Attackers positioned on the physical or adjacent communication segment serving Siebel Cloud Manager can bypass authentication and reach critical data held in Oracle Siebel CRM Cloud Applications 22.3 through 26.9. No credentials and no user interaction are needed (PR:N/UI:N), but the vendor rates the attack as difficult (AC:H) and confines it to AV:A, so it is not reachable over the open internet and the impact is scored at 5.9 with high confidentiality and low integrity consequences. No public exploit code was identified and the issue is not listed on CISA KEV at the time of analysis, making mass or remote exploitation impractical.
An authentication-bypass issue in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 (Enterprise Infrastructure SEC component) lets an unauthenticated attacker positioned on the same physical or adjacent network segment read critical data and perform limited unauthorized updates, inserts, or deletes. The CVSS 3.1 score is 5.9 (AV:A/AC:H/PR:N/UI:N/C:H/I:L/A:N): no credentials or user interaction are required, but exploitation depends on non-deterministic conditions and local-segment access, so arbitrary internet attackers are not realistically exposed. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, making this a moderate rather than high priority.
Remote denial of service in Apple macOS allows an attacker who controls the network file server to crash the target system through an integer underflow triggered by crafted server responses. Affected releases are macOS versions before Golden Gate 27, Sequoia 15.8, and Tahoe 26.7; the CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, reflecting a high-complexity network attack with availability-only impact. No public exploit was identified at time of analysis, EPSS is low at 0.17% (percentile 6%), and Apple has released fixed versions.
Denial-of-service in Apple's iOS and iPadOS (26.x releases before 26.7, and versions before 27) allows an attacker who already holds a privileged on-path network position to degrade or halt availability on the target device; there is no confidentiality or integrity impact (CVSS 5.9, C:N/I:N/A:H, AC:H/PR:N/UI:N). Exploitation is gated by the on-path precondition - the attacker must already sit on the traffic path as a man-in-the-middle - so this cannot be triggered by an arbitrary remote Internet attacker against a device behind normal network boundaries, and no public exploit code was identified at time of analysis. Affected devices are fixed by updating to iOS/iPadOS 26.7 or 27.
Local low-privileged users on hosts running Oracle VM VirtualBox 7.2.16 can cause a complete denial of service-hang or frequently repeatable crash-of the VirtualBox Core component, with scope change potentially affecting other host products, but only when a second user performs a triggering action. This moderate-severity flaw requires local logon and human interaction, is not remotely reachable, and affects availability only; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Server-side request forgery in the A2A Java SDK before 1.3.0.Final allows an unauthenticated caller to register an attacker-chosen push-notification destination and make the server send task updates to loopback, private, link-local, cloud-metadata, IPv6 unique-local, or multicast addresses where routing permits. Push notifications are enabled by default, and the vulnerable BasePushNotificationSender sends to the stored TaskPushNotificationConfig URL without scheme restrictions, destination validation, or redirect bounds, although the attack is blind because responses are discarded and delivery success is not exposed. No public exploit was identified at time of analysis; the issue is rated CVSS 5.8 (medium, CWE-918) and is fixed in 1.3.0.Final.
Unauthenticated network attackers can read a limited subset of Oracle Siebel CRM Cloud Applications data through the Siebel Cloud Manager component in versions 22.3 through 26.9. Oracle rates this CVSS 3.1 5.8 (Medium) with AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N, reflecting a low-complexity HTTP attack that requires no credentials or user interaction and can affect resources beyond the vulnerable component while only exposing confidentiality. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Unauthenticated HTTP requests to the PeopleSoft Enterprise PeopleTools Web Server component in versions 8.61 through 8.63 can return a subset of PeopleTools-accessible data that the requester should not be able to read, so internet- or intranet-exposed PeopleSoft portals are directly at risk. Oracle scored it CVSS 3.1 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N): no credentials, no user interaction and no special configuration are needed, but the impact is confidentiality-only - no data modification and no availability effect - and the scope change means exposed data may extend beyond PeopleTools into connected products. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied with the available intelligence.
Unauthenticated information disclosure in Oracle Helidon 4.0.0 through 4.5.5 can expose a subset of Helidon-accessible data when the helidon-integrations-vault component is deployed and reachable over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) confirms remote exploitation without credentials or user interaction, with limited confidentiality impact and a scope change that may extend disclosed data to other components. No public exploit code or confirmed active exploitation was identified at time of analysis, and deployments that do not use the Vault integration are not affected.
