Authentication Bypass
Monthly
Full system takeover in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 is achievable by a high-privileged, network-authenticated attacker via HTTP against the Deployment component, resulting in complete confidentiality, integrity, and availability compromise. Disclosed as part of Oracle's August 2026 Critical Security Update (CPU) and registered in ENISA EUVD (EUVD-2026-61690), with no confirmed active exploitation or public exploit code at time of analysis. The PR:H prerequisite significantly constrains the attacker population to insiders, compromised administrator accounts, or actors with prior lateral movement to admin-level access.
Data integrity and availability compromise in Oracle Autonomous Health Framework's Trace File Analyzer component affects versions 26 through 26.5.2, permitting high-privileged local attackers to corrupt or destroy critical data and induce a complete denial-of-service condition. Notably, the attack carries a scope change, meaning successful exploitation can cascade to affect additional co-located Oracle products beyond AHF itself. No public exploit code or active exploitation has been identified at time of analysis; Oracle has issued remediation through its August 2026 Critical Patch Update.
Unauthorized data disclosure and partial denial of service in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 is achievable by any low-privileged attacker with network access over HTTP targeting the Deployment component. The combination of a high confidentiality impact and an 'Authentication Bypass' tag from EUVD suggests the flaw may allow authenticated users to escalate access beyond their authorization level, potentially exposing all financial and operational data managed by the platform. No public exploit code or CISA KEV listing exists at time of analysis, though Oracle has addressed this in the August 2026 Critical Security Patch Update.
Local privilege escalation and denial-of-service in Oracle Autonomous Health Framework's Trace File Analyzer component affects versions 26 through 26.5.2, enabling low-privileged infrastructure users to corrupt or destroy critical data and crash the framework with scope change to dependent Oracle products. The CVSS 3.1 score of 8.4 reflects ease of exploitation once local access is obtained, with no user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis; this disclosure originates from Oracle's Critical Security Patch Update for August 2026.
Unauthenticated data compromise in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 (Deployment component) lets a remote attacker over HTTP read, create, modify, or delete all data accessible to the application. Tagged as an authentication bypass and rated CVSS 3.1 9.1, it was reported by Oracle and addressed in the August 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Teleservice (E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged attacker with network access via HTTP, exploiting a flaw in the Service Request Form component. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation is straightforward - no elevated privileges, no user interaction, and no complex preconditions beyond a valid low-privilege account. Oracle's own advisory characterizes the outcome as complete product takeover, implying full loss of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data exposure in Oracle Autonomous Health Framework (Trace File Analyzer component) allows a low-privileged network attacker to gain complete read access to critical data and limited write capability across the framework and potentially connected Oracle products due to a scope-changing exploit path. Affected versions span the entire 26.x release family through 26.5.2, making this a broad exposure across current deployments. No public exploit has been identified at time of analysis, but the low attack complexity, absence of user interaction, and scope-change characteristic elevate real-world priority beyond what the raw CVSS alone conveys.
Oracle Advanced Inbound Telephony versions 12.2.3 through 12.2.15 exposes its Internal Operations component to low-privileged HTTP attackers who can achieve full read access to sensitive telephony data, limited data manipulation, and partial denial of service. The 'Authentication Bypass' tag suggests that while a valid low-privilege account is required to initiate the attack, the Internal Operations component fails to enforce additional authorization controls, allowing privilege escalation within the application. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the vulnerability was disclosed by Oracle's own security team via the August 2026 Critical Patch Update.
Full takeover of Oracle MySQL Cluster is achievable by an unauthenticated remote attacker over HTTP across three active release trains: 8.0.0-8.0.48, 8.4.0-8.4.11, and 9.7.0-9.7.2. The attack carries high complexity and requires human interaction from a victim user, but successful exploitation yields complete confidentiality, integrity, and availability compromise of the cluster. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data exposure in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to gain complete read access to all data accessible by the application, with scope change enabling lateral data exposure across additional Oracle Hyperion ecosystem products. The vulnerability resides in the Deployment component and is exploitable over HTTP without user interaction. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the Authentication Bypass tag from ENISA EUVD signals a likely authorization control weakness that warrants priority patching in enterprise environments.
Unauthenticated remote exploitation of Oracle Advanced Inbound Telephony (versions 12.2.3-12.2.15) within Oracle E-Business Suite allows a network attacker to perform unauthorized creation, deletion, or modification of critical telephony data and cause a partial denial of service via HTTPS. The CVSS 3.1 base score of 8.2 reflects high integrity impact and low availability impact with no confidentiality exposure. No public exploit code or active exploitation (CISA KEV listing) has been identified at time of analysis.
Unauthenticated remote exploitation of Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 allows network attackers to gain complete read access to all application-managed financial data via HTTP, with no credentials or user interaction required. The vulnerability resides in the Deployment component and carries a CVSS scope change, meaning successful exploitation may expose data from additional interconnected Oracle Hyperion products sharing the same infrastructure. No public exploit code or active exploitation has been confirmed, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N profile makes this trivially repeatable once an attacker identifies the vulnerable endpoint.
Full system compromise of Oracle Bills of Material - a component of Oracle E-Business Suite - across versions 12.2.3 through 12.2.15 is achievable by a network-reachable, low-privileged attacker via crafted HTTP requests, with Oracle confirming potential for complete takeover covering confidentiality, integrity, and availability. The scope change designation in the CVSS vector indicates that successful exploitation can cascade beyond the Bills of Material module to affect additional Oracle E-Business Suite components. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Oracle has issued a patch in the August 2026 Critical Patch Update.
Full takeover of Oracle iSetup 12.2.3 through 12.2.15 is achievable by a low-privileged, network-adjacent attacker via HTTP, targeting the General Ledger Update Transform and Reports component within Oracle E-Business Suite. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected instance. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the full-takeover impact (C:H/I:H/A:H) and network accessibility elevate the urgency of patching relative to other Oracle CPU entries in this cycle.
Full takeover of Oracle Sales Foundation (E-Business Suite 12.2.3-12.2.15) is achievable by a low-privileged network attacker via HTTP, targeting the Security API component. The vulnerability is rated CVSS 8.8 with high impact across confidentiality, integrity, and availability, indicating the attacker can gain complete control of the affected application. No public exploit or CISA KEV listing has been identified at time of analysis, though Oracle's classification as 'easily exploitable' elevates urgency for patching.
Unauthorized data access and modification in Oracle Sales Foundation (Oracle E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged, network-authenticated attacker via HTTP, with no user interaction required. The vulnerability resides in the Security API component and is tagged as an authentication bypass, enabling an attacker to read, create, delete, or modify critical data across the entire Sales Foundation dataset. No public exploit code has been identified at time of analysis, and the CVE does not appear in the CISA KEV catalog, though the low exploitation complexity makes this a realistic near-term threat for exposed deployments.
Full system takeover of Oracle Sales for Handhelds (E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged authenticated attacker with HTTP network access, resulting in complete compromise of confidentiality, integrity, and availability. The vulnerability resides in the Internal Operations component and requires no user interaction or elevated privileges beyond a basic account. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad version range make this a credible lateral-movement or privilege-escalation risk within Oracle EBS environments.
Full compromise of Oracle Sales (E-Business Suite component: Internal Operations) is achievable by a low-privileged network attacker via HTTP across versions 12.2.3 through 12.2.15, with successful exploitation resulting in complete takeover - high confidentiality, integrity, and availability impact. The attack is constrained by high complexity (AC:H), meaning reliable exploitation requires meeting specific, non-trivial conditions rather than simple request crafting. Disclosed through Oracle's August 2026 Critical Security Patch Update, no public exploit or active exploitation has been identified at time of analysis.
Local authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an unauthenticated local attacker - one with OS-level logon to the host infrastructure but no Oracle application credentials - to compromise the Security component and gain complete unauthorized read access to all data accessible by Hyperion Calculation Manager. The scope change (S:C) in the CVSS vector confirms that successful exploitation can cascade to impact additional Oracle products co-hosted on the same infrastructure. No public exploit has been identified at time of analysis, and Oracle disclosed this through its August 2026 Critical Patch Update.
Full takeover of Oracle Trading Community within Oracle E-Business Suite is achievable by unauthenticated remote attackers via HTTP, targeting the Party Search UI component across versions 12.2.3 through 12.2.15. The Oracle-reported CVSS vector confirms network accessibility with no privilege or user-interaction requirement, though high attack complexity (AC:H) indicates exploitation is non-trivial and likely requires precise conditions such as timing, specific request sequencing, or environment-dependent state. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Unauthorized read and write access to critical data in Oracle Agile Engineering Data Management 6.2.1 is achievable by low-privileged network attackers targeting the Engineering Communication Interface (ECI) component via HTTP, with successful exploitation yielding high confidentiality and integrity impact (C:H/I:H) that can cascade to additional Oracle products via scope change. The 'Authentication Bypass' tag in reporter intelligence suggests the flaw enables attackers to exceed their granted access level within the ECI, despite requiring an initial low-privileged foothold. Oracle addressed this in the August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote exploitation of the File Transmission component in Oracle Payments (E-Business Suite 12.2.3-12.2.15) allows network-accessible attackers over HTTP to gain complete read access to all Oracle Payments data and perform limited unauthorized write operations. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 8.2, and the Authentication Bypass tag confirms no credentials are required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-prerequisite attack profile makes this a high-priority patching target for any organization running Oracle EBS with the Payments module active.
