Oracle JD Edwards EnterpriseOne Tools (Installation Security component) versions 9.2.0.0 through 9.2.26.5 can be taken over by a remote, unauthenticated attacker who convinces another user to interact with attacker-supplied content delivered over HTTP, yielding high confidentiality, integrity and availability impact (CVSS 3.1 base 8.8). The mandatory victim interaction (UI:R) means delivery depends on social engineering rather than a direct server-side hit, which limits automated mass exploitation. No public exploit code or confirmed active exploitation was identified at time of analysis, so this is a credible high-priority item rather than a drop-everything emergency; the fix ships in Oracle's October 2026 Critical Patch Update.
Low-privileged authenticated attackers can achieve full takeover of Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 by sending SQL against the Dictionary Repository component over the network. Exploitation requires a valid low-privilege ODI account but no user interaction and only low attack complexity, with high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis, and no CISA KEV status was supplied.
Full takeover of MySQL Server and MySQL Cluster is possible for unauthenticated attackers who can reach the Group Replication communication segment, affecting MySQL Server 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1 plus MySQL Cluster 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. The flaw is in the Server: Group Replication GCS component and yields high confidentiality, integrity and availability impact (CVSS 8.8, AV:A/AC:L/PR:N/UI:N). Exploitation is limited to deployments running Group Replication and to attackers on the adjacent physical communication segment; no public exploit was identified at time of analysis and CISA KEV status is not indicated.
Authenticated, high-privilege users of the Advantech ADAM-3600 industrial edge gateway can exploit a command injection flaw in the device’s command-handling functionality to execute arbitrary OS commands with root privileges, achieving full device compromise. The network-reachable flaw has a CVSS 4.0 score of 8.6 (PR:H, UI:N, AC:L) and, per the independent assessment, is not accessible to anonymous remote attackers because valid administrative credentials or a privileged session are required. No public exploit was identified at the time of analysis, and the device’s usual placement inside segmented OT/ICS networks limits exposure, although the exact vulnerable interface and affected firmware versions were not specified.
Origin-policy bypass in Google Chrome before 156.0.8078.47 can let a remote attacker use a crafted HTML page to make unauthorized cross-origin accesses after the victim visits the page. The flaw is a missing authorization check in Chrome's Animation component (CWE-862); it affects default installations and requires user interaction, with no authentication needed. There is no evidence of active exploitation and no public exploit identified at time of analysis; EPSS is 0.24% (14th percentile), and Google has released 156.0.8078.47 as the fixed build.
Improper access control in Google Chrome's ComputePressure component allows a remote, unauthenticated attacker to bypass web origin policy in any build prior to 156.0.8078.47 by getting a victim to open a crafted HTML page. Impact scoring conflicts across sources: the published vector claims 8.8 with high confidentiality and integrity impact, while our own assessment rates it confidentiality-only and low (C:L/I:N/A:N), so the realistic worst case is a limited cross-origin information leak rather than full compromise. No public exploit code has been identified at time of analysis and EPSS sits at 0.24% (14th percentile); the mandatory user interaction keeps mass automation unlikely, which is why it is prioritized for remediation this week rather than treated as an emergency.
Oracle BI Publisher versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0 can be taken over by unauthenticated remote attackers who persuade a victim to interact with a crafted HTTP-delivered resource in the BI Platform Security component. The CVSS 3.1 score is 8.8 with high confidentiality, integrity, and availability impact, but exploitation requires human interaction (UI:R) and network reachability to the BI Publisher endpoint. No public exploit code or CISA KEV confirmation was identified at time of analysis.
Improper access control in the V8 JavaScript engine of Google Chrome builds prior to 156.0.8078.47 lets a remote attacker who convinces a user to load a crafted HTML page potentially bypass web origin policy, compromising the confidentiality and integrity of data across origins. Exploitation needs no credentials (PR:N) but does require user interaction, so unattended mass exploitation is bounded. No public exploit code or CISA KEV entry is present in the supplied data; EPSS is low at 0.23% (14th percentile), and the priority decision is this_week rather than emergency.
Adjacent-network attackers can exploit an installation-security weakness in JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.4 to take over the product, provided a person other than the attacker performs a required interaction; no authentication is needed and the scope change means connected products may also be affected. The CVSS 3.1 score is 8.8, but exploitation is constrained by the AV:A adjacency requirement and UI:R human interaction. No public exploit identified at time of analysis and no CISA KEV entry is present in the available data.
