects complete loss of confidentiality, integrity and availability, but exploitation is gated on an attacker already holding a valid low-privilege OIM account plus network reachability to the deployed Legacy UI - unauthenticated external exploitation is not indicated by the assessed vector. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so the practical risk is highest for environments where the Legacy UI is exposed to broad network segments or where low-privilege accounts are weakly governed.
Authenticated takeover of Oracle Identity Manager is achievable through the OIM Legacy UI component: a holder of any low-privileged account who can reach the instance over HTTPS can escalate to full control of confidentiality, integrity, and availability (CVSS 8.8). Only versions 12.2.1.4.0 and 14.1.2.1.0 of the Fusion Middleware product are listed as affected, and no user interaction or special attack conditions are required beyond that minimal foothold. Oracle resolves the issue with the October 2026 Critical Patch Update; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, but the low complexity and high payoff make unpatched, lower-trust-accessible deployments a priority.
An authenticated low-privileged user who can reach the Oracle Contract Lifecycle Management for Public Sector HTTP endpoints in Oracle E-Business Suite can achieve full takeover of the CLM module's data and functionality - a complete loss of confidentiality, integrity and availability scored at CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Only instances running the Award/PO component of CLM for Public Sector on releases 12.2.3 through 12.2.15 are exposed, and the attack requires a valid account (PR:L) with no user interaction and low complexity once that prerequisite is met. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle typically withholds technical detail until customers have patched, so the absence of exploit reporting should not be read as low risk for internet-facing or broadly accessible EBS deployments.
Oracle Solaris 11.3 and 11.4 can be fully compromised - confidentiality, integrity, and availability - by an authenticated low-privileged attacker who can reach the HTTP-exposed Utility component, per Oracle's October 2026 Critical Patch Update. The CVSS 3.1 base score of 8.8 reflects network reachability (AV:N), low attack complexity (AC:L), and no user interaction (UI:N), gated only by the PR:L requirement for an existing low-privilege account on the host; successful exploitation is described by Oracle as leading to takeover of the operating system. No public exploit code has been identified and there is no CISA KEV listing at time of analysis, but the modest preconditions mean exposed Solaris estates should treat this as a high-priority patching item.
Takeover of Oracle Product Hub is possible for a low-privileged authenticated attacker with HTTP access to the Internal Operations component in Oracle E-Business Suite 12.2.3 through 12.2.15. The flaw carries CVSS 3.1 score 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning any valid low-tier session can reach the vulnerable component without user interaction and potentially gain full control of confidentiality, integrity, and availability. No public exploit code or CISA KEV entry was identified at time of analysis, but the low attack complexity and authenticated network vector make it a credible priority for exposed EBS deployments.
Oracle Product Hub in Oracle E-Business Suite 12.2.3 through 12.2.15 can be taken over by an authenticated low-privileged attacker with HTTP network access, enabling high impact to confidentiality, integrity, and availability of the component. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) shows low attack complexity and no user interaction once a valid low-privileged account is obtained, making this a genuine high-priority issue. No public exploit identified at time of analysis and no CISA KEV entry or EPSS score was provided in the supplied intelligence, but Oracle has published an October 2026 CPU advisory for remediation.
Any authenticated low-privilege user who can reach the HTTP interface of Oracle Product Hub (the Internal Operations component of Oracle E-Business Suite) can take full control of the module, with high impact on confidentiality, integrity, and availability (CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U). Deployments of E-Business Suite 12.2.3 through 12.2.15 running Product Hub are in scope, and because attack complexity is low and no user interaction is required, a single valid low-privilege session is sufficient to attempt exploitation - the real barrier is first obtaining EBS credentials and network reachability to the endpoint. No public exploit code and no CISA KEV entry were identified at time of analysis, so this is a credible mid-to-high priority patching item rather than an emergency, but the low bar for a credentialed insider or compromised account keeps it worth scheduling promptly.
Authenticated low-privileged users can achieve full takeover of the Oracle Engineering Change Management component in Oracle E-Business Suite 12.2.3 through 12.2.15 over HTTP, with high impact to confidentiality, integrity, and availability (CVSS 8.8, PR:L/AC:L/UI:N). The flaw is easily exploitable once a valid EBS account is obtained; no public exploit code or confirmed active exploitation is identified in the available intelligence. Risk is greatest for internet-exposed EBS instances or environments where low-privilege accounts are readily available.
Oracle Applications Manager, the diagnostics and management console bundled with Oracle E-Business Suite 12.2.3 through 12.2.15, can be fully taken over by a low-privileged attacker who has network access to its HTTP interface. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is remote, low-complexity, requires no user interaction, and yields high confidentiality, integrity, and availability impact once a valid low-privilege EBS account is obtained. There is no public exploit code and no CISA KEV confirmation at time of analysis, but the low bar (PR:L, AC:L, UI:N) and the internal-facing nature of many Diagnostics deployments make this a high-priority patching item in the October 2026 Oracle Critical Patch Update.