Unauthorized data access and modification in Oracle Payables (E-Business Suite versions 12.2.3-12.2.15) is exploitable by any low-privileged authenticated attacker with HTTP network access, enabling full compromise of Payables confidentiality and integrity. The vulnerability resides in the Internal Operations component and is tagged as an authentication bypass, indicating that access-control deficiencies allow a low-privileged account holder to read or manipulate critical financial data-including supplier invoices, payments, and transaction records-beyond their intended authorization scope. No public exploit code and no CISA KEV listing exist at time of analysis; however, the low attack complexity, vendor-confirmed CVSS 8.1, and sensitive financial data at stake make this a meaningful priority for Oracle EBS environments.
Remote denial-of-service in Oracle Payables (E-Business Suite versions 12.2.3 through 12.2.15) allows unauthenticated network attackers to crash or hang the Payables service via HTTP, completely disrupting accounts payable operations. Oracle describes the flaw as 'easily exploitable' with no authentication requirement, and the vendor-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) corroborates full availability impact with minimal attacker effort. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Oracle Critical Patch Update for August 2026 confirms the issue and provides remediation.
Unauthorized data access and modification in Oracle Payments (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 is achievable by unauthenticated remote attackers via HTTPS targeting the File Transmission component. The vulnerability, tagged as an Authentication Bypass, enables full confidentiality and integrity compromise of Oracle Payments data - allowing attackers to read, create, delete, or modify all accessible payment records. Exploitation is rated 'difficult' (AC:H) and no active exploitation has been identified in CISA KEV at time of analysis, though the zero-prerequisites authentication bypass warrants urgent patching given the financial data exposure.
Local privilege escalation in Oracle Agile Engineering Data Management 6.2.1 allows a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the system via the Engineering Communication Interface component. Exploitation requires high-complexity conditions and local access, but successful attacks result in complete takeover - full loss of confidentiality, integrity, and availability. Disclosed through Oracle's Critical Security Patch Update for August 2026; no public exploit identified at time of analysis.
Unauthenticated network exposure in Oracle Payments (E-Business Suite versions 12.2.3 through 12.2.15) allows remote attackers to access all data handled by the File Transmission component without credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network reachability with no authentication or user interaction required. Tagged as an authentication bypass, this flaw yields complete confidentiality loss over Oracle Payments data; no public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes exploitation straightforward once a target instance is reachable.
Unauthorized data access and manipulation in Oracle Payments (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 is achievable by a network-adjacent, high-privileged attacker exploiting a flaw in the File Transmission component via HTTP. Successful exploitation produces a scope change, meaning compromise extends beyond Oracle Payments to additional E-Business Suite products, enabling complete confidentiality and integrity compromise of critical payment data. No public exploit or active KEV listing is identified at time of analysis; however, the 'Authentication Bypass' tag supplied by the reporter suggests internal authorization controls within the File Transmission component can be subverted despite the high-privilege initial access requirement.
Oracle Payments versions 12.2.3 through 12.2.15, within Oracle E-Business Suite, expose a flaw in the File Transmission component that permits a high-privileged HTTP attacker to bypass internal access controls and achieve full confidentiality and integrity compromise of payment data, with confirmed scope change cascading impact to additional integrated EBS modules. The vendor-assigned 'Authentication Bypass' tag creates a notable tension with the PR:H CVSS metric, suggesting the bypass operates within Oracle EBS's internal authorization layer - circumventing role-based data access controls - rather than defeating the perimeter authentication mechanism. No public exploit code or active exploitation has been identified at time of analysis; remediation is available via Oracle's August 2026 Critical Security Patch Update.
Unauthorized data disclosure in Oracle Marketing Encyclopedia System (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to gain complete read access to all data accessible by the application component. The vulnerability carries a scope change, meaning successful exploitation can impact resources beyond the immediately compromised component. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the tags attribute 'Authentication Bypass' suggesting the low-privilege barrier may be weaker in practice than the PR:L CVSS metric implies.
Full system takeover of Oracle Agile Engineering Data Management 6.2.1 is achievable by unauthenticated attackers who can reach the physical network segment hosting the EDM hardware, specifically via the Engineering Communication Interface (ECI) component. The CVSS vector (AV:A/AC:H/PR:N) confirms adjacency is mandatory and complexity is high, constraining realistic exposure to internal networks or co-located infrastructure. No public exploit code or active exploitation has been identified at time of analysis; this is patched under Oracle's August 2026 Critical Security Patch Update.
Full system takeover of Oracle HRMS (US) versions 12.2.3 through 12.2.15 is achievable by a highly privileged network attacker exploiting a flaw in the US Payroll - General component via HTTP. The CVSS scope change (S:C) means a successful compromise can cascade into additional Oracle E-Business Suite modules beyond HRMS itself, amplifying the blast radius significantly. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis; remediation is addressed in Oracle's Critical Patch Update for August 2026.
Complete takeover of Oracle Essbase 21.8.1.0.0 is possible by an unauthenticated remote attacker over HTTP, per Oracle's August 2026 Critical Patch Update. Oracle rates it CVSS 9.8 with full confidentiality, integrity, and availability impact and flags it as 'easily exploitable,' meaning no authentication, no user interaction, and low attack complexity are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of network reach and unauthenticated takeover makes it a high-priority patch candidate.
Full system takeover in Oracle Essbase 21.8.1.0.0 is achievable by any low-privileged authenticated user with network access via HTTP, targeting the Calculator component. The CVSS 3.1 score of 8.8 reflects complete impact across confidentiality, integrity, and availability (C:H/I:H/A:H), consistent with Oracle's own classification of this as 'easily exploitable.' No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network vector make this a credible and accessible exploitation path for any valid account holder.
Unauthorized data disclosure in Oracle Marketing 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to fully compromise confidentiality of all Oracle Marketing-accessible data via the Audience component over HTTP. The vulnerability carries a scope change, meaning successful exploitation can ripple into additional Oracle E-Business Suite products beyond Marketing itself. Tagged as an Authentication Bypass by the reporting source, no public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle General Ledger (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged, network-accessible attacker via HTTP, requiring no user interaction and minimal exploitation complexity. The vulnerability resides in the Internal Operations component and results in complete compromise of confidentiality, integrity, and availability of the General Ledger application. No public exploit code or active exploitation has been identified at the time of analysis, but the vendor's own 'easily exploitable' characterization combined with the broad affected version range makes this a high-priority patch for all Oracle EBS deployments.
Local authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables unauthenticated local attackers to access critical application data and perform limited data modification, with a confirmed scope change that can propagate impact to additional co-deployed Oracle Hyperion products. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) classifies this as easily exploitable once local infrastructure access is obtained, requiring no application credentials. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Remote takeover of Oracle Enterprise Manager Base Platform is achievable by unauthenticated network attackers via HTTP targeting the Agent Next Gen component in versions 13.5 and 24.1. Despite the high attack complexity requirement (CVSS AC:H), successful exploitation yields complete compromise - high confidentiality, integrity, and availability impact, effectively full platform control. No public exploit or active exploitation has been identified at time of analysis, but the Oracle CPU August 2026 advisory documents this as a supported-version vulnerability requiring immediate attention.
Full takeover of Oracle Applications DBA within Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible via an unauthenticated, network-based HTTP attack targeting the JRI and associated Java utility components. Exploitation is rated difficult (CVSS AC:H) and requires human interaction from a legitimate user, but successful compromise yields complete loss of confidentiality, integrity, and availability of the affected component. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Oracle's August 2026 Critical Patch Update addresses this issue.
Oracle Applications DBA, the administrative component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, exposes critical internal operations over HTTP to low-privileged attackers. Successful exploitation enables unauthorized access to critical or complete data accessible by the Applications DBA component, along with the ability to trigger partial denial-of-service conditions against the same component. No public exploit has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog, though the low complexity and broad network accessibility make it a meaningful risk in unpatched EBS deployments.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a flaw in its Security component that enables a network-accessible, low-privileged attacker to compromise the application via HTTP when a legitimate user is induced to interact with malicious content. Successful exploitation results in complete unauthorized read access to all data within Calculation Manager and limited write capability, with a confirmed scope change that may extend impact to other interconnected Oracle Hyperion EPM products. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the 'Authentication Bypass' tag sourced from EUVD metadata suggests the root cause involves bypassing higher-privilege access controls within the Security component after initial low-privilege authentication.