Memory corruption in ANGLE, the graphics translation layer built into Google Chrome, allows a remote attacker to read memory from the browser process when a victim renders a crafted HTML page on any build prior to 156.0.8078.47. Exploitation needs user interaction (the victim must load the page) but no credentials, and the disclosed impact is a confidentiality breach via memory disclosure rather than confirmed code execution, so the independent assessment scores it AV:N/AC:L/PR:N/UI:R/C:H/I:N/A:N rather than the vendor-supplied 8.8 with full integrity and availability impact. Chrome's own severity rating is Medium, EPSS is 0.22% (11th percentile), and no public exploit code has been identified at time of analysis; Google has released a fix in the 156.0.8078.47 stable channel update.
A stack-based buffer overflow in Apple's Bluetooth stack lets an attacker who controls a Bluetooth device already paired with the target run arbitrary code on the device, with high impact to confidentiality, integrity, and availability. Affected are default Bluetooth-enabled configurations of iOS/iPadOS before 26.7 and 27, macOS Sequoia before 15.8, macOS Tahoe before 26.7, macOS Golden Gate before 27, and visionOS before 27; Apple fixed the flaw through improved input validation in iOS 26.7/27, iPadOS 26.7/27, macOS Sequoia 15.8, macOS Tahoe 26.7, macOS Golden Gate 27, and visionOS 27. Exploitation requires a pre-existing pairing and proximity within Bluetooth radio range (CVSS AV:A, PR:N, UI:N), which rules out untargeted internet-scale attacks; EPSS is 0.19% (8th percentile), CISA SSVC records Exploitation: none and Automatable: no, and no public exploit code has been identified at time of analysis.
Memory corruption in Google Chrome's Extensions component lets remote, unauthenticated attackers read memory inside the browser sandbox when a victim loads a crafted HTML page in any build prior to 156.0.8078.47. Exploitation is not zero-click: it requires the user to open the attacker-controlled page (UI:R), and the demonstrated impact is confined to information disclosure within the sandbox rather than code execution or sandbox escape, which is why Chromium rated it Medium severity despite a nominal 8.8 base score. There is no public exploit identified at time of analysis and EPSS is low at 0.18% (8th percentile), while Google has shipped a fixed release in the Stable channel.
Hard-coded credentials in IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 appliances can let an attacker in physical or adjacent-network proximity gain elevated privileges, with CVSS 3.1 score 8.8 reflecting high confidentiality, integrity, and availability impact. The CVSS vector indicates no privileges or user interaction are required (PR:N/UI:N), but the adjacent-network attack vector limits exposure to attackers who can reach the appliance locally or on an adjacent segment. No public exploit code or confirmed active exploitation was identified at time of analysis.
Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 can be taken over by an authenticated, low-privileged attacker who already has a local logon to the host, with scope change potentially affecting other products on that infrastructure. Exploitation is straightforward once local access exists (AV:L/AC:L/PR:L/UI:N/S:C), but it is not remotely reachable without a prior foothold; no public exploit was identified at time of analysis. This is a credible high-priority issue but not an emergency drop-everything item.
Apple Xcode before version 27 fails to enforce library validation on certain bundled binaries, allowing a malicious app already running inside Xcode's sandbox to load untrusted libraries and break out of that sandbox (CVSS 8.8, scope-changed, high confidentiality/integrity/availability impact). Exploitation is strictly local: an attacker must first get code executing on the macOS host - for example through a trojanized developer tool, plugin, or dependency - and the flaw then provides sandbox escape and privilege escalation rather than initial access. Apple addressed the issue by enforcing library validation, shipping the fix in Xcode 27 (available from https://support.apple.com/en-us/149040); no public exploit code and no confirmed active exploitation were identified at time of analysis.
Arbitrary code execution in Apple Safari and WebKit-based components on iOS/iPadOS, macOS, and visionOS can occur when a user processes maliciously crafted web content, due to a type confusion flaw corrected with improved state management. Safari, iOS/iPadOS, macOS, and visionOS versions prior to 27 are affected, while Safari 27, iOS/iPadOS 27, macOS Golden Gate 27, and visionOS 27 contain the fix. The CVSS 3.1 score of 8.8 reflects a network-reachable, low-complexity, unauthenticated attack that requires user interaction (visiting hostile content); no public exploit was identified at time of analysis.