Unauthenticated HTTP requests can read a limited subset of Helidon-protected application data in Oracle Helidon 4.0.0 through 4.5.5 and 27.0.0 when the helidon-security-providers-jwt component is used, because the JWT security provider can be bypassed. The CVSS 3.1 score of 5.8 reflects network reachability, low attack complexity, no privileges or user interaction, and a scope change with low confidentiality impact; no public exploit code was identified at time of analysis.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 allows a high-privileged, authenticated attacker who can reach the Report Distribution component over HTTP to obtain unauthorized access to critical PeopleTools-accessible data, with possible scope expansion to additional products. The CVSS 3.1 score is 5.8 with high attack complexity (AC:H) and high privileges required (PR:H), so this is not reachable by an anonymous remote user; no public exploit was identified at time of analysis.
Authenticated local users on hosts running Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 can abuse the Analytic Server component to gain unauthorized create, delete, and modify access to critical PeopleTools data, read a subset of that data, and trigger a partial denial of service. Exploitation is constrained: the CVSS vector (AV:L/AC:H/PR:L/UI:N) requires an existing low-privilege logon to the underlying infrastructure plus runtime conditions outside the attacker's control, so realistic risk is well below what the 5.8 base score suggests. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; Oracle addresses it in its October 2026 Critical Patch Update.
Cleartext credential disclosure in the A2A Java SDK prior to 1.3.0.Final writes push-notification bearer tokens and authentication credentials into server logs: when JsonFormat.parser().merge() throws InvalidProtocolBufferException, RestHandler.parseRequestBody logs the entire JSON request body at SEVERE level instead of just the error. The leak is reachable only when push notifications are enabled, via authenticated requests to /v1/tenants/{tenant}/tasks/{taskId}/pushNotificationConfigs whose token and authentication.credentials fields carry secrets for client push endpoints, and only when the body is valid JSON that fails protobuf deserialization (for example an unknown field under strict parsing or a schema mismatch). An actor with read access to the server logs or the log-aggregation/SIEM system can recover those credentials and use them to send forged task status updates to the client's push endpoint; the patch (1.3.0.Final) replaces the body dump with a logged body length, and no public exploit code was identified at time of analysis.
A2A Java SDK releases prior to 1.3.0.Final leak configured API key credentials to attacker-controlled third-party servers: the default JDK-based client trusts the header name declared in a remote agent's AgentCard and, because JdkA2AHttpClient follows cross-origin redirects, an agent-controlled redirect can carry that credential-bearing custom header to an arbitrary host even when the standard Authorization header is stripped. The issue is unauthenticated from the attacker's perspective (PR:N in the assessed CVSS:3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, scored 5.7), but exploitation is conditional: the client must use CredentialService to store an API key for the agent's APIKeySecurityScheme, must use the default JDK HTTP transport, and must connect to a malicious or compromised agent that controls both its AgentCard and its redirect response. Impact is confidentiality-only and scoped to the leaked credential; the fix is the vendor-released 1.3.0.Final, and no public exploit code or active exploitation (CISA KEV) was identified at time of analysis.
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 allows a high-privileged local attacker who can log on to the host to modify or delete critical data and cause a hang or repeatable crash, while confidentiality is not impacted. Exploitation is assessed as difficult (AC:H) and requires prior high-privileged logon access to the infrastructure where JDeveloper executes; no public exploit identified at time of analysis.
OGNL versions before 3.4.13 can be tricked into executing blocked operations through Java reflection when an application evaluates attacker-controlled OGNL expressions under the optional stricter-invocation sandbox and a permissive MemberAccess. The bypass uses java.lang.reflect.Method, Constructor, or Field as a proxy so the real call runs inside JDK reflection without a second stricter-invocation check; applications that use a restrictive MemberAccess, including Apache Struts with SecurityMemberAccess, are not affected. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation requires the specific stacked configuration described rather than default hardened deployments.