Unauthorized data modification, partial denial of service, and limited data exposure in Oracle Hyperion Calculation Manager 11.2.25.0.000 are achievable by unauthenticated remote attackers over HTTP targeting the Security component. The CVSS 3.1 score of 7.0 reflects high integrity impact - attackers can create, delete, or modify critical EPM data - tempered by high attack complexity (AC:H) that prevents trivial automated exploitation. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Oracle Reports Developer 14.1.2.0.0, a component of Oracle Fusion Middleware, allows unauthenticated remote attackers to fully compromise the system via a network-accessible HTTP attack against its Security and Authentication component. Successful exploitation results in complete takeover - achieving high confidentiality, integrity, and availability impact - consistent with full control over the affected instance. No public exploit code has been identified at time of analysis, and exploitation requires high attack complexity (AC:H), meaning real-world exploitation depends on meeting specific non-trivial preconditions.
Authentication bypass in Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows a remote unauthenticated attacker to reach and compromise the reporting service over HTTP, exposing critical data and enabling partial data modification. The scope-changing flaw (CVSS 3.1 9.3) can also significantly impact adjacent products beyond Reports Developer itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low-complexity, no-privilege, no-interaction profile makes it high priority.
Oracle Reports Developer 14.1.2.0.0 contains an authentication bypass in its Security and Authentication component that permits unauthenticated, network-based attackers to achieve both complete data disclosure and unauthorized modification of critical data over HTTP. The vulnerability requires no credentials or user interaction, though the high attack complexity (AC:H) means exploitation demands precise conditions or crafted request sequences. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network reach combined with dual high-impact outcomes warrants urgent remediation for any internet-exposed or untrusted-network-accessible deployments.
Oracle Reports Developer 14.1.2.0.0 contains an authentication bypass flaw in its Security and Authentication component that allows a low-privileged network attacker to gain unauthorized read and write access to all data managed by the application over HTTP. Rated 8.1 CVSS with low attack complexity and no user interaction required, this represents a significant confidentiality and integrity risk for any organization with Oracle Reports Developer exposed on a network-accessible interface. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Reports Developer 14.1.2.0.0 is exposed to a full system takeover through an authentication bypass (CWE-284) in its Security and Authentication component, exploitable by unauthenticated attackers with access to the adjacent network segment hosting the software. Two conflicting CVSS vectors are present in the source data - the embedded description asserts AV:A (Adjacent Network, score 9.6) while the separately provided vector field records AV:P (Physical, score 7.6) - a material discrepancy that affects risk prioritization and requires vendor clarification. Scope change (S:C) is confirmed, meaning successful exploitation may extend impact to other Oracle Fusion Middleware components; no public exploit or CISA KEV listing has been identified, and EPSS probability is very low at 0.26%.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible when an unauthenticated remote attacker sends crafted HTTP requests to the Security and Authentication component of this Oracle Fusion Middleware reporting tool. The flaw carries a CVSS 9.8 base score with full confidentiality, integrity, and availability impact, and requires no privileges or user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; it was disclosed via Oracle's August 2026 Critical Patch Update.
Remote unauthenticated compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible over the network via SOAP, letting an attacker read, create, delete, or modify all data accessible to the product. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact and no availability impact, and flagged as an authentication-bypass class issue, it was addressed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible for an unauthenticated attacker who can reach the service over IIOP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the flaw is network-reachable, low-complexity, and requires no credentials or user interaction, yielding full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV; it was reported by Oracle and fixed in the August 2026 Critical Patch Update.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible for a remote, unauthenticated attacker who can reach the product's CORBA interface over the network, per the Oracle Critical Patch Update of August 2026. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is rated by Oracle as easily exploitable. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Unauthenticated data tampering and denial-of-service in Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) lets a remote attacker over HTTP create, delete, or modify all Reports Developer-accessible data and trigger a complete, repeatable crash. The flaw carries a CVSS 3.1 base score of 9.1 with high integrity and availability impact but no confidentiality impact, and was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Oracle Reports Developer 14.1.2.0.0 exposes an unauthenticated authentication bypass in its Security and Authentication component, allowing an attacker on the same physical network segment to fully compromise confidentiality and integrity of all accessible data - including critical data - without any credentials or user interaction. The vulnerability carries a scope change, meaning successful exploitation may cascade to impact additional Oracle Fusion Middleware products beyond Reports Developer itself. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.22% (13th percentile), suggesting low opportunistic risk despite the critical vendor-stated CVSS base score.
Unauthenticated remote exploitation of Oracle Reports Developer 14.1.2.0.0 via the SOAP interface allows attackers to read all data accessible to the application, perform partial data modification, and cause partial service disruption without credentials or user interaction. The vulnerability resides in the Security and Authentication component of Oracle Fusion Middleware, meaning authentication enforcement over the SOAP protocol can be bypassed entirely. No active exploitation has been confirmed at time of analysis, but the network-accessible, zero-authentication attack vector makes this a high-priority patching target for any organization with this product exposed beyond strictly controlled network segments.
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows an unauthenticated attacker with only HTTP network access to fully compromise the product, per Oracle's Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and no user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and unauthenticated network vector make it a high-priority patch target.
Full system takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible when a remote, unauthenticated attacker reaches the product over CORBA. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a top-priority patch item.
Full takeover of Oracle Reports Developer 14.1.2.0.0 (a component of Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP, carrying a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact. Disclosed in Oracle's August 2026 Critical Patch Update (cross-referenced as ENISA EUVD-2026-61615), the flaw sits in the Security and Authentication component and permits complete compromise of the product without credentials or user interaction. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware) is possible by a remote, unauthenticated attacker over HTTP against the Security and Authentication component, per Oracle's August 2026 Critical Patch Update. Oracle rates it CVSS 9.8 with high confidentiality, integrity, and availability impact, describing 'takeover' of the product. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible by a remote, unauthenticated attacker over TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch.
Unauthenticated remote compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows attackers with only HTTP network access to tamper with or destroy critical data, read a subset of accessible data, and force a complete denial of service. Oracle rates this CVSS 9.4, reflecting high integrity and availability impact combined with trivial exploitability and no authentication requirement. No public exploit identified at time of analysis, but the low-complexity, no-privileges vector makes it a high-priority patch from Oracle's August 2026 Critical Patch Update.
Authentication bypass in Oracle Reports Developer 12.2.1.19.0 exposes critical data to unauthenticated remote attackers over TCP, with a scope change confirmed by the vendor meaning downstream Oracle Fusion Middleware components can also be compromised. The CVSS 3.1 score of 8.6 reflects a network-accessible, zero-interaction attack path yielding high confidentiality impact across system boundaries. No public exploit code has been identified at time of analysis, though the vendor's own 'easily exploitable' classification substantially lowers the operational barrier for threat actors.
Oracle Reports Developer 12.2.1.19.0, a component of Oracle Fusion Middleware, exposes a network-exploitable authentication/security bypass in its Security and Authentication component that allows a low-privileged attacker to gain complete unauthorized read access to all data accessible by the application and limited write access to some data. The scope change (S:C) in the CVSS vector confirms that a successful attack can cascade and significantly impact additional products beyond Oracle Reports Developer itself. No public exploit code or active exploitation has been identified at time of analysis, and Oracle classifies this as difficult to exploit (AC:H).
Complete takeover of Oracle Reports Developer 12.2.1.19.0 is achievable by a remote, unauthenticated attacker over HTTP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the product's Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch.
Unauthenticated remote compromise of Oracle Reports Developer 12.2.1.19.0 is achievable via crafted SOAP requests targeting the Security and Authentication component, confirming an authentication bypass condition. The CVSS 3.1 vector (PR:N, AV:N, AC:L) indicates no credentials or user interaction are required, and the high confidentiality impact reflects full data exposure across all data accessible to the Reports Developer service. Additionally, limited integrity and availability degradation are possible, making this a high-priority patch candidate for any Oracle Fusion Middleware deployment running this version. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full compromise of Oracle Reports Developer 12.2.1.19.0 is possible when an unauthenticated attacker reaches the product over the network via the IIOP protocol, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Security and Authentication component and yields complete takeover with high confidentiality, integrity, and availability impact (CVSS 9.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
Remote takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows an unauthenticated attacker with network access over the IIOP protocol to fully compromise the product, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible via a Security and Authentication component flaw that lets a remote attacker take over the product over TCP without credentials or user interaction. Oracle rates it CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch in the August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Reports Developer 12.2.1.19.0 exposes all data accessible to the application via HTTP, with confirmed scope change that can impact additional downstream products within the Oracle Fusion Middleware environment. The vulnerability resides in the Security and Authentication component and is tagged as an authentication bypass, meaning attackers require no credentials to exploit it. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this straightforward to exploit once a target instance is reachable.
Full system takeover in Oracle Reports Developer 12.2.1.19.0 is achievable by unauthenticated remote attackers over HTTP, though exploitation requires human interaction from a victim user. The vulnerability resides in the Security and Authentication component of Oracle Fusion Middleware, and successful exploitation yields complete confidentiality, integrity, and availability compromise of the target instance. Oracle classifies the flaw as 'easily exploitable' in its August 2026 Critical Patch Update; no public exploit has been identified and the vulnerability is not listed in CISA KEV, meaning active exploitation is not confirmed at time of analysis.
