Authentication Bypass
Monthly
Integrity and availability compromise in Oracle Siebel CRM Integration's Open Integration component (versions 25.12 through 26.6) allows a high-privileged remote attacker over HTTP to corrupt or destroy critical data and trigger a complete denial of service, with confirmed scope change meaning successful exploitation may cascade into additional integrated downstream products. The attack requires high complexity and pre-existing administrative privileges, limiting opportunistic exploitation, but the cross-system blast radius elevates overall business risk. No public exploit code has been identified and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data disclosure in Oracle Siebel CRM Integration (versions 25.12 through 26.6) allows a low-privileged authenticated attacker to access critical or complete CRM data via HTTP by exploiting an authentication bypass in the Open Integration component. The scope change (S:C) in the CVSS vector means successful exploitation can extend data exposure beyond Siebel CRM Integration to additional integrated Oracle products. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and no user-interaction requirement make this readily actionable for any attacker holding even minimal valid credentials.
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is possible by an unauthenticated remote attacker over HTTP, per Oracle's August 2026 Critical Patch Update. Affected releases span Siebel CRM Integration 25.12 through 26.6, and successful exploitation yields complete takeover of the Integration component with full confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the unauthenticated, low-complexity network profile makes it a high-priority patch item.
Remote authentication bypass in Oracle Siebel CRM Integration (Open Integration component, versions 25.12-26.6) allows unauthenticated network attackers via HTTP to achieve full confidentiality and integrity compromise of CRM data when a victim user interacts with attacker-controlled content. The vulnerability enables unauthorized read, create, delete, and modification access to all Siebel CRM Integration accessible data. Tagged as an Authentication Bypass by Oracle and scored CVSS 8.1 (High), no public exploit code or CISA KEV listing has been identified at time of analysis.
Siebel CRM Integration versions 25.12 through 26.6 expose a network-exploitable flaw in the Open Integration component that permits a low-privileged attacker to achieve full system takeover via crafted HTTP requests under high-complexity conditions. The CVSS 3.1 score of 8.5 reflects a scope change (S:C) alongside full confidentiality, integrity, and availability impact, meaning successful exploitation can cascade to other Oracle and third-party systems connected through the integration layer. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed the issue in the August 2026 Critical Security Patch Update.
Authentication bypass in Oracle Siebel CRM Integration (Open Integration component, versions 25.12-26.6) allows a remote unauthenticated attacker reachable over HTTP to gain unauthorized read and write access to critical CRM data, with a confirmed scope change meaning successful exploitation can cascade to impact additional integrated systems beyond Siebel itself. The AC:H rating indicates exploitation is difficult and likely requires meeting specific environmental or timing conditions, tempering the urgency implied by the 8.7 CVSS score. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is achievable by a low-privileged, network-based attacker over HTTP, with a scope change that lets attacks significantly impact additional products beyond the vulnerable component. Affected releases span 25.12 through 26.6, and Oracle rates it CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss (component takeover). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of low attack complexity, low privilege requirement, and scope change makes it a top-tier patch priority.
Unauthorized data access and partial data manipulation in Oracle Siebel CRM's Data Archival component exposes critical CRM data to low-privileged network attackers via HTTP. Affected versions 25.12 through 26.6 allow an authenticated low-privileged user to gain complete read access to all Siebel CRM Administration accessible data and perform unauthorized write operations on a subset of that data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the 'Authentication Bypass' tag suggests the flaw enables privilege escalation beyond the attacker's authorized scope within the application.
Unauthenticated network exploitation of the Data Archival component in Oracle Siebel CRM Administration exposes complete CRM data to unauthorized access over HTTP. Affecting versions 25.12 through 26.6, the vulnerability carries a CVSS 3.1 score of 8.6 with a confirmed scope change, meaning successful exploitation can cascade to impact additional Oracle or integrated enterprise products beyond the Siebel CRM Administration interface itself. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this a high-priority patching target for any organization with internet-exposed Siebel administrative interfaces.
Remote takeover of Oracle Siebel CRM Administration is possible via its Data Archival component, where an unauthenticated attacker with only HTTP network access can fully compromise the module. Oracle rates this CVSS 9.8 with high confidentiality, integrity, and availability impact, and it was disclosed in the August 2026 Oracle Critical Patch Update. At time of analysis there is no public exploit identified and no CISA KEV listing, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch for Siebel operators.
Privilege abuse and cross-product compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 lets an attacker holding only low-level network credentials read and tamper with all data the product can reach, and - because of a scope change - pivot to significantly impact additional Oracle Hyperion components beyond Calculation Manager. Oracle rates it CVSS 3.1 9.6 with high confidentiality and integrity impact but no availability impact, and the vendor tags it as an authentication-bypass-class flaw in the Security component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged authenticated user with logon access to the host to fully compromise the system, resulting in complete loss of confidentiality, integrity, and availability. The vulnerability resides in the Installation and Configuration component and is characterized by Oracle as 'easily exploitable,' with a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis, though the Oracle August 2026 Critical Patch Update addresses this flaw.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a security bypass flaw in its Security component that allows low-privileged, authenticated network attackers to obtain unauthorized read access to critical or complete application data over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) confirms a scope change, meaning successful exploitation can propagate beyond Calculation Manager to compromise other Oracle Hyperion products in the same environment. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the vendor-tagged 'Authentication Bypass' classification and low attack complexity make this a credible risk for any enterprise running this EPM release.
Unauthenticated remote access to sensitive data is possible in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via an authentication bypass in the Installation and Configuration component exposed over HTTP. An attacker with network access can achieve complete read access to all data accessible by the Hyperion infrastructure layer without any credentials or user interaction. No public exploit has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog, but the trivial exploitation profile (AV:N/AC:L/PR:N/UI:N) represents a meaningful confidentiality risk for any organization running this specific version.
Unauthenticated remote information disclosure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes critical financial planning and performance management data over HTTP. The authentication bypass flaw in the Installation and Configuration component allows a network-adjacent attacker with no credentials to gain complete read access to all data accessible within the Hyperion environment. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low-complexity, zero-authentication attack vector makes this a high-priority patching target for any enterprise running the affected version.
Unauthenticated remote exploitation of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via HTTP allows an attacker to read a subset of accessible data, perform unauthorized inserts, updates, or deletes, and cause a partial denial of service against the Installation and Configuration component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms low attack complexity with no authentication required, making this trivially reachable for any attacker with network access to the service. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthorized data exposure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows unauthenticated remote attackers to access critical or complete sensitive data via HTTP. The vulnerability resides in the Installation and Configuration component and is tagged as an authentication bypass, consistent with the CVSS PR:N rating. No public exploit has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this a high-priority patching target for any organization running the affected version.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by an unauthenticated attacker positioned on the same physical network segment as the affected host, exploiting a flaw in the Installation and Configuration component. The CVSS vector confirms adjacent-network vector (AV:A) with high attack complexity (AC:H), meaning exploitation requires specific conditions but no credentials. Despite the adjacent-network constraint limiting broad internet exposure, successful exploitation yields complete compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible by a remote, unauthenticated attacker over HTTP against the Installation and Configuration component. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit or CISA KEV listing has been identified at the time of analysis, so this is a pre-exploitation, patch-now situation rather than confirmed active exploitation.
Full product takeover in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Installation and Configuration component) allows a remote, unauthenticated attacker to compromise the platform over HTTP, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and requires no user interaction. No public exploit is identified at time of analysis, but the trivially exploitable, network-facing nature makes it a top-tier patching priority for affected Oracle EPM deployments.
Complete takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible via HTTP by an unauthenticated remote attacker, per Oracle's Critical Patch Update of August 2026. The flaw resides in the Installation and Configuration component and carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication, low-complexity profile makes it a high-priority patch.
Full system takeover of Oracle Cost Management (versions 12.2.3-12.2.15) is achievable by a highly privileged network attacker via HTTP, resulting in complete compromise of confidentiality, integrity, and availability. The vulnerability resides in the Cost Planning component of Oracle E-Business Suite and is characterized by Oracle as 'easily exploitable' - meaning low attack complexity once credentials are obtained. No public exploit code or CISA KEV listing has been identified at time of analysis.
Complete takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible for a remote, unauthenticated attacker sending crafted HTTP requests to the Installation and Configuration component. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and was disclosed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network attack profile makes it a high-priority patch item.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes an unauthenticated authentication bypass over HTTPS in its Installation and Configuration component, enabling remote attackers to gain complete read access and full create, delete, or modify capabilities over all data accessible to the platform. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms no credentials or user interaction are required, though the High attack complexity means exploitation demands specific technical preconditions rather than trivial scanning. No public exploit code and no CISA KEV listing have been identified at time of analysis; the issue is formally acknowledged in Oracle's August 2026 Critical Security Patch Update advisory.