Authenticated low-privilege users can take over Oracle Mobile Field Service in Oracle E-Business Suite 12.2.3 through 12.2.15 by sending crafted HTTP requests, and the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) scores 8.8 because a single valid low-privilege account yields full confidentiality, integrity, and availability impact on the component. No user interaction and no non-default configuration are required, so the practical barrier is holding or obtaining any valid EBS account; risk rises sharply where the EBS login interface is internet-exposed or low-privilege accounts are numerous or easily obtained. No public exploit code or CISA KEV entry was identified at time of analysis, but this remains a genuine high priority for organizations running the affected E-Business Suite releases.
Oracle E-Business Suite Mobile Field Service 12.2.3 through 12.2.15 is exposed to takeover through its Internal Operations component by an authenticated, low-privileged attacker with HTTPS network access; the CVSS 3.1 score is 8.8 with high confidentiality, integrity and availability impact and no user interaction. Exploitation requires valid credentials but no special configuration, and no public exploit was identified at time of analysis. Organizations running the listed EBS releases should treat this as high priority because a low-privileged account can compromise the product's confidentiality, integrity and availability.
Application takeover in Oracle Mobile Field Service, the field-service module of Oracle E-Business Suite 12.2.3 through 12.2.15, is achievable over HTTP by any attacker who already holds a low-privilege application account. Because no user interaction is required, attack complexity is low, and the vector leaves scope unchanged while scoring high across confidentiality, integrity and availability (CVSS 3.1 base 8.8), a single compromised technician or contractor login is enough to pivot into full control of the module rather than a narrow data leak. Exploitation-signal data is thin: the issue is not in CISA KEV, no public exploit code has been identified at time of analysis, and no EPSS score was supplied, so priority should be driven by the technical profile and by whether the module is actually deployed - the authentication prerequisite is the main limiting factor, while the prevalence of low-privilege EBS accounts is the main aggravating one.
Oracle Mobile Field Service in Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated low-privileged attacker with network access via HTTPS to compromise the application, leading to full takeover with high confidentiality, integrity, and availability impact. The vulnerability is easily exploitable (CVSS 8.8) but requires a valid low-privileged account; no public exploit code has been identified at time of analysis.
Authenticated low-privileged users can fully compromise Oracle Mobile Field Service in Oracle E-Business Suite 12.2.3 through 12.2.15, achieving high confidentiality, integrity, and availability impact (CVSS 8.8, AV:N/PR:L, no user interaction). The flaw resides in the Internal Operations component and is reachable over HTTPS, so only EBS deployments that actually run Mobile Field Service are exposed. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, but low attack complexity combined with the existing-credential requirement makes this a realistic privilege-escalation path for an insider or a compromised low-privileged account.
Authenticated low-privileged attackers can achieve takeover of Oracle Mobile Field Service in Oracle E-Business Suite 12.2.3 through 12.2.15 by reaching the Internal Operations component over HTTP. The flaw is remotely exploitable with low complexity and no user interaction, yielding high confidentiality, integrity, and availability impact; it requires a valid low-privileged account (PR:L) rather than anonymous access. No public exploit identified at time of analysis, and no CISA KEV entry is present in the provided intelligence; Oracle addresses the issue in its October 2026 Critical Patch Update.
Authenticated low-privileged users can achieve takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 by sending crafted HTTP requests to its Product Quality Management component, with high confidentiality, integrity and availability impact. The vulnerability is network-reachable at low attack complexity, requires no user interaction, and is limited in the provided data to version 6.2.4; exploitation still requires a valid low-privilege account, so exposure depends on how widely such accounts are issued and whether the application is internet-facing. No public exploit identified at time of analysis; nevertheless, the 8.8 score and post-authentication takeover potential make it a high-priority remediation item.
Authenticated low-privileged users can achieve full takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 through its HTTP interface in the Product Quality Management component. The flaw has a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning high confidentiality, integrity, and availability impact once a valid account is obtained, with no user interaction required. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle's October 2026 Critical Patch Update advisory is the primary remediation reference.
SQL-layer compromise in Oracle Siebel CRM's Life Sciences eDetailing component, affecting versions 17.0 through 26.9, allows an authenticated low-privileged attacker with network access to execute SQL against the application and achieve full takeover, with high confidentiality, integrity, and availability impact. The vendor-assigned CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating a low-complexity, no-user-interaction attack once low privileges are obtained; no public exploit identified at time of analysis.