Unauthenticated remote compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows a network attacker to reach protected data and cross a trust boundary into other products. An attacker with only HTTP access can read all data accessible to Oracle Reports Developer and make limited unauthorized modifications, and because the flaw is scope-changing it can significantly impact additional products beyond Reports Developer itself. It carries a CVSS 3.1 base score of 9.3 and is addressed in Oracle's August 2026 Critical Patch Update; no public exploit identified at time of analysis.
Remote takeover in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) lets an unauthenticated network attacker fully compromise the product via UDP. Oracle rates the flaw CVSS 9.8 with high confidentiality, integrity, and availability impact and describes it as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote exploitation of Oracle Reports Developer 12.2.1.19.0 via SMTP allows attackers to perform unauthorized data manipulation and cause a partial denial of service against the affected instance. The vulnerability resides in the Security and Authentication component of Oracle Fusion Middleware, and carries a scope-change designation indicating that successful attacks may cascade to impact additional Oracle products sharing the same environment. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Reports Developer 12.2.1.19.0 can be fully compromised by low-privileged, authenticated attackers over HTTP, resulting in complete system takeover with full confidentiality, integrity, and availability loss. The flaw resides in the Security and Authentication component of Oracle Fusion Middleware, and carries a scope-changing impact - successful exploitation may cascade into additional Fusion Middleware products beyond Reports Developer itself. No public exploit code or CISA KEV listing exists at time of analysis; however, the full-takeover potential and cross-component scope change elevate this beyond typical high-complexity findings.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP via the Security and Authentication component. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle describes successful attacks as resulting in complete takeover of the product. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable takeover profile makes it a high patch priority.
Improper access control in Oracle Reports Developer 12.2.1.19.0 enables unauthenticated attackers positioned on the same network segment as the host to fully compromise confidentiality and integrity of all data accessible by the product, with scope change allowing impact to additional Oracle Fusion Middleware components. The vulnerability carries tags of Authentication Bypass and is tracked under CWE-284 (Improper Access Control). No public exploit code or CISA KEV entry exists at time of analysis, and the EPSS score of 0.22% (13th percentile) reflects low observed exploitation probability despite the high theoretical severity.
Full system takeover of Oracle Reports Developer 12.2.1.19.0 is achievable by any low-privileged authenticated user with HTTP network access, exploiting a flaw in the Security and Authentication component of Oracle Fusion Middleware. Oracle classifies this as 'easily exploitable,' and the CVSS 3.1 score of 8.8 reflects complete confidentiality, integrity, and availability impact - effectively equivalent to administrative compromise of the affected instance. No public exploit code or active exploitation has been identified at time of analysis, but the low attack barrier significantly narrows the defender's window.
Remote unauthenticated takeover in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows an attacker with network access via the IIOP protocol to fully compromise the product without credentials or user interaction. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, this was disclosed in Oracle's August 2026 Critical Patch Update (CPUAUG2026). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) lets a remote, unauthenticated attacker reach and manipulate the reporting service over HTTP, gaining read access to all data the product can reach and the ability to create, delete, or modify that data. Rated CVSS 3.1 9.1 (Critical) with high confidentiality and integrity impact but no availability impact, it was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible by a remote, unauthenticated attacker over TCP, per Oracle's August 2026 Critical Patch Update. The flaw resides in the Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, but the trivial exploitability and complete-takeover outcome make this a high-priority patch.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible when a low-privileged attacker reaches the product over the network via the CORBA protocol, per Oracle's August 2026 Critical Patch Update. Because the flaw carries a scope change, successful exploitation can take over the Reports Developer instance and significantly impact other products beyond the vulnerable component, yielding full confidentiality, integrity, and availability loss (CVSS 3.1 base 9.9). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Oracle Customer Care (Internal Operations component) in E-Business Suite versions 12.2.3 through 12.2.15 allows a high-privileged, remote attacker to achieve full confidentiality and integrity compromise via HTTP - with a confirmed scope change that can cascade to additional EBS products. Despite the PR:H requirement, the 'Authentication Bypass' tag suggests that controls within the authenticated context can be circumvented, enabling unauthorized read and write access to critical customer data. No public exploit code has been identified and CISA KEV listing is absent, but the 'easily exploitable' vendor qualifier and low attack complexity mean that any attacker who reaches this component with elevated credentials faces minimal technical barriers.
Oracle Partner Management versions 12.2.3 through 12.2.15 (within Oracle E-Business Suite) exposes a network-accessible authentication bypass in its Internal Operations component, allowing unauthenticated remote attackers to compromise the application via HTTP - subject to a single victim interaction. Successful exploitation yields high-confidence access to critical partner data and limited write capability, with a scope change that may laterally impact additional Oracle EBS modules beyond Partner Management itself. No active exploitation (CISA KEV) or public POC has been identified at time of analysis, but the low-complexity, unauthenticated attack surface warrants priority patching for internet-facing EBS deployments.
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables an unauthenticated attacker physically co-located on the same network segment to read or modify all data accessible to the platform, with scope change indicating compromise can cascade to additional Oracle products. The CVSS vector (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) confirms the attack requires adjacency but no credentials, and exploitation difficulty is rated high. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Oracle Sales within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes an authorization flaw in its Internal Operations component that enables low-privileged authenticated network attackers to access all Oracle Sales data they should not be authorized to view, and perform limited unauthorized data manipulation via HTTP. The CVSS 3.1 score of 7.1 reflects a high confidentiality impact - complete access to all Oracle Sales accessible data - combined with a low integrity impact allowing unauthorized insert, update, or delete operations. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV, but the ease of exploitation (AC:L, no UI required) combined with the data sensitivity of a CRM/sales platform makes this a meaningful organizational risk.
Oracle Sales versions 12.2.3 through 12.2.15 within Oracle E-Business Suite allows low-privileged, network-authenticated attackers to gain full read and write access to critical data via the Internal Operations component over HTTP. The CVSS 3.1 score of 8.1 reflects high confidentiality and integrity impacts with low attack complexity, making this easily exploitable by any user with a valid low-privilege account. No public exploit has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog; Oracle's Critical Security Patch Update for August 2026 addresses this flaw.
Unauthenticated remote data exposure in Oracle Trading Community (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a network attacker to bypass authentication in the Third Party Data Integration component via HTTP, gaining complete read access to all data accessible by Oracle Trading Community. The scope change (S:C) means a successful attack can cascade into other EBS modules or integrated downstream systems. Oracle's own advisory classifies this as 'easily exploitable,' and no public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and zero-authentication requirement make it a high-priority patching target.
Critical confidentiality and integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables low-privileged network attackers to exploit the Security component via SFTP, gaining unauthorized read and write access to all critical data within the system. The CVSS scope change indicator confirms that successful exploitation can cascade beyond the directly targeted instance, significantly impacting additional Oracle Hyperion products sharing the same environment. No public exploit identified at time of analysis, though the combination of an authentication bypass tag and high-impact dual confidentiality and integrity outcomes makes this a material risk for any organization running this EPM platform.
Unauthorized data access in Oracle Siebel CRM Integration versions 25.12 through 26.6 allows low-privileged network attackers to read all CRM-accessible data and perform limited data manipulation via HTTP against the Open Integration component, with a confirmed scope change extending impact to additional integrated products. The vulnerability is tagged by Oracle as an Authentication Bypass, enabling a valid but low-privileged account to exceed its authorized access boundaries without elevated complexity or user interaction. No public exploit has been identified at time of analysis, but the combination of low attack complexity, network accessibility, and scope change makes this a credible high-priority threat in enterprise Siebel deployments.
Oracle Siebel CRM Integration versions 25.12-26.6 exposes a high-severity authentication bypass in its Open Integration component that permits an unauthenticated attacker on the same physical network segment to fully read and modify all data accessible through the integration layer. The CVSS 8.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms low-complexity, credential-free exploitation, though the adjacent-network requirement materially constrains the attacker population to insiders or laterally-moved threat actors. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Integrity and availability compromise in Oracle Siebel CRM Integration's Open Integration component (versions 25.12 through 26.6) allows a high-privileged remote attacker over HTTP to corrupt or destroy critical data and trigger a complete denial of service, with confirmed scope change meaning successful exploitation may cascade into additional integrated downstream products. The attack requires high complexity and pre-existing administrative privileges, limiting opportunistic exploitation, but the cross-system blast radius elevates overall business risk. No public exploit code has been identified and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Full system takeover in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 is achievable by a high-privileged, network-authenticated attacker via HTTP against the Deployment component, resulting in complete confidentiality, integrity, and availability compromise. Disclosed as part of Oracle's August 2026 Critical Security Update (CPU) and registered in ENISA EUVD (EUVD-2026-61690), with no confirmed active exploitation or public exploit code at time of analysis. The PR:H prerequisite significantly constrains the attacker population to insiders, compromised administrator accounts, or actors with prior lateral movement to admin-level access.