Local data compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 enables a low-privileged local OS user to fully breach confidentiality and integrity of all data accessible to the Hyperion platform via a flaw in the Installation and Configuration component. Tagged as an authentication bypass, the vulnerability suggests internal Hyperion access controls fail to restrict a minimally-privileged local account from accessing or manipulating critical data beyond its authorization. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes a local privilege abuse path in its Installation and Configuration component, enabling a low-privileged authenticated user with system logon to gain unauthorized read and write access to all critical Hyperion data. The CVSS 3.1 score of 7.1 (High) reflects high confidentiality and integrity impacts, though the local attack vector constrains the attacker pool to insiders or those with pre-existing system access. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated network exploitation of Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows remote attackers to obtain complete unauthorized access to critical data, with confirmed scope change affecting additional Oracle Hyperion products beyond the directly targeted component. The vulnerability resides in the Installation and Configuration component, is tagged as an Authentication Bypass, and is accessible via multiple network protocols with no complexity barrier. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 3.1 base score of 8.6 reflects the elevated risk from scope change and high confidentiality impact. The Oracle August 2026 CSPU advisory (EUVD-2026-61533) is the primary disclosure source.
Full system takeover is achievable against Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via unauthenticated HTTP requests targeting the Lifecycle Management component. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates network-exploitable, authentication-free access, though the high attack complexity (AC:H) suggests a non-trivial exploitation barrier such as a race condition, specific timing requirement, or environmental precondition. Successful exploitation yields complete confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis.
High-severity data disclosure and partial integrity compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged network attacker to gain complete unauthorized read access to all data accessible within the platform, with additional unauthorized insert, update, and delete capability against a subset of that data. The flaw resides in the Common Security component - the centralized authentication and authorization layer of the Hyperion EPM suite - and carries a CVSS scope-change indicator (S:C) confirming that successful exploitation can affect additional Hyperion products beyond the initially targeted component. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though the cross-scope confidentiality and integrity impacts in a financial EPM context make it a meaningful business risk for affected organizations.
Privilege escalation to full takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.6) lets a low-privileged attacker with only HTTP network access fully compromise the application and, because of a scope change, meaningfully impact additional connected products. Oracle rates it CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact; it was disclosed in the Oracle Critical Patch Update of August 2026. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data access and modification in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by low-privileged network attackers via the Common Events component over HTTP. The vulnerability enables complete confidentiality and integrity compromise of all Hyperion-accessible data without requiring elevated privileges or user interaction, yielding a CVSS 3.1 base score of 8.1. Oracle addressed this issue in the August 2026 Critical Patch Update; no public exploit has been identified at time of analysis.
Full takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by a remote unauthenticated attacker via HTTP, exploiting the Common Events component. The CVSS vector confirms no authentication or user interaction is required, though high attack complexity (AC:H) indicates exploitation is not trivial and likely requires specific timing, configuration state, or precise request crafting. Successful exploitation yields complete compromise of confidentiality, integrity, and availability, consistent with a system takeover - no public exploit or CISA KEV listing identified at time of analysis.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by a low-privileged attacker over HTTP, exploiting the Common Events component with no user interaction required. The CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and availability impact, consistent with the vendor's own characterization of the outcome as a complete system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a credible threat for any organization running the affected version.
Authentication bypass in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes the Common Security component to unauthenticated remote attackers over HTTPS, enabling complete read and write access to all Hyperion-accessible data. The high attack complexity (AC:H) constrains opportunistic exploitation, but successful attacks result in both full confidentiality and integrity compromise with no availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Purchasing (E-Business Suite component: Internal Operations), versions 12.2.3 through 12.2.15, exposes critical data to unauthorized read and write operations by low-privileged authenticated network attackers over HTTP. The vulnerability is tagged as an Authentication Bypass, suggesting that a user with minimal system privileges can circumvent authorization controls to access or manipulate purchasing data beyond their permitted scope - including complete confidentiality and integrity compromise of all Oracle Purchasing accessible data. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but the low attack complexity and broad affected version range make this a meaningful priority for Oracle EBS deployments.
The Common Events component of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes an unauthenticated network-accessible attack path requiring victim interaction, enabling complete unauthorized read access to all Hyperion-accessible data and limited write capability through a scope-changing exploit. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) combined with the Authentication Bypass tag and scope change indicator is strongly consistent with a client-side injection flaw - such as reflected XSS or CSRF - in the Common Events interface that can hijack or bypass authenticated session controls. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Full system takeover is achievable in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via a network-accessible SQL attack vector targeting the Common Events component. A low-privileged authenticated attacker who can meet the high-complexity exploitation conditions may fully compromise confidentiality, integrity, and availability of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor-confirmed total impact - described explicitly as 'takeover' - warrants priority patching in any environment running the affected version.
Unauthorized data access and modification in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows authenticated low-privileged attackers to bypass access controls in the Common Security component via HTTP, gaining read and write access to all critical EPM platform data. The 'Authentication Bypass' tag combined with a PR:L CVSS vector indicates an authorization bypass scenario: a minimal valid account is required but is sufficient to exceed intended access boundaries across confidentiality and integrity dimensions. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by unauthenticated remote attackers via HTTP, targeting the Common Events component. The CVSS 3.1 score of 8.1 reflects maximum CIA impact (C:H/I:H/A:H) offset by high attack complexity (AC:H), indicating that while no credentials are required, specific conditions must be met to exploit the vulnerability. No public exploit code or active exploitation has been identified at time of analysis, but Oracle's August 2026 CPU advisory confirms the issue and a patch is available.
Unauthorized data disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to exfiltrate critical or all accessible Hyperion data via crafted HTTP requests to the Common Events component. The CVSS scope change (S:C) indicates exploitation can cascade beyond the directly targeted component to impact additional Oracle Hyperion products sharing the infrastructure. No public exploit or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag suggests the flaw enables privilege escalation beyond the attacker's initial access level.
Privilege-escalating data compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Lifecycle Management component) lets a low-privileged attacker with HTTP network access read, create, modify, or delete critical data across the platform. The scope-change design means the flaw pivots beyond Hyperion to significantly impact additional connected products, and the vendor's own tag of 'Authentication Bypass' plus a CVSS 9.6 mark it as a high-priority Critical Patch Update item. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and network vector make it an attractive target.
Full system takeover of Oracle Work in Process (Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker via HTTP, with no user interaction required. The Internal Operations component contains an easily exploitable flaw that yields complete compromise of confidentiality, integrity, and availability - consistent with an application-level takeover. No public exploit or active exploitation has been identified at time of analysis; a vendor patch was released as part of the Oracle Critical Patch Update (CPU) August 2026.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a high-privileged, network-exploitable vulnerability in its Security component that enables complete unauthorized read access to all data accessible by the application, with additional limited integrity and availability impacts. The CVSS scope change (S:C) is a critical signal: successful exploitation can significantly affect other products within the same Oracle Hyperion suite deployment, amplifying organizational risk beyond the directly targeted component. No public exploit identified at time of analysis, and no CISA KEV listing; however, the combination of scope change and high confidentiality impact warrants prioritization in Oracle Hyperion deployments.
Oracle Work in Process (WIP) versions 12.2.3 through 12.2.15, a manufacturing module within Oracle E-Business Suite, exposes its Internal Operations component over HTTP to low-privileged authenticated attackers who can trigger a complete service hang or crash alongside unauthorized data modification. The attack requires no user interaction and is characterized as easily exploitable by Oracle's own advisory language, giving it outsized operational impact for manufacturing environments dependent on WIP for production scheduling. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Full product takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Common Events component) is possible by an unauthenticated remote attacker sending crafted HTTP requests. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable exploitation with no privileges or user interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the 9.8 base score and unauthenticated nature make it a high-priority patch target.
Compromise of Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by a low-privileged, network-authenticated attacker over HTTP targeting the Siebel Cloud Manager component. Successful exploitation yields unauthorized creation, deletion, or modification of critical CRM data (high integrity impact), partial unauthorized read of CRM data (low confidentiality impact), and the ability to cause a complete, repeatable denial-of-service crash of the application. No public exploit code and no CISA KEV listing are confirmed at time of analysis; EPSS data was not supplied in the source intelligence.
Local privilege escalation in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) enables a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the application via the Siebel Cloud Manager component. Successful exploitation results in complete application takeover with high confidentiality, integrity, and availability impacts. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote compromise of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible through the Siebel Cloud Manager component via crafted HTTP requests, requiring no privileges or user interaction. An attacker can gain full read access to all Siebel CRM Cloud data, perform limited unauthorized writes, and cause a partial denial of service, and because the flaw carries a scope change, exploitation can significantly impact additional connected products beyond Siebel itself. Rated CVSS 9.9; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Oracle Flow Manufacturing versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, contains a vulnerability in its Internal Operations component that allows a low-privileged, network-authenticated attacker to fully compromise the system via HTTP with no user interaction required. The vendor characterizes this as 'easily exploitable,' and the CVSS 3.1 score of 8.8 reflects complete loss of confidentiality, integrity, and availability - constituting a full product takeover rather than the narrower 'Information Disclosure' tag in the intelligence metadata would suggest. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Full takeover of Oracle Work in Process (WIP), a manufacturing execution module in Oracle E-Business Suite, is achievable by a low-privileged local attacker exploiting a flaw in the Internal Operations component across versions 12.2.3 through 12.2.15. The CVSS vector (AV:L/AC:H/PR:L) constrains exploitation to authenticated infrastructure-level access with high attack complexity, significantly limiting opportunistic or remote attack paths. No public exploit code or CISA KEV listing has been identified at time of analysis; however, successful exploitation yields complete compromise of confidentiality, integrity, and availability of the WIP instance.