Broken authorization in SolarWinds Observability Self-Hosted allows an authenticated low-privileged user to access and modify information beyond their assigned permissions, with high confidentiality and integrity impact (CVSS 8.8). The flaw is network-reachable and requires only a valid low-privilege session, not pre-authentication, so a compromised or over-provisioned account is sufficient. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Cross-site request forgery in the WordPress VikRentCar plugin through 1.4.8 can make a logged-in privileged user-typically a WordPress administrator-submit unintended VikRentCar actions when tricked into visiting attacker-controlled content. The supplied CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R), but the authoritative assessment constrains realistic impact to integrity only (C:N/I:L/A:N) because the attacker cannot read responses and must rely on victim interaction. No CISA KEV entry or public exploit code was identified in the provided data.
Denial of service in the Eclipse ThreadX NetX Duo Web add-on's HTTP server, which mishandles a `Content-Length` underflow while processing a `PUT` request and ends up dereferencing and freeing an uninitialized pointer. The flaw is reachable by an unauthenticated remote client with a single malformed request (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N), making the realistic outcome a crash of the HTTP service or the whole device (VC:N/VI:L/VA:H) rather than code execution or data exposure. Only deployments that have compiled in and network-exposed the Web add-on's HTTP server are affected; devices running NetX Duo without that component are not exposed, and no public exploit code was identified at time of analysis.
Unauthenticated SQL injection in TYPO3 File Manager allows remote attackers to read database contents through crafted file-search terms, per the CVSS vector's PR:N/UI:N conditions. The extension wraps the search term in quotes but escapes only LIKE wildcards, so an unescaped quote can break out of the quoted value across every searchable field. Impact is confidentiality-only per the independent assessment, and no public exploit is identified at time of analysis; the TYPO3 advisory is the reference for affected and fixed releases.
High-privileged attackers who can reach Oracle Siebel CRM's Deployment Server Infrastructure over HTTP can create, delete, or modify critical data and read all data accessible through that component, with the scope change (S:C) meaning successful exploitation can also affect other connected Oracle products beyond Siebel CRM. Supported releases 17.0 through 26.9 are affected; Oracle rates the flaw CVSS 3.1 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), with confidentiality and integrity fully compromised but no availability impact. The pre-existing administrative privilege requirement (PR:H) is the principal limiting factor, making malicious insiders or already-compromised admin accounts the realistic threat actors; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
High-privileged SOAP access to Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 can be abused to read and modify critical connector data, with scope change extending impact to additional Oracle Fusion Middleware products. The flaw is easily exploitable once an attacker already holds high privileges in the product (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N, 8.7) and requires network reachability to the Connectors and Connector Server component; no public exploit was identified at time of analysis.
SQL injection in YS-infoware BA-Workflow allows authenticated remote attackers with low privileges to read, modify, and delete arbitrary database contents. The CPE wildcard indicates all product versions are affected, and exploitation requires only a valid low-privilege session with no user interaction. No public exploit code was identified at time of analysis.
SQL injection in YS-infoware BA-Workflow lets authenticated remote attackers execute arbitrary SQL statements, enabling them to read, modify, and delete database contents. The issue is rated CVSS 8.7 and affects BA-Workflow deployments matching the version-agnostic CPE supplied by TW-CERT; exploitation requires a valid BA-Workflow account, which limits exposure to users who can authenticate. No public exploit code was identified at time of analysis, and the product's limited deployment base makes this a credible but second-tier priority rather than a broadly urgent Internet-wide threat.
SQL injection in BA-Workflow (YS-infoware) allows authenticated remote attackers with low privileges to inject arbitrary SQL statements and read, modify, or delete database contents. The CVSS 4.0 score is 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), reflecting network reachability, low complexity, no attack requirements, low-privilege authentication, no user interaction, and high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
Oracle Trusted Answer Search 26.1 can allow a low-privileged authenticated attacker with network access to the Application expert UI to create, delete, modify, or read critical data after another user is induced to interact with attacker-supplied content. The CVSS 3.1 score is 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), reflecting high confidentiality and integrity impact and possible scope change to additional products, with no availability impact. No public exploit code or CISA KEV entry was identified at time of analysis, and exploitation requires both an existing low-privileged account and a separate human victim.