Data integrity and availability compromise in Oracle Autonomous Health Framework's Trace File Analyzer component affects versions 26 through 26.5.2, permitting high-privileged local attackers to corrupt or destroy critical data and induce a complete denial-of-service condition. Notably, the attack carries a scope change, meaning successful exploitation can cascade to affect additional co-located Oracle products beyond AHF itself. No public exploit code or active exploitation has been identified at time of analysis; Oracle has issued remediation through its August 2026 Critical Patch Update.
Unauthorized data disclosure and partial denial of service in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 is achievable by any low-privileged attacker with network access over HTTP targeting the Deployment component. The combination of a high confidentiality impact and an 'Authentication Bypass' tag from EUVD suggests the flaw may allow authenticated users to escalate access beyond their authorization level, potentially exposing all financial and operational data managed by the platform. No public exploit code or CISA KEV listing exists at time of analysis, though Oracle has addressed this in the August 2026 Critical Security Patch Update.
Local privilege escalation and denial-of-service in Oracle Autonomous Health Framework's Trace File Analyzer component affects versions 26 through 26.5.2, enabling low-privileged infrastructure users to corrupt or destroy critical data and crash the framework with scope change to dependent Oracle products. The CVSS 3.1 score of 8.4 reflects ease of exploitation once local access is obtained, with no user interaction required. No public exploit or CISA KEV listing has been identified at time of analysis; this disclosure originates from Oracle's Critical Security Patch Update for August 2026.
Unauthenticated data compromise in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 (Deployment component) lets a remote attacker over HTTP read, create, modify, or delete all data accessible to the application. Tagged as an authentication bypass and rated CVSS 3.1 9.1, it was reported by Oracle and addressed in the August 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Teleservice (E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged attacker with network access via HTTP, exploiting a flaw in the Service Request Form component. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation is straightforward - no elevated privileges, no user interaction, and no complex preconditions beyond a valid low-privilege account. Oracle's own advisory characterizes the outcome as complete product takeover, implying full loss of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthorized data exposure in Oracle Autonomous Health Framework (Trace File Analyzer component) allows a low-privileged network attacker to gain complete read access to critical data and limited write capability across the framework and potentially connected Oracle products due to a scope-changing exploit path. Affected versions span the entire 26.x release family through 26.5.2, making this a broad exposure across current deployments. No public exploit has been identified at time of analysis, but the low attack complexity, absence of user interaction, and scope-change characteristic elevate real-world priority beyond what the raw CVSS alone conveys.
Oracle Advanced Inbound Telephony versions 12.2.3 through 12.2.15 exposes its Internal Operations component to low-privileged HTTP attackers who can achieve full read access to sensitive telephony data, limited data manipulation, and partial denial of service. The 'Authentication Bypass' tag suggests that while a valid low-privilege account is required to initiate the attack, the Internal Operations component fails to enforce additional authorization controls, allowing privilege escalation within the application. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the vulnerability was disclosed by Oracle's own security team via the August 2026 Critical Patch Update.
Full takeover of Oracle MySQL Cluster is achievable by an unauthenticated remote attacker over HTTP across three active release trains: 8.0.0-8.0.48, 8.4.0-8.4.11, and 9.7.0-9.7.2. The attack carries high complexity and requires human interaction from a victim user, but successful exploitation yields complete confidentiality, integrity, and availability compromise of the cluster. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data exposure in Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to gain complete read access to all data accessible by the application, with scope change enabling lateral data exposure across additional Oracle Hyperion ecosystem products. The vulnerability resides in the Deployment component and is exploitable over HTTP without user interaction. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the Authentication Bypass tag from ENISA EUVD signals a likely authorization control weakness that warrants priority patching in enterprise environments.
Unauthenticated remote exploitation of Oracle Advanced Inbound Telephony (versions 12.2.3-12.2.15) within Oracle E-Business Suite allows a network attacker to perform unauthorized creation, deletion, or modification of critical telephony data and cause a partial denial of service via HTTPS. The CVSS 3.1 base score of 8.2 reflects high integrity impact and low availability impact with no confidentiality exposure. No public exploit code or active exploitation (CISA KEV listing) has been identified at time of analysis.
Unauthenticated remote exploitation of Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 allows network attackers to gain complete read access to all application-managed financial data via HTTP, with no credentials or user interaction required. The vulnerability resides in the Deployment component and carries a CVSS scope change, meaning successful exploitation may expose data from additional interconnected Oracle Hyperion products sharing the same infrastructure. No public exploit code or active exploitation has been confirmed, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N profile makes this trivially repeatable once an attacker identifies the vulnerable endpoint.
Full system compromise of Oracle Bills of Material - a component of Oracle E-Business Suite - across versions 12.2.3 through 12.2.15 is achievable by a network-reachable, low-privileged attacker via crafted HTTP requests, with Oracle confirming potential for complete takeover covering confidentiality, integrity, and availability. The scope change designation in the CVSS vector indicates that successful exploitation can cascade beyond the Bills of Material module to affect additional Oracle E-Business Suite components. No public exploit code or CISA KEV listing has been identified at time of analysis; however, Oracle has issued a patch in the August 2026 Critical Patch Update.
Full takeover of Oracle iSetup 12.2.3 through 12.2.15 is achievable by a low-privileged, network-adjacent attacker via HTTP, targeting the General Ledger Update Transform and Reports component within Oracle E-Business Suite. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected instance. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the full-takeover impact (C:H/I:H/A:H) and network accessibility elevate the urgency of patching relative to other Oracle CPU entries in this cycle.
Full takeover of Oracle Sales Foundation (E-Business Suite 12.2.3-12.2.15) is achievable by a low-privileged network attacker via HTTP, targeting the Security API component. The vulnerability is rated CVSS 8.8 with high impact across confidentiality, integrity, and availability, indicating the attacker can gain complete control of the affected application. No public exploit or CISA KEV listing has been identified at time of analysis, though Oracle's classification as 'easily exploitable' elevates urgency for patching.
Unauthorized data access and modification in Oracle Sales Foundation (Oracle E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged, network-authenticated attacker via HTTP, with no user interaction required. The vulnerability resides in the Security API component and is tagged as an authentication bypass, enabling an attacker to read, create, delete, or modify critical data across the entire Sales Foundation dataset. No public exploit code has been identified at time of analysis, and the CVE does not appear in the CISA KEV catalog, though the low exploitation complexity makes this a realistic near-term threat for exposed deployments.
Full system takeover of Oracle Sales for Handhelds (E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged authenticated attacker with HTTP network access, resulting in complete compromise of confidentiality, integrity, and availability. The vulnerability resides in the Internal Operations component and requires no user interaction or elevated privileges beyond a basic account. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad version range make this a credible lateral-movement or privilege-escalation risk within Oracle EBS environments.
Full compromise of Oracle Sales (E-Business Suite component: Internal Operations) is achievable by a low-privileged network attacker via HTTP across versions 12.2.3 through 12.2.15, with successful exploitation resulting in complete takeover - high confidentiality, integrity, and availability impact. The attack is constrained by high complexity (AC:H), meaning reliable exploitation requires meeting specific, non-trivial conditions rather than simple request crafting. Disclosed through Oracle's August 2026 Critical Security Patch Update, no public exploit or active exploitation has been identified at time of analysis.
Local authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows an unauthenticated local attacker - one with OS-level logon to the host infrastructure but no Oracle application credentials - to compromise the Security component and gain complete unauthorized read access to all data accessible by Hyperion Calculation Manager. The scope change (S:C) in the CVSS vector confirms that successful exploitation can cascade to impact additional Oracle products co-hosted on the same infrastructure. No public exploit has been identified at time of analysis, and Oracle disclosed this through its August 2026 Critical Patch Update.
Full takeover of Oracle Trading Community within Oracle E-Business Suite is achievable by unauthenticated remote attackers via HTTP, targeting the Party Search UI component across versions 12.2.3 through 12.2.15. The Oracle-reported CVSS vector confirms network accessibility with no privilege or user-interaction requirement, though high attack complexity (AC:H) indicates exploitation is non-trivial and likely requires precise conditions such as timing, specific request sequencing, or environment-dependent state. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Unauthorized read and write access to critical data in Oracle Agile Engineering Data Management 6.2.1 is achievable by low-privileged network attackers targeting the Engineering Communication Interface (ECI) component via HTTP, with successful exploitation yielding high confidentiality and integrity impact (C:H/I:H) that can cascade to additional Oracle products via scope change. The 'Authentication Bypass' tag in reporter intelligence suggests the flaw enables attackers to exceed their granted access level within the ECI, despite requiring an initial low-privileged foothold. Oracle addressed this in the August 2026 Critical Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote exploitation of the File Transmission component in Oracle Payments (E-Business Suite 12.2.3-12.2.15) allows network-accessible attackers over HTTP to gain complete read access to all Oracle Payments data and perform limited unauthorized write operations. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 8.2, and the Authentication Bypass tag confirms no credentials are required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-prerequisite attack profile makes this a high-priority patching target for any organization running Oracle EBS with the Payments module active.