Account-level Azure SAS tokens are written into every public attachment URL by uploadfs - the storage abstraction used by ApostropheCMS - whenever the Azure backend is configured with sas: true, so anyone who can load a single published attachment can silently harvest credentials for the entire backing storage account. Versions 1.25.0 through 1.27.x are affected; remote attackers need no authentication and no user interaction, but exposure is conditional on that specific Azure configuration, which is why the vendor scores it 5.6 with AC:H while our analysis scores the same vector at 8.8 (S:C/C:H/I:H/A:H) given the account-wide blast radius of the leaked secret. No public exploit code or confirmed active exploitation has been identified at time of analysis, and uploadfs 1.28.0 fixes the issue by no longer embedding the SAS query string in the client construction path.
Oracle Essbase 21.8.3.0.0 contains a difficult-to-exploit unauthenticated network vulnerability in its Security component reachable through T3 and IIOP listeners. A remote attacker who can reach those interfaces and satisfy a high-complexity precondition could read a limited subset of data, perform unauthorized insert, update, or delete operations, and cause a partial denial of service; no public exploit code or active exploitation has been identified at time of analysis. The moderate CVSS 3.1 score of 5.6 reflects limited confidentiality, integrity, and availability impact combined with high attack complexity.
Oracle Enterprise Manager Base Platform 13.5 and 24.1 contains a difficult-to-exploit Security Framework flaw that allows unauthenticated network attackers with HTTP reachability to gain limited read and write access to some data and cause a partial denial of service. The CVSS 3.1 score is 5.6 with high attack complexity, reflecting that successful exploitation depends on conditions outside the attacker's control. No public exploit code or active exploitation is identified in the available intelligence, so this is a moderate, lower-priority issue rather than a critical emergency.
Information disclosure in Oracle Helidon's helidon-security-providers-idcs-mapper component allows a low-privileged attacker who already holds a local logon on the host running the application to read critical data beyond their intended authorization, with a scope change meaning other products consuming the Helidon service can also be impacted. Only Helidon 3.0.0-3.2.21 and 4.0.0-4.5.5 deployments that actually use the IDCS (Oracle Identity Cloud Service) security provider/role-mapper integration are exposed, and exploitation requires a difficult, non-deterministic precondition (CVSS 3.1 5.6, AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N). This is a moderate, not high, real-world priority: there is no remote reachability, no public exploit identified at time of analysis, and no confirmed active exploitation (not in CISA KEV), so the practical risk is concentrated in multi-tenant or shared-host deployments where untrusted users already have local accounts. Note that community tagging labels this an authentication bypass, consistent with the confidentiality-only, access-control-flavored impact, but no CWE was published with the CVE.
Denial of service in Oracle VM VirtualBox 7.2.16 can be triggered by a low-privileged user who already has local logon access to the host running VirtualBox. Exploitation is rated difficult and requires a specific non-trivial condition in the Core component, but a successful attack can crash or repeatedly hang VirtualBox and, because of the scope change, may affect other products on the same infrastructure. No public exploit was identified at time of analysis, and impact is limited to availability.
Oracle PeopleSoft Enterprise PeopleTools 8.61 through 8.63 exposes a data-disclosure and partial denial-of-service weakness in the Updates Change Assistant component that can be triggered over HTTP with low attack complexity. Exploitation requires the attacker to already hold high (administrative) privileges inside PeopleTools (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L, base 5.5), so the realistic threat actor is a privileged insider or an adversary who has already compromised an administrative account rather than an unauthenticated outsider. Successful abuse yields unauthorized access to critical - potentially all - PeopleTools-accessible data plus a partial availability impact, with no integrity impact and no user interaction required; no public exploit code or confirmed active exploitation was identified at time of analysis, and the moderate score reflects the heavy PR:H constraint rather than a lack of technical exploitability.
SQL injection in Osclass through 8.3.1 lets remote attackers manipulate the sPattern argument handled by Item::findUserItems() in oc-includes/osclass/model/Item.php, allowing arbitrary SQL to be injected into the item-listing/search query so the attacker can read or alter database contents. The CVSS:4.0 score of 5.5 with an assessed CVSS:3.1 vector of AV:N/AC:L/PR:N/UI:N/SC:L/I:L/A:N indicates unauthenticated, low-complexity network exploitation with limited confidentiality and integrity impact; publicly available exploit code exists, though it is not confirmed as actively exploited (no CISA KEV entry). No vendor fix is identified - VulDB reports the vendor was contacted early and did not respond - so exposure persists for any reachable instance at version 8.3.1 or earlier.