Authenticated remote code execution affects Uniong WebITR: a low-privilege user (CVSS PR:L) can forge serialized data using a hard-coded cryptographic key, bypass integrity validation, and trigger insecure deserialization (CWE-502) to run arbitrary code on the server. The network-reachable flaw has high confidentiality, integrity, and availability impact and requires no user interaction. No public exploit code or CISA KEV entry was identified in the provided intelligence at time of analysis.
Incorrect privilege assignment in the CICD-toolchain-for-serverless-applications IAM policy (versions 1.0.7 through 1.0.10) lets an authenticated user who can push to the application source repository escalate privileges beyond the application stack inside the same AWS account. Because the CloudFormation deployment role is not scoped to the application's own resources, an attacker-supplied application template processed by the toolchain pipeline can read or modify unrelated IAM role policies, Secrets Manager secrets, and SSM parameters. Exploitation is gated on repository push rights (CVSS PR:L) and on the pipeline actually deploying the crafted template; no public exploit code and no confirmed active exploitation were identified at time of analysis, and AWS has released 1.0.11 to close the path.
Authorization bypass in Cloudflare Pingora before 0.9.0 can occur only in a chained HTTP/1 deployment where Pingora forwards to a downstream HTTP/1 intermediary that honors Connection-nominated headers and the origin trusts a header Pingora adds, such as X-Forwarded-For. A remote, unauthenticated attacker can use the client Connection header to nominate that trusted header; because the vulnerable HTTP/1 upstream path fails to strip hop-by-hop or nominated headers, the intermediary may remove it and bypass IP-based authorization. No public exploit was identified at time of analysis, Cloudflare CDN customers are explicitly unaffected, and 0.9.0+ default policy removes these headers, so the issue is conditional rather than broadly exploitable.
Authenticated low-privileged users of the Siebel Life Sciences Web UI in Oracle Siebel CRM versions 17.0 through 26.9 can exploit a scope-changing flaw over HTTP to read and modify critical data beyond their own authorization boundary, but only if they can persuade another user to interact with the attack. The CVSS 3.1 score is 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), with high confidentiality and integrity impact and no availability impact. No public exploit was identified at time of analysis, and there is no CISA KEV entry.
Stored content injection in Oracle Applications Framework's Personalization component (Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged authenticated attacker to place malicious content that executes when another user opens the personalized page, causing high confidentiality and integrity impact and possible scope change into other products. The attacker must hold valid credentials and convince a second user to interact with the page, so exploitation is neither self-contained nor unauthenticated. No public exploit code or CISA KEV entry was identified at time of analysis.
Unauthorized read and write access to critical data in Oracle E-Business Suite's Document Management and Collaboration (Attachments) component affects versions 12.2.3 through 12.2.15 and, because of a scope change, can extend to data and resources in other EBS products. A low-privileged authenticated attacker with HTTP access can trigger the flaw, but exploitation requires a different user-typically someone with higher privileges-to interact with attacker-supplied attachment content, so this behaves like a stored/second-order access-control or injection issue (CVSS 8.7; C:H/I:H/A:N) rather than a pre-auth remote compromise. No public exploit code or CISA KEV entry was identified in the available intelligence, and no EPSS score was supplied.
Low-privileged, network-positioned users of PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can abuse the Test Framework component to cross a security boundary and obtain read/write access to critical PeopleTools data, but only if they can persuade another user to interact with attacker-supplied content. The issue is rated CVSS 8.7 with high confidentiality and integrity impact and no availability impact; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied.
Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 can be compromised by unauthenticated, remote attackers through the WebLogic Server Proxy Plug-in component, yielding high confidentiality and integrity impact and - because the CVSS vector carries a scope change (S:C) - potential knock-on impact to systems the plug-in fronts. Oracle rates the attack complexity as high ('difficult to exploit'), so the bug is not reliably repeatable against arbitrary targets and depends on conditions outside the attacker's control, but no authentication (PR:N) or user interaction (UI:N) is required once those conditions are met. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the source data.