Unauthorized data access and modification in Oracle Payables (E-Business Suite versions 12.2.3-12.2.15) is exploitable by any low-privileged authenticated attacker with HTTP network access, enabling full compromise of Payables confidentiality and integrity. The vulnerability resides in the Internal Operations component and is tagged as an authentication bypass, indicating that access-control deficiencies allow a low-privileged account holder to read or manipulate critical financial data-including supplier invoices, payments, and transaction records-beyond their intended authorization scope. No public exploit code and no CISA KEV listing exist at time of analysis; however, the low attack complexity, vendor-confirmed CVSS 8.1, and sensitive financial data at stake make this a meaningful priority for Oracle EBS environments.
Remote denial-of-service in Oracle Payables (E-Business Suite versions 12.2.3 through 12.2.15) allows unauthenticated network attackers to crash or hang the Payables service via HTTP, completely disrupting accounts payable operations. Oracle describes the flaw as 'easily exploitable' with no authentication requirement, and the vendor-provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) corroborates full availability impact with minimal attacker effort. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Oracle Critical Patch Update for August 2026 confirms the issue and provides remediation.
Unauthorized data access and modification in Oracle Payments (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 is achievable by unauthenticated remote attackers via HTTPS targeting the File Transmission component. The vulnerability, tagged as an Authentication Bypass, enables full confidentiality and integrity compromise of Oracle Payments data - allowing attackers to read, create, delete, or modify all accessible payment records. Exploitation is rated 'difficult' (AC:H) and no active exploitation has been identified in CISA KEV at time of analysis, though the zero-prerequisites authentication bypass warrants urgent patching given the financial data exposure.
Local privilege escalation in Oracle Agile Engineering Data Management 6.2.1 allows a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the system via the Engineering Communication Interface component. Exploitation requires high-complexity conditions and local access, but successful attacks result in complete takeover - full loss of confidentiality, integrity, and availability. Disclosed through Oracle's Critical Security Patch Update for August 2026; no public exploit identified at time of analysis.
Unauthenticated network exposure in Oracle Payments (E-Business Suite versions 12.2.3 through 12.2.15) allows remote attackers to access all data handled by the File Transmission component without credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network reachability with no authentication or user interaction required. Tagged as an authentication bypass, this flaw yields complete confidentiality loss over Oracle Payments data; no public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes exploitation straightforward once a target instance is reachable.
Unauthorized data access and manipulation in Oracle Payments (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 is achievable by a network-adjacent, high-privileged attacker exploiting a flaw in the File Transmission component via HTTP. Successful exploitation produces a scope change, meaning compromise extends beyond Oracle Payments to additional E-Business Suite products, enabling complete confidentiality and integrity compromise of critical payment data. No public exploit or active KEV listing is identified at time of analysis; however, the 'Authentication Bypass' tag supplied by the reporter suggests internal authorization controls within the File Transmission component can be subverted despite the high-privilege initial access requirement.
Oracle Payments versions 12.2.3 through 12.2.15, within Oracle E-Business Suite, expose a flaw in the File Transmission component that permits a high-privileged HTTP attacker to bypass internal access controls and achieve full confidentiality and integrity compromise of payment data, with confirmed scope change cascading impact to additional integrated EBS modules. The vendor-assigned 'Authentication Bypass' tag creates a notable tension with the PR:H CVSS metric, suggesting the bypass operates within Oracle EBS's internal authorization layer - circumventing role-based data access controls - rather than defeating the perimeter authentication mechanism. No public exploit code or active exploitation has been identified at time of analysis; remediation is available via Oracle's August 2026 Critical Security Patch Update.
Unauthorized data disclosure in Oracle Marketing Encyclopedia System (E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to gain complete read access to all data accessible by the application component. The vulnerability carries a scope change, meaning successful exploitation can impact resources beyond the immediately compromised component. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the tags attribute 'Authentication Bypass' suggesting the low-privilege barrier may be weaker in practice than the PR:L CVSS metric implies.
Full system takeover of Oracle Agile Engineering Data Management 6.2.1 is achievable by unauthenticated attackers who can reach the physical network segment hosting the EDM hardware, specifically via the Engineering Communication Interface (ECI) component. The CVSS vector (AV:A/AC:H/PR:N) confirms adjacency is mandatory and complexity is high, constraining realistic exposure to internal networks or co-located infrastructure. No public exploit code or active exploitation has been identified at time of analysis; this is patched under Oracle's August 2026 Critical Security Patch Update.
Full system takeover of Oracle HRMS (US) versions 12.2.3 through 12.2.15 is achievable by a highly privileged network attacker exploiting a flaw in the US Payroll - General component via HTTP. The CVSS scope change (S:C) means a successful compromise can cascade into additional Oracle E-Business Suite modules beyond HRMS itself, amplifying the blast radius significantly. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis; remediation is addressed in Oracle's Critical Patch Update for August 2026.
Complete takeover of Oracle Essbase 21.8.1.0.0 is possible by an unauthenticated remote attacker over HTTP, per Oracle's August 2026 Critical Patch Update. Oracle rates it CVSS 9.8 with full confidentiality, integrity, and availability impact and flags it as 'easily exploitable,' meaning no authentication, no user interaction, and low attack complexity are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of network reach and unauthenticated takeover makes it a high-priority patch candidate.
Full system takeover in Oracle Essbase 21.8.1.0.0 is achievable by any low-privileged authenticated user with network access via HTTP, targeting the Calculator component. The CVSS 3.1 score of 8.8 reflects complete impact across confidentiality, integrity, and availability (C:H/I:H/A:H), consistent with Oracle's own classification of this as 'easily exploitable.' No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network vector make this a credible and accessible exploitation path for any valid account holder.
Unauthorized data disclosure in Oracle Marketing 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to fully compromise confidentiality of all Oracle Marketing-accessible data via the Audience component over HTTP. The vulnerability carries a scope change, meaning successful exploitation can ripple into additional Oracle E-Business Suite products beyond Marketing itself. Tagged as an Authentication Bypass by the reporting source, no public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle General Ledger (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged, network-accessible attacker via HTTP, requiring no user interaction and minimal exploitation complexity. The vulnerability resides in the Internal Operations component and results in complete compromise of confidentiality, integrity, and availability of the General Ledger application. No public exploit code or active exploitation has been identified at the time of analysis, but the vendor's own 'easily exploitable' characterization combined with the broad affected version range makes this a high-priority patch for all Oracle EBS deployments.
Local authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables unauthenticated local attackers to access critical application data and perform limited data modification, with a confirmed scope change that can propagate impact to additional co-deployed Oracle Hyperion products. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) classifies this as easily exploitable once local infrastructure access is obtained, requiring no application credentials. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Remote takeover of Oracle Enterprise Manager Base Platform is achievable by unauthenticated network attackers via HTTP targeting the Agent Next Gen component in versions 13.5 and 24.1. Despite the high attack complexity requirement (CVSS AC:H), successful exploitation yields complete compromise - high confidentiality, integrity, and availability impact, effectively full platform control. No public exploit or active exploitation has been identified at time of analysis, but the Oracle CPU August 2026 advisory documents this as a supported-version vulnerability requiring immediate attention.
Full takeover of Oracle Applications DBA within Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible via an unauthenticated, network-based HTTP attack targeting the JRI and associated Java utility components. Exploitation is rated difficult (CVSS AC:H) and requires human interaction from a legitimate user, but successful compromise yields complete loss of confidentiality, integrity, and availability of the affected component. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Oracle's August 2026 Critical Patch Update addresses this issue.
Oracle Applications DBA, the administrative component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, exposes critical internal operations over HTTP to low-privileged attackers. Successful exploitation enables unauthorized access to critical or complete data accessible by the Applications DBA component, along with the ability to trigger partial denial-of-service conditions against the same component. No public exploit has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog, though the low complexity and broad network accessibility make it a meaningful risk in unpatched EBS deployments.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a flaw in its Security component that enables a network-accessible, low-privileged attacker to compromise the application via HTTP when a legitimate user is induced to interact with malicious content. Successful exploitation results in complete unauthorized read access to all data within Calculation Manager and limited write capability, with a confirmed scope change that may extend impact to other interconnected Oracle Hyperion EPM products. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the 'Authentication Bypass' tag sourced from EUVD metadata suggests the root cause involves bypassing higher-privilege access controls within the Security component after initial low-privilege authentication.
Unauthorized data modification, partial denial of service, and limited data exposure in Oracle Hyperion Calculation Manager 11.2.25.0.000 are achievable by unauthenticated remote attackers over HTTP targeting the Security component. The CVSS 3.1 score of 7.0 reflects high integrity impact - attackers can create, delete, or modify critical EPM data - tempered by high attack complexity (AC:H) that prevents trivial automated exploitation. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Oracle Reports Developer 14.1.2.0.0, a component of Oracle Fusion Middleware, allows unauthenticated remote attackers to fully compromise the system via a network-accessible HTTP attack against its Security and Authentication component. Successful exploitation results in complete takeover - achieving high confidentiality, integrity, and availability impact - consistent with full control over the affected instance. No public exploit code has been identified at time of analysis, and exploitation requires high attack complexity (AC:H), meaning real-world exploitation depends on meeting specific non-trivial preconditions.