High-privileged network attackers can force hangs or repeatable crashes and read a limited subset of data in Oracle MySQL Server and MySQL Cluster versions 9.7.0 through 9.7.3 and 26.7.0 through 26.7.1. The issue is in the Server: Security: Encryption component and requires an existing high-privilege MySQL account, so anonymous or low-privileged remote users are not sufficient. Oracle assigned CVSS 3.1 base score 5.5, and no public exploit identified at time of analysis; the referenced Oracle Critical Patch Update advisory is the primary source.
Authenticated, high-privileged users of MySQL Server and MySQL Cluster (versions 9.7.0-9.7.3 and 26.7.0-26.7.1) can trigger a flaw in the InnoDB storage engine over the network to hang or repeatedly crash the database and to modify or delete some accessible data. Because exploitation requires DBA-level privileges (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H, base score 5.5), realistic risk is concentrated on malicious insiders or attackers who have already stolen administrative credentials; confidentiality is not affected. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied, so this is a moderate-priority availability and data-integrity issue rather than an emergency.
PeopleSoft Enterprise PeopleTools 8.61 and 8.62 contain a flaw in the Query component that a high-privileged, authenticated attacker can reach over HTTP to cause repeatable denial of service and limited unauthorized data reads or modifications. Oracle rates it CVSS 3.1 5.5 with high attack complexity and high privileges required, and no public exploit identified at time of analysis.
Unexpected system termination can be triggered in Apple macOS by a locally running malicious or compromised app that exploits insufficient size validation in an unnamed system component, affecting versions prior to macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. This is a local-only availability flaw rated CVSS 5.5 with a low EPSS score of 0.21% (11th percentile); no public exploit code or confirmed active exploitation was identified at time of analysis.
Local denial of service in the Python `filelock` package (versions 3.20.4 through 4.2.0) allows a second local account to stall or hang lock acquisition through `ReadWriteLock` by planting a crafted SQLite lock database at the database path; the library loads the database schema without bounding the schema or query work, so an oversized schema burns past the acquire timeout. Only local attackers holding a valid account are relevant (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5), and the outcome is availability loss only - no confidentiality or integrity impact - though the practical triggerability depends on the lock database living in a directory other accounts can write, which is precisely the condition the fix addresses. Exposure occurs on the initial per-instance database open for 3.20.4 and later, and repeats on every acquisition from 3.30.0 onward, so the hang is more reliably reproducible on newer releases. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; a vendor-released patch is available in 4.2.1.
Local information disclosure in Apple macOS allows a malicious application already running with user privileges to read sensitive user data that should be protected by secure input state handling. The flaw affects macOS releases before Golden Gate 27, Sequoia 15.8, and Tahoe 26.7, and exploitation requires the attacker to first get an app installed and executing locally, with no remote or network-based path. Apple has released fixes, EPSS is low at 0.17% (6th percentile), and no public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in Apple macOS allows a locally executing application to read sensitive user data that should be protected by macOS access controls. The flaw affects macOS versions before Golden Gate 27, Sequoia 15.8, and Tahoe 26.7, and exploitation requires local code execution with low privileges and no user interaction. It is not confirmed actively exploited (CISA KEV), no public exploit was identified at time of analysis, and EPSS is low at 0.17%, so risk is moderate and primarily relevant where untrusted apps can run on macOS hosts.
Improper access-control validation in Apple's operating systems lets a locally installed app read protected user data that should be off-limits to it. The flaw affects iOS and iPadOS before 27, macOS Tahoe before 26.7 and macOS Golden Gate before 27, and visionOS before 27; exploitation requires an attacker to first get a crafted app onto the device, since the vector is local with low privileges (AV:L/PR:L) and no user interaction beyond launching the app (UI:N). Impact is confidentiality-only (C:H/I:N/A:N) with a CVSS base score of 5.5, EPSS is low at 0.16% (5th percentile), CISA SSVC records no exploitation, and no public exploit code has been identified at time of analysis.
macOS can expose sensitive network connection information to a locally installed, low-privileged app because of improper state management in affected releases. The flaw affects macOS versions before Sequoia 15.8, Tahoe 26.7, and Golden Gate 27, and Apple has released fixes. No public exploit code or active exploitation has been identified; EPSS is 0.16% (5th percentile), indicating low predicted exploitation risk.