Unauthenticated attackers with HTTP network access to a third-party web server (Apache HTTP Server, Microsoft IIS, or Oracle iPlanet) running the Oracle WebLogic Server Proxy Plug-in can bypass authentication and obtain read/write access to critical data reachable through the proxied WebLogic backend. The flaw affects plug-in versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 and carries a CVSS 3.1 score of 8.7 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). Oracle rates exploitation as difficult (AC:H), and no public exploit code or CISA KEV entry was identified in the provided intelligence at time of analysis; EPSS was not supplied.
Unauthenticated attackers with HTTP network access can abuse Oracle Access Manager's Authentication Engine (versions 12.2.1.4.0 and 14.1.2.1.0) to achieve full confidentiality and integrity compromise of OAM-accessible data, with scope change extending impact to federated downstream products. Oracle rates the issue 'difficult to exploit' (AC:H), meaning success hinges on non-trivial environmental or flow-specific conditions rather than a simple request, so this is a serious but conditional risk rather than a point-and-click exploit. No public exploit code or confirmed active exploitation was identified at time of analysis, and no CVE-level patch version is stated beyond Oracle's October 2026 Critical Patch Update advisory. EPSS: not provided.
Unauthenticated network attackers can potentially bypass authentication and read or modify critical data through the Oracle WebLogic Server Proxy Plug-in in supported 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 deployments, although Oracle rates exploitation as difficult (AC:H) and the impact may extend to systems behind the proxy because of scope change. No public exploit identified at time of analysis, and no CISA KEV confirmation was provided, so internet-facing proxy plug-in installations should still be prioritized for review and patching.
Unauthenticated remote attackers can crash the logs management service on Advantech ADAM-3600 industrial RTUs/controllers by sending crafted input that triggers a NULL pointer dereference, denying access to that service until it is restarted. The CVSS:3.1 vector indicates network-reachable, low-complexity exploitation with no privileges or user interaction required, but impact is confined to availability - no code execution, data disclosure, or integrity loss is implied by the flaw itself. No public exploit code or confirmed active exploitation was identified at time of analysis, and practical risk is primarily gated by whether the device's logs management interface is exposed beyond a segmented OT/SCADA network.
Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0, specifically the SAP ERP+ component, exposes an unauthenticated HTTP attack surface that can lead to authentication bypass and unauthorized creation, deletion, modification, or access of critical connector data, with scope change potentially affecting connected systems. The issue is serious but constrained: exploitation is difficult (AC:H) and requires reachable HTTP access to a deployment that actually uses the SAP ERP+ connector. No public exploit identified at time of analysis, and no CISA KEV confirmation was supplied.
Stack-based buffer overflow in Advantech ADAM-3600 can let a remote attacker with administrative credentials execute arbitrary code on the RTU. The flaw is network-reachable and requires no user interaction, but exploitation depends on prior high-privilege access to the management interface and on network reachability, which is often constrained in segmented OT deployments. No public exploit was identified at time of analysis, and active exploitation is not confirmed by CISA KEV.
Cross-site WebSocket hijacking in Google Cloud Shell prior to 2026-07-22 lets an unauthenticated remote attacker hijack an active, authenticated Cloud Shell session and exfiltrate the user's OAuth access token. Exploitation requires the victim to have a live Cloud Shell session and to load an attacker-controlled page that issues a cross-origin WebSocket request, which is the user-interaction precondition reflected in the CVSS vector. Google remediated the hosted service server-side on 2026-07-22, and no public exploit was identified at time of analysis.
Stack-based buffer overflow in Advantech ADAM-3600's FileProcess::CheckDir path handling lets an authenticated attacker with high-privilege access supply a directory path longer than 1024 bytes and potentially achieve arbitrary code execution on the device. The flaw is network-reachable with low complexity and no user interaction once the attacker holds the required high-privilege credentials, but impact is confined to the device with no scope change. No public exploit was identified at the time of analysis, and exploitation is primarily constrained by the high-privilege authentication prerequisite.
Arbitrary code execution on Advantech ADAM-3600 devices is possible for remote attackers who already possess high-privilege credentials for the device's network-reachable management service. The flaw affects ADAM-3600 units exposed to the attacker's network and carries a high CVSS score, but exploitation is not pre-authentication and depends on valid administrative or operator access. No public exploit identified at time of analysis, and the risk is credible but not emergency-level because privileged credentials and network reachability are both required.