Oracle Email Center versions 12.2.3 through 12.2.15 contains a network-exploitable authentication bypass in its Message Component that allows unauthenticated remote attackers to gain unauthorized access to critical data and perform limited data manipulation via HTTP, contingent on victim user interaction. The scope change embedded in the CVSS vector (S:C) indicates successful exploitation can extend impact beyond Email Center to other Oracle E-Business Suite components, materially amplifying real-world risk beyond the immediate application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this vulnerability in the August 2026 Critical Patch Update.
Unauthenticated adjacent-network exploitation of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) via the Siebel Cloud Manager component allows complete read and write access to all CRM data without credentials. The CVSS vector (AV:A/AC:L/PR:N/UI:N) confirms low-complexity, zero-authentication exploitation, constrained only by the requirement for physical or logical adjacency to the target network segment. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the authentication bypass tag and high integrity/confidentiality impact make this a serious concern for any environment with exposed CRM infrastructure.
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by any low-privileged, network-accessible attacker via HTTP against the Siebel Cloud Manager component, with no user interaction required. Oracle classifies this as 'easily exploitable' and the CVSS vector confirms high impact across confidentiality, integrity, and availability - consistent with a complete system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range across four years of releases materially raises real-world risk for unpatched enterprise deployments.
Oracle MES for Process Manufacturing versions 12.2.3 through 12.2.15 exposes unauthenticated remote attackers to complete confidentiality compromise and partial integrity loss via HTTP, contingent on a victim's interaction. The scope change in the CVSS vector confirms that a successful attack can cascade beyond the MES module itself into additional Oracle E-Business Suite components. No public exploit code or CISA KEV active-exploitation confirmation exists at time of analysis, but the low attack complexity and zero privilege requirement make this a credible phishing or watering-hole vector against manufacturing-sector targets.
Local privilege abuse in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) allows a low-privileged OS-level user on the hosting infrastructure to compromise the Siebel Cloud Manager component, achieving full read access to all CRM application data and limited write access, with a confirmed scope change extending impact to additional co-hosted products. The attack vector is local infrastructure access, making this primarily an insider threat or post-compromise lateral movement risk rather than an external internet-facing exposure. No public exploit has been identified, and Oracle addressed this vulnerability in the August 2026 Critical Patch Update (CPU Aug 2026).
High-privileged remote exploitation of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) via the Siebel Cloud Manager component enables full confidentiality and integrity compromise of Siebel data, with a documented scope change allowing cascading impact on additional Oracle products in the environment. Oracle's August 2026 Critical Security Patch Update discloses a CVSS 3.1 base score of 8.7, reflecting network-accessible exploitation requiring no interaction but demanding high-privilege credentials. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data disclosure in Oracle Financials Common Modules (Oracle E-Business Suite 12.2.3-12.2.15) allows a low-privileged authenticated attacker with HTTP network access to bypass access controls in the Common Components layer, gaining unauthorized read access to critical or complete financial data. The scope change (S:C) confirmed in the CVSS vector means successful exploitation can cascade into data exposure across additional Oracle EBS products beyond the directly vulnerable module. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this a straightforward exploitation path for any authenticated EBS user.
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications exposes a network-accessible, low-complexity attack path that allows any low-privileged authenticated user to fully take over the application via HTTP. Affected versions span 22.3 through 26.6, a multi-year range covering a substantial portion of the deployed base. No public exploit has been identified at time of analysis; however, Oracle's own characterization of this as 'easily exploitable' and the complete C/I/A impact make this a high-priority remediation target from the August 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3-26.6) allows a low-privileged, network-authenticated attacker to read the entirety of accessible CRM data and perform limited unauthorized data writes via standard HTTP requests. The vulnerability carries a confirmed scope change, meaning successful exploitation of the Siebel Cloud Manager component can cascade to compromise data in additional integrated Oracle products beyond the initial target. No public exploit code has been identified at time of analysis, but the low attack complexity combined with only a low-privilege requirement makes this a realistic and urgent patching priority for any organization running a Siebel CRM Cloud deployment.
Unauthorized data access and manipulation in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by low-privileged, network-connected attackers via HTTP against the Siebel Cloud Manager component. Successful exploitation grants complete read access to all CRM data and the ability to create, delete, or modify critical records, with no availability disruption to the service itself. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity and low privilege requirement lower the bar for a targeted threat actor with valid credentials.
Full takeover of Oracle U.S. Federal Financials (versions 12.2.3 through 12.2.15) is achievable by a low-privileged attacker over HTTP, with successful exploitation resulting in complete compromise of confidentiality, integrity, and availability. The Internal Operations component within Oracle E-Business Suite exposes this attack surface to any authenticated network user, requiring no user interaction and no elevated permissions beyond a basic account. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and high impact make this a priority patching target for affected federal agencies.
Full application takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.6, lets a remote unauthenticated attacker fully compromise the system over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) with a 9.8 base score and full high impact on confidentiality, integrity, and availability marks this as a pre-authentication, network-reachable critical flaw disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivially-exploitable, unauthenticated profile makes it a high-priority patch target.
Privilege-based takeover of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible via the Siebel Cloud Manager component, where a low-privileged attacker with HTTP network access can fully compromise the application. Because the flaw carries a scope change, successful attacks can significantly impact additional connected products beyond Siebel itself. Rated CVSS 3.1 9.9 with full confidentiality, integrity, and availability impact; no public exploit identified at time of analysis.
Full takeover of PeopleSoft Enterprise CC Common Application Objects version 9.2 is achievable by an unauthenticated remote attacker via the Oracle Net protocol. Despite the high-severity classification (CVSS 8.1), the attack complexity is rated High, meaning specific technical conditions must be satisfied for exploitation to succeed. No public exploit code exists at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the full C:H/I:H/A:H impact (confidentiality, integrity, and availability) makes this a meaningful risk for organizations running PeopleSoft 9.2 in network-accessible configurations.
Unauthorized data exposure and partial denial-of-service in Oracle Complex Maintenance, Repair and Overhaul (CMRO) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker to read critical or complete CMRO application data across a scope boundary into additional Oracle E-Business Suite components. The vulnerability resides in the Production component and is exploitable over HTTP without user interaction, though high attack complexity limits opportunistic exploitation. No public exploit code or CISA KEV listing exists at time of analysis; Oracle has issued remediation via the August 2026 Critical Patch Update.
Oracle BI Publisher's BI Platform Security component allows a low-privileged, network-adjacent attacker to compromise confidentiality, integrity, and availability of the platform via HTTP without user interaction. Affected versions span the full supported lifecycle - 8.2.0.0.0, 12.2.1.4.0, and the current 26.01.0.0.0 - making this broadly applicable across Oracle Analytics deployments. The flaw is tagged as an authentication bypass, meaning a minimally authenticated user may escalate access well beyond their assigned privileges to read or destroy critical report data and partially disrupt service. No public exploit or CISA KEV listing has been identified at time of analysis.
Remote unauthenticated exploitation of Oracle Business Intelligence Enterprise Edition's Pod Admin component allows attackers to access critical analytics data and cause partial service disruption over HTTP without credentials. Versions 8.2.0.0.0 and 26.01.0.0.0 are confirmed affected, with a CVSS 3.1 score of 8.2 reflecting low attack complexity and no authentication or user interaction requirement. No public exploit has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog; Oracle has addressed it in the August 2026 Critical Patch Update.
Full platform takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is achievable by a local attacker holding low-privileged OS credentials on the host where the Agent Next Gen component executes. Oracle's advisory explicitly characterizes this as 'easily exploitable,' with no user interaction and no elevated authentication beyond an initial local logon required. No public exploit has been identified at time of analysis, but the combination of low attack complexity, high-impact outcome across all three pillars, and Oracle's own severity language makes this a priority for any enterprise Oracle infrastructure team.