Double-free memory corruption in Apple's iOS/iPadOS, macOS, tvOS, visionOS and watchOS lets a locally installed app trigger an unexpected system termination by driving a vulnerable system code path - a crash-only denial of service with no confidentiality or integrity impact per the assessed vector. The flaw affects every release prior to the fixed builds (iOS/iPadOS 26.7 and 27, macOS Sequoia 15.8, macOS Tahoe 26.7 and macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27) and requires the attacker to already be running code as an app on the device, so it is neither remotely reachable nor automatable (CISA SSVC: Exploitation none, Automatable no, Technical Impact partial). No public exploit code was identified at time of analysis, and Apple has shipped vendor fixes; this is a moderate, availability-only issue rather than an urgent patching priority.
Local users with only low-level logon privileges on a host running Oracle TimesTen In-Memory Database 22.1 through 22.1.1.43.0 can read critical database contents they are not entitled to see, giving them complete read access to all TimesTen data reachable from that instance. The flaw is easily triggered once an attacker already holds a foothold on the machine (AV:L/PR:L, no user interaction) but cannot be reached over the network, and it affects confidentiality only - no writes, corruption, or service disruption. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor has published a fix through the October 2026 Critical Patch Update.
Local low-privileged users with logon access to hosts running Oracle Utilities Network Management System can read critical application data across affected 2.4.0.1.x, 2.5.0.1.x, 2.5.0.2.x, 2.6.0.1.x, 2.6.0.2.x, and 25.12.0.0.x releases. The issue is rated CVSS 5.5 with confidentiality-only impact; exploitation requires an existing local account (AV:L/PR:L) and low complexity, not remote or unauthenticated access. No public exploit code or CISA KEV entry was identified in the provided data, so this is a moderate-priority patching item rather than an emergency.
Siebel Cloud Manager, a component of Oracle Siebel CRM Cloud Applications 22.3 through 26.9, can expose critical or complete application-accessible data to a low-privileged user who already has logon access to the infrastructure where the product runs. The assessed CVSS 3.1 vector is local (AV:L), low-privilege authenticated (PR:L), no user interaction, with high confidentiality impact and no integrity or availability impact, making this a moderate-risk insider or post-foothold issue rather than a remotely exploitable one. No KEV status is provided, and no public exploit identified at time of analysis.
Apple visionOS before version 27 contains an authorization state-management flaw that lets a locally installed app read sensitive user data. The issue requires attacker-controlled code already running as a low-privilege app, has no user-interaction requirement at exploit time, and is fixed in visionOS 27. No public exploit was identified at time of analysis, and EPSS is 0.15% (4th percentile).
Oracle BRM 15.x can expose critical billing and revenue data to a low-privileged user who already has local logon access to the BRM Server host. The flaw affects Oracle Communications Billing and Revenue Management versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0; per the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) it is a local, authenticated, low-complexity confidentiality-only issue rather than remote unauthenticated access. No public exploit was identified at time of analysis.
Oracle Fusion Middleware's Remote Diagnostic Agent component, within Oracle Middleware Common Libraries and Tools, allows a low-privileged user who already has local logon access to the host to read critical data, affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 5.5 vector is confidentiality-only (C:H/I:N/A:N) and requires local authenticated access (AV:L/PR:L/UI:N), with no remote network path. No public exploit has been identified at time of analysis.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.9 expose confidential data to any low-privileged user who can log on locally to the host where the Siebel server infrastructure runs. No user interaction or elevated privileges are needed, and a successful attack yields read access to critical Siebel CRM Deployment data with no integrity or availability impact (CVSS 3.1 base 5.5, C:H/I:N/A:N). No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical barrier remains that the attacker must already hold a local account on the Siebel server host.
WebCenter Content: Imaging 12.2.1.4.0 and 14.1.2.0.0 can disclose critical data to a high-privileged attacker who already has logon access to the hosting infrastructure and can induce a different user to interact with the attack. Oracle rates this local, scope-changing flaw CVSS 5.5 with confidentiality-only impact; no public exploit was identified at time of analysis. Intelligence feeds tag it as an authentication bypass, but the authoritative vector requires high privileges and user interaction, so it is not a remote unauthenticated path.