Authentication bypass in Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows a remote unauthenticated attacker to reach and compromise the reporting service over HTTP, exposing critical data and enabling partial data modification. The scope-changing flaw (CVSS 3.1 9.3) can also significantly impact adjacent products beyond Reports Developer itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low-complexity, no-privilege, no-interaction profile makes it high priority.
Oracle Reports Developer 14.1.2.0.0 contains an authentication bypass in its Security and Authentication component that permits unauthenticated, network-based attackers to achieve both complete data disclosure and unauthorized modification of critical data over HTTP. The vulnerability requires no credentials or user interaction, though the high attack complexity (AC:H) means exploitation demands precise conditions or crafted request sequences. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated network reach combined with dual high-impact outcomes warrants urgent remediation for any internet-exposed or untrusted-network-accessible deployments.
Oracle Reports Developer 14.1.2.0.0 contains an authentication bypass flaw in its Security and Authentication component that allows a low-privileged network attacker to gain unauthorized read and write access to all data managed by the application over HTTP. Rated 8.1 CVSS with low attack complexity and no user interaction required, this represents a significant confidentiality and integrity risk for any organization with Oracle Reports Developer exposed on a network-accessible interface. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Reports Developer 14.1.2.0.0 is exposed to a full system takeover through an authentication bypass (CWE-284) in its Security and Authentication component, exploitable by unauthenticated attackers with access to the adjacent network segment hosting the software. Two conflicting CVSS vectors are present in the source data - the embedded description asserts AV:A (Adjacent Network, score 9.6) while the separately provided vector field records AV:P (Physical, score 7.6) - a material discrepancy that affects risk prioritization and requires vendor clarification. Scope change (S:C) is confirmed, meaning successful exploitation may extend impact to other Oracle Fusion Middleware components; no public exploit or CISA KEV listing has been identified, and EPSS probability is very low at 0.26%.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible when an unauthenticated remote attacker sends crafted HTTP requests to the Security and Authentication component of this Oracle Fusion Middleware reporting tool. The flaw carries a CVSS 9.8 base score with full confidentiality, integrity, and availability impact, and requires no privileges or user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; it was disclosed via Oracle's August 2026 Critical Patch Update.
Remote unauthenticated compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible over the network via SOAP, letting an attacker read, create, delete, or modify all data accessible to the product. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact and no availability impact, and flagged as an authentication-bypass class issue, it was addressed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible for an unauthenticated attacker who can reach the service over IIOP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) the flaw is network-reachable, low-complexity, and requires no credentials or user interaction, yielding full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV; it was reported by Oracle and fixed in the August 2026 Critical Patch Update.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible for a remote, unauthenticated attacker who can reach the product's CORBA interface over the network, per the Oracle Critical Patch Update of August 2026. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is rated by Oracle as easily exploitable. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Unauthenticated data tampering and denial-of-service in Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) lets a remote attacker over HTTP create, delete, or modify all Reports Developer-accessible data and trigger a complete, repeatable crash. The flaw carries a CVSS 3.1 base score of 9.1 with high integrity and availability impact but no confidentiality impact, and was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Oracle Reports Developer 14.1.2.0.0 exposes an unauthenticated authentication bypass in its Security and Authentication component, allowing an attacker on the same physical network segment to fully compromise confidentiality and integrity of all accessible data - including critical data - without any credentials or user interaction. The vulnerability carries a scope change, meaning successful exploitation may cascade to impact additional Oracle Fusion Middleware products beyond Reports Developer itself. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.22% (13th percentile), suggesting low opportunistic risk despite the critical vendor-stated CVSS base score.
Unauthenticated remote exploitation of Oracle Reports Developer 14.1.2.0.0 via the SOAP interface allows attackers to read all data accessible to the application, perform partial data modification, and cause partial service disruption without credentials or user interaction. The vulnerability resides in the Security and Authentication component of Oracle Fusion Middleware, meaning authentication enforcement over the SOAP protocol can be bypassed entirely. No active exploitation has been confirmed at time of analysis, but the network-accessible, zero-authentication attack vector makes this a high-priority patching target for any organization with this product exposed beyond strictly controlled network segments.
Remote takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows an unauthenticated attacker with only HTTP network access to fully compromise the product, per Oracle's Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and no user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and unauthenticated network vector make it a high-priority patch target.
Full system takeover of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) is possible when a remote, unauthenticated attacker reaches the product over CORBA. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-facing nature makes it a top-priority patch item.
Full takeover of Oracle Reports Developer 14.1.2.0.0 (a component of Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP, carrying a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact. Disclosed in Oracle's August 2026 Critical Patch Update (cross-referenced as ENISA EUVD-2026-61615), the flaw sits in the Security and Authentication component and permits complete compromise of the product without credentials or user interaction. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware) is possible by a remote, unauthenticated attacker over HTTP against the Security and Authentication component, per Oracle's August 2026 Critical Patch Update. Oracle rates it CVSS 9.8 with high confidentiality, integrity, and availability impact, describing 'takeover' of the product. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Complete takeover of Oracle Reports Developer 14.1.2.0.0 is possible by a remote, unauthenticated attacker over TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch.
Unauthenticated remote compromise of Oracle Reports Developer 14.1.2.0.0 (Oracle Fusion Middleware, Security and Authentication component) allows attackers with only HTTP network access to tamper with or destroy critical data, read a subset of accessible data, and force a complete denial of service. Oracle rates this CVSS 9.4, reflecting high integrity and availability impact combined with trivial exploitability and no authentication requirement. No public exploit identified at time of analysis, but the low-complexity, no-privileges vector makes it a high-priority patch from Oracle's August 2026 Critical Patch Update.
Authentication bypass in Oracle Reports Developer 12.2.1.19.0 exposes critical data to unauthenticated remote attackers over TCP, with a scope change confirmed by the vendor meaning downstream Oracle Fusion Middleware components can also be compromised. The CVSS 3.1 score of 8.6 reflects a network-accessible, zero-interaction attack path yielding high confidentiality impact across system boundaries. No public exploit code has been identified at time of analysis, though the vendor's own 'easily exploitable' classification substantially lowers the operational barrier for threat actors.
Oracle Reports Developer 12.2.1.19.0, a component of Oracle Fusion Middleware, exposes a network-exploitable authentication/security bypass in its Security and Authentication component that allows a low-privileged attacker to gain complete unauthorized read access to all data accessible by the application and limited write access to some data. The scope change (S:C) in the CVSS vector confirms that a successful attack can cascade and significantly impact additional products beyond Oracle Reports Developer itself. No public exploit code or active exploitation has been identified at time of analysis, and Oracle classifies this as difficult to exploit (AC:H).
Complete takeover of Oracle Reports Developer 12.2.1.19.0 is achievable by a remote, unauthenticated attacker over HTTP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the product's Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network vector make it a high-priority patch.
Unauthenticated remote compromise of Oracle Reports Developer 12.2.1.19.0 is achievable via crafted SOAP requests targeting the Security and Authentication component, confirming an authentication bypass condition. The CVSS 3.1 vector (PR:N, AV:N, AC:L) indicates no credentials or user interaction are required, and the high confidentiality impact reflects full data exposure across all data accessible to the Reports Developer service. Additionally, limited integrity and availability degradation are possible, making this a high-priority patch candidate for any Oracle Fusion Middleware deployment running this version. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full compromise of Oracle Reports Developer 12.2.1.19.0 is possible when an unauthenticated attacker reaches the product over the network via the IIOP protocol, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Security and Authentication component and yields complete takeover with high confidentiality, integrity, and availability impact (CVSS 9.8). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a high-priority patch.
Remote takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows an unauthenticated attacker with network access over the IIOP protocol to fully compromise the product, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle rates it easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible via a Security and Authentication component flaw that lets a remote attacker take over the product over TCP without credentials or user interaction. Oracle rates it CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable.' No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a high-priority patch in the August 2026 Critical Patch Update.
Unauthenticated remote exploitation of Oracle Reports Developer 12.2.1.19.0 exposes all data accessible to the application via HTTP, with confirmed scope change that can impact additional downstream products within the Oracle Fusion Middleware environment. The vulnerability resides in the Security and Authentication component and is tagged as an authentication bypass, meaning attackers require no credentials to exploit it. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this straightforward to exploit once a target instance is reachable.
Full system takeover in Oracle Reports Developer 12.2.1.19.0 is achievable by unauthenticated remote attackers over HTTP, though exploitation requires human interaction from a victim user. The vulnerability resides in the Security and Authentication component of Oracle Fusion Middleware, and successful exploitation yields complete confidentiality, integrity, and availability compromise of the target instance. Oracle classifies the flaw as 'easily exploitable' in its August 2026 Critical Patch Update; no public exploit has been identified and the vulnerability is not listed in CISA KEV, meaning active exploitation is not confirmed at time of analysis.