Unauthorized data access in Oracle Enterprise Asset Management (E-Business Suite, Linear Asset Management component), versions 12.2.3 through 12.2.15, is achievable by a low-privileged authenticated network attacker over HTTP when a victim interacts with attacker-controlled content, resulting in complete confidentiality exposure and limited integrity compromise with a confirmed scope change to additional products. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C) combined with an Authentication Bypass tag from the reporter suggests a client-side attack pathway - likely cross-site scripting or a similar injection technique - where a victim must interact with attacker-influenced material to trigger the exploit. No public exploit code has been identified and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Local authentication bypass in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows any user with OS-level logon access to the hosting infrastructure to read all data managed by the Content Server component without Oracle application credentials. The scope change designation (S:C in the CVSS vector) indicates successful exploitation may further compromise additional Oracle Fusion Middleware products co-located on the same host. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Full takeover of Oracle Hyperion Calculation Manager version 11.2.25.0.000 is achievable by an unauthenticated remote attacker over HTTP, resulting in complete loss of confidentiality, integrity, and availability. The attack is classified as difficult to exploit (AC:H), meaning specific conditions must align, but no credentials or user interaction are required once those conditions are met. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the severity of impact warrants priority patching for any affected deployment.
Local privilege escalation in Oracle WebCenter Content's Content Server component allows low-privileged infrastructure users to achieve full system takeover across versions 12.2.1.4.0 and 14.1.2.0.0. Oracle classifies this as 'easily exploitable,' requiring only a low-privileged local logon to the host server - no network access or user interaction needed - with complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the severity of the takeover outcome and low exploitation complexity elevate practical risk for affected deployments.
Full system takeover of Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by a low-privileged, network-connected attacker exploiting the Content Server component via HTTP, provided a separate victim user performs some form of interaction. Despite the severe outcome - complete compromise of confidentiality, integrity, and availability - the CVSS vector signals above-average exploitation complexity (AC:H) and a mandatory human-interaction requirement (UI:R), meaning opportunistic, automated attacks are unlikely. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Remote authentication bypass in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to gain unauthorized access to all content managed by the platform and perform limited data modification, provided a victim user interacts with attacker-controlled material. The Oracle August 2026 CPU advisory confirms both supported release trains are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of unauthenticated network access, low complexity, and a high confidentiality impact makes this a priority patch for any Oracle Fusion Middleware deployment.
Unauthenticated remote exploitation of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 via HTTP allows an attacker to create, delete, or modify critical platform-managed data through the Event Management component, with secondary impacts on confidentiality and service availability. The Oracle-published CVSS 8.6 score reflects a low-complexity, no-privilege-required attack path, making this accessible to non-sophisticated threat actors with network access. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.
Full platform takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is achievable by any low-privileged attacker with HTTP access to the Application Config Console component. The CVSS 3.1 score of 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms low attack complexity, no user interaction, and full confidentiality, integrity, and availability impact - directly corroborated by Oracle's own characterization of the outcome as complete platform compromise. No public exploit has been identified at time of analysis, but Oracle has released a fix via the August 2026 Critical Security Patch Update.
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows unauthenticated network attackers to fully compromise both confidentiality and integrity of all data accessible within the product via HTTP. The flaw resides in the Security component and, once triggered, grants read, creation, deletion, and modification access to critical data - impacts consistent with complete data ownership. Human interaction from a victim is required (UI:R), suggesting a CSRF-style or socially-engineered delivery vector; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Full system compromise of Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by a low-privileged network attacker via HTTP, with the Security component identified as the vulnerable surface. The CVSS 3.1 score of 8.8 reflects high impacts across confidentiality, integrity, and availability, consistent with Oracle's own characterization of complete product 'takeover.' No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the low attack complexity and minimal privilege requirements make this a credible near-term exploitation target.
Full takeover of Oracle JD Edwards EnterpriseOne Tools is achievable by a low-privileged remote attacker via HTTP, affecting all 9.2.x releases through 9.2.26.4. The vulnerability resides in the Installation Security component and requires only a low-privileged account with no user interaction, which Oracle itself classifies as 'easily exploitable.' No public exploit code or CISA KEV listing has been identified at time of analysis, but the complete C/I/A impact profile represents a critical business risk for organizations running JD Edwards ERP environments.
Full compromise of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.4) is possible via the Web Runtime SEC component, where an unauthenticated attacker with only HTTP network access can achieve complete takeover of the product. Oracle rates this CVSS 3.1 9.8 with full confidentiality, integrity, and availability loss and describes it as 'easily exploitable,' meaning no special skill or preconditions are needed. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network-facing nature makes it a high-priority patch item.
Unauthorized data access and manipulation in Oracle JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.4 is achievable by any low-privileged network attacker over HTTP, with no user interaction required. Tagged as an authentication bypass in the E1 IOT Orchestrator Security component, the vulnerability exposes both confidentiality and integrity of all data accessible to the Orchestrator - including critical business records - to unauthorized reads, creates, deletes, and modifications. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range make this a credible risk for all unpatched deployments.
Remote data compromise in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0-9.2.26.4) allows a low-privileged authenticated attacker to fully breach confidentiality and integrity of critical ERP data via HTTP, with no user interaction required. The vulnerability resides in the Business Logic Infra SEC component and is tagged as an Authentication Bypass, indicating the flaw permits unauthorized escalation beyond the attacker's assigned privilege level. No public exploit has been identified at time of analysis; Oracle's August 2026 Critical Patch Update is the designated remediation vehicle.
Full system takeover is achievable against JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.4 by an unauthenticated remote attacker over TLS, exploiting a flaw in the E1 IOT Orchestrator Security component. Successful exploitation results in complete compromise of confidentiality, integrity, and availability - effectively a full orchestrator takeover. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the high-severity impact warrants priority attention for Oracle JD Edwards deployments.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes critical data and partial availability loss to low-privileged network attackers via a flaw in its Security component, accessible over HTTP. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms easy network exploitation requiring only a low-privilege account with no interaction, yielding high confidentiality impact and partial denial of service. Notably, the 'Authentication Bypass' tag in the intelligence data suggests the effective exploitation barrier may be lower than the PR:L metric implies. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Full compromise of Oracle Internet Directory (OID) LDAP Server is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a remote unauthenticated attacker reaching the LDAP service over the network can take over the directory instance. The flaw scores CVSS 9.8 with high confidentiality, integrity, and availability impact and is addressed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Privilege escalation to full takeover in Oracle Internet Directory (OID) 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access over LDAP to fully compromise the directory server, with a scope change that can significantly impact other products relying on it. Rated CVSS 9.9 with high confidentiality, integrity, and availability impact, it was reported by Oracle and addressed in the August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Internet Directory (OID) is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 through its OID LDAP Server component, where an unauthenticated remote attacker with LDAP network access can fully compromise the directory service. Rated CVSS 10.0 with a scope change (S:C), successful exploitation can pivot beyond OID to significantly impact additional products that depend on it. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the maximum severity and identity-infrastructure role make this a top-priority patch.
Unauthenticated remote data exposure in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allows network-based attackers to access critical or all portal-accessible data via HTTP with no privileges or user interaction required. Tagged as an Authentication Bypass in the Oracle CPUAUG2026 advisory, the vulnerability carries a changed scope, meaning successful exploitation can cascade to impact additional Oracle Fusion Middleware products integrated with the portal. No public exploit has been identified at time of analysis, and remediation is available through Oracle's Critical Security Patch Update for August 2026.
Full takeover of Oracle WebCenter Portal is achievable by an unauthenticated remote attacker via HTTP, affecting the Runtime Tools component in versions 12.2.1.4.0 and 14.1.2.0.0 of the Fusion Middleware stack. The CVSS vector rates this 8.1 due to high attack complexity (AC:H), meaning exploitation requires specific but unspecified preconditions to be met - yet successful exploitation yields complete compromise of confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the Oracle CPU August 2026 advisory confirms the vulnerability is vendor-acknowledged.
Unauthenticated remote compromise of Oracle WebCenter Portal's Runtime Tools component exposes critical data through an authentication bypass vulnerability patched in Oracle's August 2026 Critical Patch Update. Affected versions 12.2.1.4.0 and 14.1.2.0.0 allow any network-accessible attacker to gain complete read access to all data handled by the portal - and, due to a confirmed scope change, potentially reach data in additional connected Oracle Fusion Middleware products. No public exploit or KEV listing is confirmed at time of analysis, but the absence of authentication requirements and low attack complexity make this a high-priority remediation target.
Integrity and availability compromise in Oracle Siebel CRM Integration's Open Integration component (versions 25.12 through 26.6) allows a high-privileged remote attacker over HTTP to corrupt or destroy critical data and trigger a complete denial of service, with confirmed scope change meaning successful exploitation may cascade into additional integrated downstream products. The attack requires high complexity and pre-existing administrative privileges, limiting opportunistic exploitation, but the cross-system blast radius elevates overall business risk. No public exploit code has been identified and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthorized data disclosure in Oracle Siebel CRM Integration (versions 25.12 through 26.6) allows a low-privileged authenticated attacker to access critical or complete CRM data via HTTP by exploiting an authentication bypass in the Open Integration component. The scope change (S:C) in the CVSS vector means successful exploitation can extend data exposure beyond Siebel CRM Integration to additional integrated Oracle products. No public exploit code or CISA KEV listing exists at time of analysis, but the low attack complexity and no user-interaction requirement make this readily actionable for any attacker holding even minimal valid credentials.