Local low-privileged users on a Siebel CRM Deployment host can read critical or all Siebel-accessible data through a confidentiality-only flaw in the Server Infrastructure component, tracked as CVE-2026-101462 with a CVSS 3.1 base score of 5.5. The issue affects supported Siebel CRM Deployment versions 17.0 through 26.9 and requires an existing authenticated local account with logon to the affected infrastructure, so the realistic attacker set is insiders or someone who already has a foothold on the Siebel server. No public exploit code or CISA KEV entry is present in the supplied intelligence; no public exploit identified at time of analysis.
Oracle Siebel CRM's Marketing component (Siebel Apps - Marketing) in versions 17.0 through 26.9 exposes critical Marketing data to a locally authenticated low-privileged attacker; successful exploitation yields high confidentiality impact but no integrity or availability impact. The attack requires logon to the infrastructure hosting the component and needs no user interaction, so risk is concentrated among malicious insiders or attackers with an existing foothold. No public exploit code or CISA KEV active exploitation is identified in the supplied data.
Oracle GoldenGate exposes critical data to any low-privileged user who can log on to the host running the product, through a weakness in the Vendor Access Module component. Affected builds span three release trains: 19.1.0.0.0 through 19.32.0.0, 21.3 through 21.23, and 23.4 through 23.26.3.0.0; successful exploitation yields high confidentiality impact with no integrity or availability effect (CVSS 3.1 base 5.5). The attack path is strictly local and authenticated (AV:L/PR:L), so external unauthenticated attackers cannot reach it directly, and there is no public exploit identified at time of analysis - a moderate-severity data-exposure issue rather than a mass-exploitable emergency.
Local information disclosure in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 lets a low-privileged user who can log on to the host running OIM reach critical data through the Installer component, with a high confidentiality impact and no integrity or availability effect. Because the vector is strictly local (AV:L) and requires a valid low-privileged account (PR:L) with no user interaction (UI:N), this is primarily an insider or post-compromise risk rather than a remotely reachable attack surface. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update; it is rated medium severity at CVSS 3.1 base 5.5.
Information disclosure in Siebel CRM Deployment 17.0 through 26.9 lets a low-privileged attacker who can log on locally to the deployment server read critical data accessible to the Server Infrastructure component. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms local, authenticated access is required and that only confidentiality is affected; there is no remote or unauthenticated path. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE.
Local, authenticated low-privileged access to the host running Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 can be abused through the Web Runtime SEC component to disclose critical or all accessible application data (CVSS 3.1 score 5.5, confidentiality-only). The attacker must already have a valid low-privileged account with logon access to the infrastructure, so there is no unauthenticated network path and no integrity or availability impact; no public exploit code was identified at time of analysis.
Low-privileged local users can read critical data from JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 via the Monitoring and Diagnostics SEC component, according to the Oracle October 2026 CPU. The assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) requires an existing interactive logon on the host running the affected Tools, so this is not a remote or unauthenticated authentication bypass despite the supplied 'Authentication Bypass' tag. No public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data.
Local, low-privileged users who can log on to a host where Oracle JDeveloper 12.2.1.4.0 or 14.1.2.0.0 is installed can read critical data exposed through the ADF Faces component, giving them access to anything the JDeveloper process can reach (CVSS 5.5, confidentiality-only). The attacker must already hold a valid account and shell access on the developer workstation or build server running the IDE - this is not network-reachable and cannot be triggered from an unauthenticated position. No public exploit code or confirmed active exploitation was identified at time of analysis, and Oracle addresses the flaw in its October 2026 Critical Patch Update; despite the 'Authentication Bypass' classification tag, the assessed vector makes this a moderate, low-priority issue for most environments.
Local information disclosure in Oracle JD Edwards EnterpriseOne Tools 9.2.0.0 through 9.2.26.5 lets a low-privileged user who can log on to the host read critical data or all EnterpriseOne data accessible through the Installation Security component. The flaw is confidentiality-only, requires authenticated local access, and does not allow remote unauthenticated compromise or modification of data. No public exploit was identified at time of analysis, and EPSS data was not supplied; overall risk is moderate rather than high priority.