Heap out-of-bounds read in the NetX Secure TLS 1.3 Certificate-message parser of Eclipse ThreadX NetX Duo can be triggered by a malicious or man-in-the-middle TLS 1.3 server, crashing the connecting peer. The flaw is unauthenticated (CVSS PR:N) and reachable during the normal handshake, before certificate verification completes, but requires the victim device to act as a TLS client and connect to an attacker-controlled endpoint - an attacker cannot trigger it against an unsolicited listening service. Vendor/independent assessment rates impact as availability-only (CVSS 4.0 base 8.7; CVSS 3.1 AV:N/AC:L/PR:N/UI:N/A:H), and no public exploit code or CISA KEV active-exploitation entry was identified at time of analysis.
A four-byte malformed TLS 1.3 Certificate handshake header can drive the NetX Secure certificate parser in Eclipse ThreadX NetX Duo past the end of its session packet buffer, crashing the device or stack. The flaw is remotely reachable, unauthenticated, and requires no cryptographic validity or user interaction - the parser decrements the message length to skip a certificate_request_context byte without first confirming a byte exists, so a zero-length message wraps the unsigned length to 0xFFFFFFFF and renders the subsequent bounds check vacuous. Impact is bounded to availability (out-of-bounds read leading to fault/denial of service) per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector, and no public exploit code or confirmed active exploitation was identified at time of analysis; the practical exposure limit is that the target must actually negotiate TLS 1.3 and enter the Certificate-message parsing path.
Unauthenticated remote attackers can cause a hang or frequently repeatable crash of Oracle Secure Backup 19.1.0.0.0 and 19.1.0.1.0 by reaching its TCP-exposed service, resulting in complete denial of service with a CVSS 3.1 base score of 8.6 and a scope change that may affect dependent products. This is a genuine high-priority availability risk for environments that run the affected product, but the signals are mixed: no public exploit or CISA KEV entry was provided in the available data, and practical exposure depends on whether the backup service is reachable from untrusted networks. Exploitation requires only network access, with no authentication and no user interaction per the assessed vector.
Oracle E-Business Suite Integrated SOA Gateway releases 12.2.3 through 12.2.15 expose the SOA Provider component to unauthenticated HTTP requests, allowing an attacker with network reachability to read critical data and potentially reach all data accessible through the gateway. The CVSS 3.1 score of 8.6 reflects a scope-changing, confidentiality-only impact (C:H/I:N/A:N) reachable without credentials or user interaction (AV:N/AC:L/PR:N/UI:N/S:C); no public exploit code or confirmed active exploitation was identified at time of analysis. Risk is driven primarily by exposure - only deployments whose SOA Gateway endpoint is reachable from the attacker's network position are at risk.
Oracle Outside In Technology 8.5.8 can expose sensitive data to unauthenticated remote attackers when a host application embedding the Outside In Clean Content SDK parses an attacker-supplied document, producing high confidentiality impact and a scope change into the hosting product. The vendor CVSS 3.1 score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), and no public exploit code or CISA KEV entry was identified at time of analysis.
Unauthenticated remote attackers can read critical data from Oracle JD Edwards EnterpriseOne Tools releases 9.2.0.0 through 9.2.26.5 through the component tracked as Object and Env Tech SEC, with the flaw classified as an authentication bypass affecting the HTTP-facing web tier. The CVSS 3.1 score of 8.6 reflects a network-reachable, low-complexity, no-privileges, no-user-interaction attack that is confidentiality-only but carries a scope change, so downstream systems trusting the Tools layer may also be exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, but the exposure-based risk is high where the JD Edwards HTTP interface is internet-facing or reachable from untrusted segments.
Unauthenticated remote attackers can read sensitive data from Oracle SOA Suite 12.2.1.4.0 and 14.1.2.0.0 through the Fabric Layer over HTTP, with scope change potentially exposing data in connected Oracle products. The flaw is easily exploitable (CVSS 3.1 8.6, AV:N/AC:L/PR:N/UI:N/S:C/C:H) and is limited to confidentiality impact; no public exploit was identified in the provided intelligence at time of analysis.