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is possible by an unauthenticated remote attacker over HTTP, per Oracle's August 2026 Critical Patch Update. Affected releases span Siebel CRM Integration 25.12 through 26.6, and successful exploitation yields complete takeover of the Integration component with full confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the unauthenticated, low-complexity network profile makes it a high-priority patch item.
Remote authentication bypass in Oracle Siebel CRM Integration (Open Integration component, versions 25.12-26.6) allows unauthenticated network attackers via HTTP to achieve full confidentiality and integrity compromise of CRM data when a victim user interacts with attacker-controlled content. The vulnerability enables unauthorized read, create, delete, and modification access to all Siebel CRM Integration accessible data. Tagged as an Authentication Bypass by Oracle and scored CVSS 8.1 (High), no public exploit code or CISA KEV listing has been identified at time of analysis.
Siebel CRM Integration versions 25.12 through 26.6 expose a network-exploitable flaw in the Open Integration component that permits a low-privileged attacker to achieve full system takeover via crafted HTTP requests under high-complexity conditions. The CVSS 3.1 score of 8.5 reflects a scope change (S:C) alongside full confidentiality, integrity, and availability impact, meaning successful exploitation can cascade to other Oracle and third-party systems connected through the integration layer. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed the issue in the August 2026 Critical Security Patch Update.
Authentication bypass in Oracle Siebel CRM Integration (Open Integration component, versions 25.12-26.6) allows a remote unauthenticated attacker reachable over HTTP to gain unauthorized read and write access to critical CRM data, with a confirmed scope change meaning successful exploitation can cascade to impact additional integrated systems beyond Siebel itself. The AC:H rating indicates exploitation is difficult and likely requires meeting specific environmental or timing conditions, tempering the urgency implied by the 8.7 CVSS score. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Full compromise of Oracle Siebel CRM Integration (Open Integration component) is achievable by a low-privileged, network-based attacker over HTTP, with a scope change that lets attacks significantly impact additional products beyond the vulnerable component. Affected releases span 25.12 through 26.6, and Oracle rates it CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss (component takeover). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of low attack complexity, low privilege requirement, and scope change makes it a top-tier patch priority.
Unauthorized data access and partial data manipulation in Oracle Siebel CRM's Data Archival component exposes critical CRM data to low-privileged network attackers via HTTP. Affected versions 25.12 through 26.6 allow an authenticated low-privileged user to gain complete read access to all Siebel CRM Administration accessible data and perform unauthorized write operations on a subset of that data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the 'Authentication Bypass' tag suggests the flaw enables privilege escalation beyond the attacker's authorized scope within the application.
Unauthenticated network exploitation of the Data Archival component in Oracle Siebel CRM Administration exposes complete CRM data to unauthorized access over HTTP. Affecting versions 25.12 through 26.6, the vulnerability carries a CVSS 3.1 score of 8.6 with a confirmed scope change, meaning successful exploitation can cascade to impact additional Oracle or integrated enterprise products beyond the Siebel CRM Administration interface itself. No public exploit or CISA KEV listing has been identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this a high-priority patching target for any organization with internet-exposed Siebel administrative interfaces.
Remote takeover of Oracle Siebel CRM Administration is possible via its Data Archival component, where an unauthenticated attacker with only HTTP network access can fully compromise the module. Oracle rates this CVSS 9.8 with high confidentiality, integrity, and availability impact, and it was disclosed in the August 2026 Oracle Critical Patch Update. At time of analysis there is no public exploit identified and no CISA KEV listing, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch for Siebel operators.
Privilege abuse and cross-product compromise in Oracle Hyperion Calculation Manager 11.2.25.0.000 lets an attacker holding only low-level network credentials read and tamper with all data the product can reach, and - because of a scope change - pivot to significantly impact additional Oracle Hyperion components beyond Calculation Manager. Oracle rates it CVSS 3.1 9.6 with high confidentiality and integrity impact but no availability impact, and the vendor tags it as an authentication-bypass-class flaw in the Security component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged authenticated user with logon access to the host to fully compromise the system, resulting in complete loss of confidentiality, integrity, and availability. The vulnerability resides in the Installation and Configuration component and is characterized by Oracle as 'easily exploitable,' with a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis, though the Oracle August 2026 Critical Patch Update addresses this flaw.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a security bypass flaw in its Security component that allows low-privileged, authenticated network attackers to obtain unauthorized read access to critical or complete application data over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) confirms a scope change, meaning successful exploitation can propagate beyond Calculation Manager to compromise other Oracle Hyperion products in the same environment. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the vendor-tagged 'Authentication Bypass' classification and low attack complexity make this a credible risk for any enterprise running this EPM release.
Unauthenticated remote access to sensitive data is possible in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via an authentication bypass in the Installation and Configuration component exposed over HTTP. An attacker with network access can achieve complete read access to all data accessible by the Hyperion infrastructure layer without any credentials or user interaction. No public exploit has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog, but the trivial exploitation profile (AV:N/AC:L/PR:N/UI:N) represents a meaningful confidentiality risk for any organization running this specific version.
Unauthenticated remote information disclosure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes critical financial planning and performance management data over HTTP. The authentication bypass flaw in the Installation and Configuration component allows a network-adjacent attacker with no credentials to gain complete read access to all data accessible within the Hyperion environment. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low-complexity, zero-authentication attack vector makes this a high-priority patching target for any enterprise running the affected version.
Unauthenticated remote exploitation of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via HTTP allows an attacker to read a subset of accessible data, perform unauthorized inserts, updates, or deletes, and cause a partial denial of service against the Installation and Configuration component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms low attack complexity with no authentication required, making this trivially reachable for any attacker with network access to the service. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthorized data exposure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows unauthenticated remote attackers to access critical or complete sensitive data via HTTP. The vulnerability resides in the Installation and Configuration component and is tagged as an authentication bypass, consistent with the CVSS PR:N rating. No public exploit has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this a high-priority patching target for any organization running the affected version.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by an unauthenticated attacker positioned on the same physical network segment as the affected host, exploiting a flaw in the Installation and Configuration component. The CVSS vector confirms adjacent-network vector (AV:A) with high attack complexity (AC:H), meaning exploitation requires specific conditions but no credentials. Despite the adjacent-network constraint limiting broad internet exposure, successful exploitation yields complete compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible by a remote, unauthenticated attacker over HTTP against the Installation and Configuration component. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and was disclosed in Oracle's August 2026 Critical Patch Update. No public exploit or CISA KEV listing has been identified at the time of analysis, so this is a pre-exploitation, patch-now situation rather than confirmed active exploitation.
Full product takeover in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Installation and Configuration component) allows a remote, unauthenticated attacker to compromise the platform over HTTP, per Oracle's August 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and requires no user interaction. No public exploit is identified at time of analysis, but the trivially exploitable, network-facing nature makes it a top-tier patching priority for affected Oracle EPM deployments.
Complete takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible via HTTP by an unauthenticated remote attacker, per Oracle's Critical Patch Update of August 2026. The flaw resides in the Installation and Configuration component and carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication, low-complexity profile makes it a high-priority patch.
Full system takeover of Oracle Cost Management (versions 12.2.3-12.2.15) is achievable by a highly privileged network attacker via HTTP, resulting in complete compromise of confidentiality, integrity, and availability. The vulnerability resides in the Cost Planning component of Oracle E-Business Suite and is characterized by Oracle as 'easily exploitable' - meaning low attack complexity once credentials are obtained. No public exploit code or CISA KEV listing has been identified at time of analysis.
Complete takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is possible for a remote, unauthenticated attacker sending crafted HTTP requests to the Installation and Configuration component. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, and was disclosed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network attack profile makes it a high-priority patch item.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes an unauthenticated authentication bypass over HTTPS in its Installation and Configuration component, enabling remote attackers to gain complete read access and full create, delete, or modify capabilities over all data accessible to the platform. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms no credentials or user interaction are required, though the High attack complexity means exploitation demands specific technical preconditions rather than trivial scanning. No public exploit code and no CISA KEV listing have been identified at time of analysis; the issue is formally acknowledged in Oracle's August 2026 Critical Security Patch Update advisory.