Unauthenticated remote compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows a network attacker to reach protected data and cross a trust boundary into other products. An attacker with only HTTP access can read all data accessible to Oracle Reports Developer and make limited unauthorized modifications, and because the flaw is scope-changing it can significantly impact additional products beyond Reports Developer itself. It carries a CVSS 3.1 base score of 9.3 and is addressed in Oracle's August 2026 Critical Patch Update; no public exploit identified at time of analysis.
Remote takeover in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) lets an unauthenticated network attacker fully compromise the product via UDP. Oracle rates the flaw CVSS 9.8 with high confidentiality, integrity, and availability impact and describes it as easily exploitable. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote exploitation of Oracle Reports Developer 12.2.1.19.0 via SMTP allows attackers to perform unauthorized data manipulation and cause a partial denial of service against the affected instance. The vulnerability resides in the Security and Authentication component of Oracle Fusion Middleware, and carries a scope-change designation indicating that successful attacks may cascade to impact additional Oracle products sharing the same environment. No public exploit code or active exploitation has been identified at time of analysis.
Oracle Reports Developer 12.2.1.19.0 can be fully compromised by low-privileged, authenticated attackers over HTTP, resulting in complete system takeover with full confidentiality, integrity, and availability loss. The flaw resides in the Security and Authentication component of Oracle Fusion Middleware, and carries a scope-changing impact - successful exploitation may cascade into additional Fusion Middleware products beyond Reports Developer itself. No public exploit code or CISA KEV listing exists at time of analysis; however, the full-takeover potential and cross-component scope change elevate this beyond typical high-complexity findings.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible for a remote, unauthenticated attacker over HTTP via the Security and Authentication component. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and Oracle describes successful attacks as resulting in complete takeover of the product. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-reachable takeover profile makes it a high patch priority.
Improper access control in Oracle Reports Developer 12.2.1.19.0 enables unauthenticated attackers positioned on the same network segment as the host to fully compromise confidentiality and integrity of all data accessible by the product, with scope change allowing impact to additional Oracle Fusion Middleware components. The vulnerability carries tags of Authentication Bypass and is tracked under CWE-284 (Improper Access Control). No public exploit code or CISA KEV entry exists at time of analysis, and the EPSS score of 0.22% (13th percentile) reflects low observed exploitation probability despite the high theoretical severity.
Full system takeover of Oracle Reports Developer 12.2.1.19.0 is achievable by any low-privileged authenticated user with HTTP network access, exploiting a flaw in the Security and Authentication component of Oracle Fusion Middleware. Oracle classifies this as 'easily exploitable,' and the CVSS 3.1 score of 8.8 reflects complete confidentiality, integrity, and availability impact - effectively equivalent to administrative compromise of the affected instance. No public exploit code or active exploitation has been identified at time of analysis, but the low attack barrier significantly narrows the defender's window.
Remote unauthenticated takeover in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) allows an attacker with network access via the IIOP protocol to fully compromise the product without credentials or user interaction. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, this was disclosed in Oracle's August 2026 Critical Patch Update (CPUAUG2026). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware, Security and Authentication component) lets a remote, unauthenticated attacker reach and manipulate the reporting service over HTTP, gaining read access to all data the product can reach and the ability to create, delete, or modify that data. Rated CVSS 3.1 9.1 (Critical) with high confidentiality and integrity impact but no availability impact, it was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible by a remote, unauthenticated attacker over TCP, per Oracle's August 2026 Critical Patch Update. The flaw resides in the Security and Authentication component and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). No public exploit identified at time of analysis, but the trivial exploitability and complete-takeover outcome make this a high-priority patch.
Full compromise of Oracle Reports Developer 12.2.1.19.0 (Oracle Fusion Middleware) is possible when a low-privileged attacker reaches the product over the network via the CORBA protocol, per Oracle's August 2026 Critical Patch Update. Because the flaw carries a scope change, successful exploitation can take over the Reports Developer instance and significantly impact other products beyond the vulnerable component, yielding full confidentiality, integrity, and availability loss (CVSS 3.1 base 9.9). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Oracle Customer Care (Internal Operations component) in E-Business Suite versions 12.2.3 through 12.2.15 allows a high-privileged, remote attacker to achieve full confidentiality and integrity compromise via HTTP - with a confirmed scope change that can cascade to additional EBS products. Despite the PR:H requirement, the 'Authentication Bypass' tag suggests that controls within the authenticated context can be circumvented, enabling unauthorized read and write access to critical customer data. No public exploit code has been identified and CISA KEV listing is absent, but the 'easily exploitable' vendor qualifier and low attack complexity mean that any attacker who reaches this component with elevated credentials faces minimal technical barriers.
Oracle Partner Management versions 12.2.3 through 12.2.15 (within Oracle E-Business Suite) exposes a network-accessible authentication bypass in its Internal Operations component, allowing unauthenticated remote attackers to compromise the application via HTTP - subject to a single victim interaction. Successful exploitation yields high-confidence access to critical partner data and limited write capability, with a scope change that may laterally impact additional Oracle EBS modules beyond Partner Management itself. No active exploitation (CISA KEV) or public POC has been identified at time of analysis, but the low-complexity, unauthenticated attack surface warrants priority patching for internet-facing EBS deployments.
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables an unauthenticated attacker physically co-located on the same network segment to read or modify all data accessible to the platform, with scope change indicating compromise can cascade to additional Oracle products. The CVSS vector (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) confirms the attack requires adjacency but no credentials, and exploitation difficulty is rated high. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Oracle Sales within Oracle E-Business Suite versions 12.2.3 through 12.2.15 exposes an authorization flaw in its Internal Operations component that enables low-privileged authenticated network attackers to access all Oracle Sales data they should not be authorized to view, and perform limited unauthorized data manipulation via HTTP. The CVSS 3.1 score of 7.1 reflects a high confidentiality impact - complete access to all Oracle Sales accessible data - combined with a low integrity impact allowing unauthorized insert, update, or delete operations. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV, but the ease of exploitation (AC:L, no UI required) combined with the data sensitivity of a CRM/sales platform makes this a meaningful organizational risk.
Oracle Sales versions 12.2.3 through 12.2.15 within Oracle E-Business Suite allows low-privileged, network-authenticated attackers to gain full read and write access to critical data via the Internal Operations component over HTTP. The CVSS 3.1 score of 8.1 reflects high confidentiality and integrity impacts with low attack complexity, making this easily exploitable by any user with a valid low-privilege account. No public exploit has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog; Oracle's Critical Security Patch Update for August 2026 addresses this flaw.
Unauthenticated remote data exposure in Oracle Trading Community (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 allows a network attacker to bypass authentication in the Third Party Data Integration component via HTTP, gaining complete read access to all data accessible by Oracle Trading Community. The scope change (S:C) means a successful attack can cascade into other EBS modules or integrated downstream systems. Oracle's own advisory classifies this as 'easily exploitable,' and no public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and zero-authentication requirement make it a high-priority patching target.
Critical confidentiality and integrity compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 enables low-privileged network attackers to exploit the Security component via SFTP, gaining unauthorized read and write access to all critical data within the system. The CVSS scope change indicator confirms that successful exploitation can cascade beyond the directly targeted instance, significantly impacting additional Oracle Hyperion products sharing the same environment. No public exploit identified at time of analysis, though the combination of an authentication bypass tag and high-impact dual confidentiality and integrity outcomes makes this a material risk for any organization running this EPM platform.
Unauthorized data access in Oracle Siebel CRM Integration versions 25.12 through 26.6 allows low-privileged network attackers to read all CRM-accessible data and perform limited data manipulation via HTTP against the Open Integration component, with a confirmed scope change extending impact to additional integrated products. The vulnerability is tagged by Oracle as an Authentication Bypass, enabling a valid but low-privileged account to exceed its authorized access boundaries without elevated complexity or user interaction. No public exploit has been identified at time of analysis, but the combination of low attack complexity, network accessibility, and scope change makes this a credible high-priority threat in enterprise Siebel deployments.
Oracle Siebel CRM Integration versions 25.12-26.6 exposes a high-severity authentication bypass in its Open Integration component that permits an unauthenticated attacker on the same physical network segment to fully read and modify all data accessible through the integration layer. The CVSS 8.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) confirms low-complexity, credential-free exploitation, though the adjacent-network requirement materially constrains the attacker population to insiders or laterally-moved threat actors. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Integrity and availability compromise in Oracle Siebel CRM Integration's Open Integration component (versions 25.12 through 26.6) allows a high-privileged remote attacker over HTTP to corrupt or destroy critical data and trigger a complete denial of service, with confirmed scope change meaning successful exploitation may cascade into additional integrated downstream products. The attack requires high complexity and pre-existing administrative privileges, limiting opportunistic exploitation, but the cross-system blast radius elevates overall business risk. No public exploit code has been identified and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.