Local data compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 enables a low-privileged local OS user to fully breach confidentiality and integrity of all data accessible to the Hyperion platform via a flaw in the Installation and Configuration component. Tagged as an authentication bypass, the vulnerability suggests internal Hyperion access controls fail to restrict a minimally-privileged local account from accessing or manipulating critical data beyond its authorization. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 exposes a local privilege abuse path in its Installation and Configuration component, enabling a low-privileged authenticated user with system logon to gain unauthorized read and write access to all critical Hyperion data. The CVSS 3.1 score of 7.1 (High) reflects high confidentiality and integrity impacts, though the local attack vector constrains the attacker pool to insiders or those with pre-existing system access. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated network exploitation of Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows remote attackers to obtain complete unauthorized access to critical data, with confirmed scope change affecting additional Oracle Hyperion products beyond the directly targeted component. The vulnerability resides in the Installation and Configuration component, is tagged as an Authentication Bypass, and is accessible via multiple network protocols with no complexity barrier. No public exploit or CISA KEV listing has been identified at time of analysis, though the CVSS 3.1 base score of 8.6 reflects the elevated risk from scope change and high confidentiality impact. The Oracle August 2026 CSPU advisory (EUVD-2026-61533) is the primary disclosure source.
Full system takeover is achievable against Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via unauthenticated HTTP requests targeting the Lifecycle Management component. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates network-exploitable, authentication-free access, though the high attack complexity (AC:H) suggests a non-trivial exploitation barrier such as a race condition, specific timing requirement, or environmental precondition. Successful exploitation yields complete confidentiality, integrity, and availability compromise of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis.
High-severity data disclosure and partial integrity compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged network attacker to gain complete unauthorized read access to all data accessible within the platform, with additional unauthorized insert, update, and delete capability against a subset of that data. The flaw resides in the Common Security component - the centralized authentication and authorization layer of the Hyperion EPM suite - and carries a CVSS scope-change indicator (S:C) confirming that successful exploitation can affect additional Hyperion products beyond the initially targeted component. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, though the cross-scope confidentiality and integrity impacts in a financial EPM context make it a meaningful business risk for affected organizations.
Privilege escalation to full takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.6) lets a low-privileged attacker with only HTTP network access fully compromise the application and, because of a scope change, meaningfully impact additional connected products. Oracle rates it CVSS 3.1 9.9 with high confidentiality, integrity, and availability impact; it was disclosed in the Oracle Critical Patch Update of August 2026. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data access and modification in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by low-privileged network attackers via the Common Events component over HTTP. The vulnerability enables complete confidentiality and integrity compromise of all Hyperion-accessible data without requiring elevated privileges or user interaction, yielding a CVSS 3.1 base score of 8.1. Oracle addressed this issue in the August 2026 Critical Patch Update; no public exploit has been identified at time of analysis.
Full takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by a remote unauthenticated attacker via HTTP, exploiting the Common Events component. The CVSS vector confirms no authentication or user interaction is required, though high attack complexity (AC:H) indicates exploitation is not trivial and likely requires specific timing, configuration state, or precise request crafting. Successful exploitation yields complete compromise of confidentiality, integrity, and availability, consistent with a system takeover - no public exploit or CISA KEV listing identified at time of analysis.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by a low-privileged attacker over HTTP, exploiting the Common Events component with no user interaction required. The CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and availability impact, consistent with the vendor's own characterization of the outcome as a complete system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a credible threat for any organization running the affected version.
Authentication bypass in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes the Common Security component to unauthenticated remote attackers over HTTPS, enabling complete read and write access to all Hyperion-accessible data. The high attack complexity (AC:H) constrains opportunistic exploitation, but successful attacks result in both full confidentiality and integrity compromise with no availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Purchasing (E-Business Suite component: Internal Operations), versions 12.2.3 through 12.2.15, exposes critical data to unauthorized read and write operations by low-privileged authenticated network attackers over HTTP. The vulnerability is tagged as an Authentication Bypass, suggesting that a user with minimal system privileges can circumvent authorization controls to access or manipulate purchasing data beyond their permitted scope - including complete confidentiality and integrity compromise of all Oracle Purchasing accessible data. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present, but the low attack complexity and broad affected version range make this a meaningful priority for Oracle EBS deployments.
The Common Events component of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 exposes an unauthenticated network-accessible attack path requiring victim interaction, enabling complete unauthorized read access to all Hyperion-accessible data and limited write capability through a scope-changing exploit. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) combined with the Authentication Bypass tag and scope change indicator is strongly consistent with a client-side injection flaw - such as reflected XSS or CSRF - in the Common Events interface that can hijack or bypass authenticated session controls. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Full system takeover is achievable in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 via a network-accessible SQL attack vector targeting the Common Events component. A low-privileged authenticated attacker who can meet the high-complexity exploitation conditions may fully compromise confidentiality, integrity, and availability of the affected system. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor-confirmed total impact - described explicitly as 'takeover' - warrants priority patching in any environment running the affected version.
Unauthorized data access and modification in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows authenticated low-privileged attackers to bypass access controls in the Common Security component via HTTP, gaining read and write access to all critical EPM platform data. The 'Authentication Bypass' tag combined with a PR:L CVSS vector indicates an authorization bypass scenario: a minimal valid account is required but is sufficient to exceed intended access boundaries across confidentiality and integrity dimensions. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by unauthenticated remote attackers via HTTP, targeting the Common Events component. The CVSS 3.1 score of 8.1 reflects maximum CIA impact (C:H/I:H/A:H) offset by high attack complexity (AC:H), indicating that while no credentials are required, specific conditions must be met to exploit the vulnerability. No public exploit code or active exploitation has been identified at time of analysis, but Oracle's August 2026 CPU advisory confirms the issue and a patch is available.
Unauthorized data disclosure in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 allows a low-privileged, network-authenticated attacker to exfiltrate critical or all accessible Hyperion data via crafted HTTP requests to the Common Events component. The CVSS scope change (S:C) indicates exploitation can cascade beyond the directly targeted component to impact additional Oracle Hyperion products sharing the infrastructure. No public exploit or CISA KEV listing has been identified at time of analysis, though the 'Authentication Bypass' tag suggests the flaw enables privilege escalation beyond the attacker's initial access level.
Privilege-escalating data compromise in Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Lifecycle Management component) lets a low-privileged attacker with HTTP network access read, create, modify, or delete critical data across the platform. The scope-change design means the flaw pivots beyond Hyperion to significantly impact additional connected products, and the vendor's own tag of 'Authentication Bypass' plus a CVSS 9.6 mark it as a high-priority Critical Patch Update item. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and network vector make it an attractive target.
Full system takeover of Oracle Work in Process (Oracle E-Business Suite versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker via HTTP, with no user interaction required. The Internal Operations component contains an easily exploitable flaw that yields complete compromise of confidentiality, integrity, and availability - consistent with an application-level takeover. No public exploit or active exploitation has been identified at time of analysis; a vendor patch was released as part of the Oracle Critical Patch Update (CPU) August 2026.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes a high-privileged, network-exploitable vulnerability in its Security component that enables complete unauthorized read access to all data accessible by the application, with additional limited integrity and availability impacts. The CVSS scope change (S:C) is a critical signal: successful exploitation can significantly affect other products within the same Oracle Hyperion suite deployment, amplifying organizational risk beyond the directly targeted component. No public exploit identified at time of analysis, and no CISA KEV listing; however, the combination of scope change and high confidentiality impact warrants prioritization in Oracle Hyperion deployments.
Oracle Work in Process (WIP) versions 12.2.3 through 12.2.15, a manufacturing module within Oracle E-Business Suite, exposes its Internal Operations component over HTTP to low-privileged authenticated attackers who can trigger a complete service hang or crash alongside unauthorized data modification. The attack requires no user interaction and is characterized as easily exploitable by Oracle's own advisory language, giving it outsized operational impact for manufacturing environments dependent on WIP for production scheduling. No public exploit has been identified at time of analysis, and this vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.
Full product takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Common Events component) is possible by an unauthenticated remote attacker sending crafted HTTP requests. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable exploitation with no privileges or user interaction, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the 9.8 base score and unauthenticated nature make it a high-priority patch target.
Compromise of Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by a low-privileged, network-authenticated attacker over HTTP targeting the Siebel Cloud Manager component. Successful exploitation yields unauthorized creation, deletion, or modification of critical CRM data (high integrity impact), partial unauthorized read of CRM data (low confidentiality impact), and the ability to cause a complete, repeatable denial-of-service crash of the application. No public exploit code and no CISA KEV listing are confirmed at time of analysis; EPSS data was not supplied in the source intelligence.
Local privilege escalation in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) enables a low-privileged attacker with logon access to the hosting infrastructure to fully compromise the application via the Siebel Cloud Manager component. Successful exploitation results in complete application takeover with high confidentiality, integrity, and availability impacts. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote compromise of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible through the Siebel Cloud Manager component via crafted HTTP requests, requiring no privileges or user interaction. An attacker can gain full read access to all Siebel CRM Cloud data, perform limited unauthorized writes, and cause a partial denial of service, and because the flaw carries a scope change, exploitation can significantly impact additional connected products beyond Siebel itself. Rated CVSS 9.9; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Oracle Flow Manufacturing versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, contains a vulnerability in its Internal Operations component that allows a low-privileged, network-authenticated attacker to fully compromise the system via HTTP with no user interaction required. The vendor characterizes this as 'easily exploitable,' and the CVSS 3.1 score of 8.8 reflects complete loss of confidentiality, integrity, and availability - constituting a full product takeover rather than the narrower 'Information Disclosure' tag in the intelligence metadata would suggest. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Full takeover of Oracle Work in Process (WIP), a manufacturing execution module in Oracle E-Business Suite, is achievable by a low-privileged local attacker exploiting a flaw in the Internal Operations component across versions 12.2.3 through 12.2.15. The CVSS vector (AV:L/AC:H/PR:L) constrains exploitation to authenticated infrastructure-level access with high attack complexity, significantly limiting opportunistic or remote attack paths. No public exploit code or CISA KEV listing has been identified at time of analysis; however, successful exploitation yields complete compromise of confidentiality, integrity, and availability of the WIP instance.
Oracle Email Center versions 12.2.3 through 12.2.15 contains a network-exploitable authentication bypass in its Message Component that allows unauthenticated remote attackers to gain unauthorized access to critical data and perform limited data manipulation via HTTP, contingent on victim user interaction. The scope change embedded in the CVSS vector (S:C) indicates successful exploitation can extend impact beyond Email Center to other Oracle E-Business Suite components, materially amplifying real-world risk beyond the immediate application boundary. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle addressed this vulnerability in the August 2026 Critical Patch Update.
Unauthenticated adjacent-network exploitation of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) via the Siebel Cloud Manager component allows complete read and write access to all CRM data without credentials. The CVSS vector (AV:A/AC:L/PR:N/UI:N) confirms low-complexity, zero-authentication exploitation, constrained only by the requirement for physical or logical adjacency to the target network segment. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the authentication bypass tag and high integrity/confidentiality impact make this a serious concern for any environment with exposed CRM infrastructure.
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by any low-privileged, network-accessible attacker via HTTP against the Siebel Cloud Manager component, with no user interaction required. Oracle classifies this as 'easily exploitable' and the CVSS vector confirms high impact across confidentiality, integrity, and availability - consistent with a complete system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range across four years of releases materially raises real-world risk for unpatched enterprise deployments.
Oracle MES for Process Manufacturing versions 12.2.3 through 12.2.15 exposes unauthenticated remote attackers to complete confidentiality compromise and partial integrity loss via HTTP, contingent on a victim's interaction. The scope change in the CVSS vector confirms that a successful attack can cascade beyond the MES module itself into additional Oracle E-Business Suite components. No public exploit code or CISA KEV active-exploitation confirmation exists at time of analysis, but the low attack complexity and zero privilege requirement make this a credible phishing or watering-hole vector against manufacturing-sector targets.
Local privilege abuse in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) allows a low-privileged OS-level user on the hosting infrastructure to compromise the Siebel Cloud Manager component, achieving full read access to all CRM application data and limited write access, with a confirmed scope change extending impact to additional co-hosted products. The attack vector is local infrastructure access, making this primarily an insider threat or post-compromise lateral movement risk rather than an external internet-facing exposure. No public exploit has been identified, and Oracle addressed this vulnerability in the August 2026 Critical Patch Update (CPU Aug 2026).
High-privileged remote exploitation of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) via the Siebel Cloud Manager component enables full confidentiality and integrity compromise of Siebel data, with a documented scope change allowing cascading impact on additional Oracle products in the environment. Oracle's August 2026 Critical Security Patch Update discloses a CVSS 3.1 base score of 8.7, reflecting network-accessible exploitation requiring no interaction but demanding high-privilege credentials. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthorized data disclosure in Oracle Financials Common Modules (Oracle E-Business Suite 12.2.3-12.2.15) allows a low-privileged authenticated attacker with HTTP network access to bypass access controls in the Common Components layer, gaining unauthorized read access to critical or complete financial data. The scope change (S:C) confirmed in the CVSS vector means successful exploitation can cascade into data exposure across additional Oracle EBS products beyond the directly vulnerable module. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity makes this a straightforward exploitation path for any authenticated EBS user.
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications exposes a network-accessible, low-complexity attack path that allows any low-privileged authenticated user to fully take over the application via HTTP. Affected versions span 22.3 through 26.6, a multi-year range covering a substantial portion of the deployed base. No public exploit has been identified at time of analysis; however, Oracle's own characterization of this as 'easily exploitable' and the complete C/I/A impact make this a high-priority remediation target from the August 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3-26.6) allows a low-privileged, network-authenticated attacker to read the entirety of accessible CRM data and perform limited unauthorized data writes via standard HTTP requests. The vulnerability carries a confirmed scope change, meaning successful exploitation of the Siebel Cloud Manager component can cascade to compromise data in additional integrated Oracle products beyond the initial target. No public exploit code has been identified at time of analysis, but the low attack complexity combined with only a low-privilege requirement makes this a realistic and urgent patching priority for any organization running a Siebel CRM Cloud deployment.
Unauthorized data access and manipulation in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by low-privileged, network-connected attackers via HTTP against the Siebel Cloud Manager component. Successful exploitation grants complete read access to all CRM data and the ability to create, delete, or modify critical records, with no availability disruption to the service itself. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low attack complexity and low privilege requirement lower the bar for a targeted threat actor with valid credentials.
Full takeover of Oracle U.S. Federal Financials (versions 12.2.3 through 12.2.15) is achievable by a low-privileged attacker over HTTP, with successful exploitation resulting in complete compromise of confidentiality, integrity, and availability. The Internal Operations component within Oracle E-Business Suite exposes this attack surface to any authenticated network user, requiring no user interaction and no elevated permissions beyond a basic account. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and high impact make this a priority patching target for affected federal agencies.
Full application takeover in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.6, lets a remote unauthenticated attacker fully compromise the system over HTTP. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) with a 9.8 base score and full high impact on confidentiality, integrity, and availability marks this as a pre-authentication, network-reachable critical flaw disclosed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivially-exploitable, unauthenticated profile makes it a high-priority patch target.
Privilege-based takeover of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.6) is possible via the Siebel Cloud Manager component, where a low-privileged attacker with HTTP network access can fully compromise the application. Because the flaw carries a scope change, successful attacks can significantly impact additional connected products beyond Siebel itself. Rated CVSS 3.1 9.9 with full confidentiality, integrity, and availability impact; no public exploit identified at time of analysis.
Full takeover of PeopleSoft Enterprise CC Common Application Objects version 9.2 is achievable by an unauthenticated remote attacker via the Oracle Net protocol. Despite the high-severity classification (CVSS 8.1), the attack complexity is rated High, meaning specific technical conditions must be satisfied for exploitation to succeed. No public exploit code exists at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the full C:H/I:H/A:H impact (confidentiality, integrity, and availability) makes this a meaningful risk for organizations running PeopleSoft 9.2 in network-accessible configurations.
Unauthorized data exposure and partial denial-of-service in Oracle Complex Maintenance, Repair and Overhaul (CMRO) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker to read critical or complete CMRO application data across a scope boundary into additional Oracle E-Business Suite components. The vulnerability resides in the Production component and is exploitable over HTTP without user interaction, though high attack complexity limits opportunistic exploitation. No public exploit code or CISA KEV listing exists at time of analysis; Oracle has issued remediation via the August 2026 Critical Patch Update.
Oracle BI Publisher's BI Platform Security component allows a low-privileged, network-adjacent attacker to compromise confidentiality, integrity, and availability of the platform via HTTP without user interaction. Affected versions span the full supported lifecycle - 8.2.0.0.0, 12.2.1.4.0, and the current 26.01.0.0.0 - making this broadly applicable across Oracle Analytics deployments. The flaw is tagged as an authentication bypass, meaning a minimally authenticated user may escalate access well beyond their assigned privileges to read or destroy critical report data and partially disrupt service. No public exploit or CISA KEV listing has been identified at time of analysis.
Remote unauthenticated exploitation of Oracle Business Intelligence Enterprise Edition's Pod Admin component allows attackers to access critical analytics data and cause partial service disruption over HTTP without credentials. Versions 8.2.0.0.0 and 26.01.0.0.0 are confirmed affected, with a CVSS 3.1 score of 8.2 reflecting low attack complexity and no authentication or user interaction requirement. No public exploit has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog; Oracle has addressed it in the August 2026 Critical Patch Update.
Full platform takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is achievable by a local attacker holding low-privileged OS credentials on the host where the Agent Next Gen component executes. Oracle's advisory explicitly characterizes this as 'easily exploitable,' with no user interaction and no elevated authentication beyond an initial local logon required. No public exploit has been identified at time of analysis, but the combination of low attack complexity, high-impact outcome across all three pillars, and Oracle's own severity language makes this a priority for any enterprise Oracle infrastructure team.
Unauthorized data access in Oracle Enterprise Asset Management (E-Business Suite, Linear Asset Management component), versions 12.2.3 through 12.2.15, is achievable by a low-privileged authenticated network attacker over HTTP when a victim interacts with attacker-controlled content, resulting in complete confidentiality exposure and limited integrity compromise with a confirmed scope change to additional products. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C) combined with an Authentication Bypass tag from the reporter suggests a client-side attack pathway - likely cross-site scripting or a similar injection technique - where a victim must interact with attacker-influenced material to trigger the exploit. No public exploit code has been identified and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog at time of analysis.
Local authentication bypass in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows any user with OS-level logon access to the hosting infrastructure to read all data managed by the Content Server component without Oracle application credentials. The scope change designation (S:C in the CVSS vector) indicates successful exploitation may further compromise additional Oracle Fusion Middleware products co-located on the same host. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Full takeover of Oracle Hyperion Calculation Manager version 11.2.25.0.000 is achievable by an unauthenticated remote attacker over HTTP, resulting in complete loss of confidentiality, integrity, and availability. The attack is classified as difficult to exploit (AC:H), meaning specific conditions must align, but no credentials or user interaction are required once those conditions are met. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the severity of impact warrants priority patching for any affected deployment.
Local privilege escalation in Oracle WebCenter Content's Content Server component allows low-privileged infrastructure users to achieve full system takeover across versions 12.2.1.4.0 and 14.1.2.0.0. Oracle classifies this as 'easily exploitable,' requiring only a low-privileged local logon to the host server - no network access or user interaction needed - with complete confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the severity of the takeover outcome and low exploitation complexity elevate practical risk for affected deployments.
Full system takeover of Oracle WebCenter Content (versions 12.2.1.4.0 and 14.1.2.0.0) is achievable by a low-privileged, network-connected attacker exploiting the Content Server component via HTTP, provided a separate victim user performs some form of interaction. Despite the severe outcome - complete compromise of confidentiality, integrity, and availability - the CVSS vector signals above-average exploitation complexity (AC:H) and a mandatory human-interaction requirement (UI:R), meaning opportunistic, automated attacks are unlikely. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Remote authentication bypass in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to gain unauthorized access to all content managed by the platform and perform limited data modification, provided a victim user interacts with attacker-controlled material. The Oracle August 2026 CPU advisory confirms both supported release trains are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of unauthenticated network access, low complexity, and a high confidentiality impact makes this a priority patch for any Oracle Fusion Middleware deployment.
Unauthenticated remote exploitation of Oracle Enterprise Manager Base Platform versions 13.5 and 24.1 via HTTP allows an attacker to create, delete, or modify critical platform-managed data through the Event Management component, with secondary impacts on confidentiality and service availability. The Oracle-published CVSS 8.6 score reflects a low-complexity, no-privilege-required attack path, making this accessible to non-sophisticated threat actors with network access. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.
Full platform takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is achievable by any low-privileged attacker with HTTP access to the Application Config Console component. The CVSS 3.1 score of 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms low attack complexity, no user interaction, and full confidentiality, integrity, and availability impact - directly corroborated by Oracle's own characterization of the outcome as complete platform compromise. No public exploit has been identified at time of analysis, but Oracle has released a fix via the August 2026 Critical Security Patch Update.
Authentication bypass in Oracle Hyperion Calculation Manager 11.2.25.0.000 allows unauthenticated network attackers to fully compromise both confidentiality and integrity of all data accessible within the product via HTTP. The flaw resides in the Security component and, once triggered, grants read, creation, deletion, and modification access to critical data - impacts consistent with complete data ownership. Human interaction from a victim is required (UI:R), suggesting a CSRF-style or socially-engineered delivery vector; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Full system compromise of Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by a low-privileged network attacker via HTTP, with the Security component identified as the vulnerable surface. The CVSS 3.1 score of 8.8 reflects high impacts across confidentiality, integrity, and availability, consistent with Oracle's own characterization of complete product 'takeover.' No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the low attack complexity and minimal privilege requirements make this a credible near-term exploitation target.
Full takeover of Oracle JD Edwards EnterpriseOne Tools is achievable by a low-privileged remote attacker via HTTP, affecting all 9.2.x releases through 9.2.26.4. The vulnerability resides in the Installation Security component and requires only a low-privileged account with no user interaction, which Oracle itself classifies as 'easily exploitable.' No public exploit code or CISA KEV listing has been identified at time of analysis, but the complete C/I/A impact profile represents a critical business risk for organizations running JD Edwards ERP environments.
Full compromise of Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0 through 9.2.26.4) is possible via the Web Runtime SEC component, where an unauthenticated attacker with only HTTP network access can achieve complete takeover of the product. Oracle rates this CVSS 3.1 9.8 with full confidentiality, integrity, and availability loss and describes it as 'easily exploitable,' meaning no special skill or preconditions are needed. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network-facing nature makes it a high-priority patch item.
Unauthorized data access and manipulation in Oracle JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.4 is achievable by any low-privileged network attacker over HTTP, with no user interaction required. Tagged as an authentication bypass in the E1 IOT Orchestrator Security component, the vulnerability exposes both confidentiality and integrity of all data accessible to the Orchestrator - including critical business records - to unauthorized reads, creates, deletes, and modifications. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range make this a credible risk for all unpatched deployments.
Remote data compromise in Oracle JD Edwards EnterpriseOne Tools (versions 9.2.0.0-9.2.26.4) allows a low-privileged authenticated attacker to fully breach confidentiality and integrity of critical ERP data via HTTP, with no user interaction required. The vulnerability resides in the Business Logic Infra SEC component and is tagged as an Authentication Bypass, indicating the flaw permits unauthorized escalation beyond the attacker's assigned privilege level. No public exploit has been identified at time of analysis; Oracle's August 2026 Critical Patch Update is the designated remediation vehicle.
Full system takeover is achievable against JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.4 by an unauthenticated remote attacker over TLS, exploiting a flaw in the E1 IOT Orchestrator Security component. Successful exploitation results in complete compromise of confidentiality, integrity, and availability - effectively a full orchestrator takeover. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the high-severity impact warrants priority attention for Oracle JD Edwards deployments.
Oracle Hyperion Calculation Manager version 11.2.25.0.000 exposes critical data and partial availability loss to low-privileged network attackers via a flaw in its Security component, accessible over HTTP. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms easy network exploitation requiring only a low-privilege account with no interaction, yielding high confidentiality impact and partial denial of service. Notably, the 'Authentication Bypass' tag in the intelligence data suggests the effective exploitation barrier may be lower than the PR:L metric implies. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Full compromise of Oracle Internet Directory (OID) LDAP Server is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, where a remote unauthenticated attacker reaching the LDAP service over the network can take over the directory instance. The flaw scores CVSS 9.8 with high confidentiality, integrity, and availability impact and is addressed in Oracle's August 2026 Critical Patch Update. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Privilege escalation to full takeover in Oracle Internet Directory (OID) 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access over LDAP to fully compromise the directory server, with a scope change that can significantly impact other products relying on it. Rated CVSS 9.9 with high confidentiality, integrity, and availability impact, it was reported by Oracle and addressed in the August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Internet Directory (OID) is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 through its OID LDAP Server component, where an unauthenticated remote attacker with LDAP network access can fully compromise the directory service. Rated CVSS 10.0 with a scope change (S:C), successful exploitation can pivot beyond OID to significantly impact additional products that depend on it. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the maximum severity and identity-infrastructure role make this a top-priority patch.
Unauthenticated remote data exposure in Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 allows network-based attackers to access critical or all portal-accessible data via HTTP with no privileges or user interaction required. Tagged as an Authentication Bypass in the Oracle CPUAUG2026 advisory, the vulnerability carries a changed scope, meaning successful exploitation can cascade to impact additional Oracle Fusion Middleware products integrated with the portal. No public exploit has been identified at time of analysis, and remediation is available through Oracle's Critical Security Patch Update for August 2026.
Full takeover of Oracle WebCenter Portal is achievable by an unauthenticated remote attacker via HTTP, affecting the Runtime Tools component in versions 12.2.1.4.0 and 14.1.2.0.0 of the Fusion Middleware stack. The CVSS vector rates this 8.1 due to high attack complexity (AC:H), meaning exploitation requires specific but unspecified preconditions to be met - yet successful exploitation yields complete compromise of confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the Oracle CPU August 2026 advisory confirms the vulnerability is vendor-acknowledged.
Unauthenticated remote compromise of Oracle WebCenter Portal's Runtime Tools component exposes critical data through an authentication bypass vulnerability patched in Oracle's August 2026 Critical Patch Update. Affected versions 12.2.1.4.0 and 14.1.2.0.0 allow any network-accessible attacker to gain complete read access to all data handled by the portal - and, due to a confirmed scope change, potentially reach data in additional connected Oracle Fusion Middleware products. No public exploit or KEV listing is confirmed at time of analysis, but the absence of authentication requirements and low attack complexity make this a high-priority remediation target.