Authentication Bypass
Monthly
Unauthenticated remote exploitation of Oracle Siebel CRM Integration's REST component across versions 17.0 through 26.6 can yield complete loss of data confidentiality and integrity. Tagged as an authentication bypass, the vulnerability permits network-accessible attackers to read all CRM data and perform unauthorized create, delete, or modify operations without credentials. No public exploit has been identified at time of analysis, and Oracle's August 2026 Critical Patch Update addresses the issue.
Local privilege escalation with scope change in Oracle Siebel CRM's Email Marketing component affects versions 17.0 through 26.6, confirmed via the Oracle August 2026 Critical Security Update advisory (EUVD-2026-61438). Low-privileged attackers with existing logon access to the Siebel infrastructure can, under difficult-to-reproduce conditions, bypass access controls to read or modify critical marketing data and cascade impacts to other integrated Siebel products. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated network exploitation of the Oracle Siebel CRM Marketing component enables critical data theft and unauthorized modification across all Marketing-accessible records. Tagged explicitly as an Authentication Bypass, the flaw allows a remote attacker with no credentials to compromise the confidentiality and integrity of sensitive CRM marketing data via HTTP, affecting all supported versions from 17.0 through 26.6. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the PR:N/UI:N vector means no user interaction or account is required, making the authentication bypass self-sufficient once the high-complexity exploitation conditions are met.
Unauthorized access to critical CRM data and partial data manipulation in Oracle Siebel CRM Deployment (versions 17.0-26.6) is achievable via the Migration component by any low-privileged attacker with HTTP network access, with a documented scope change indicating that successful exploitation can cascade to affect additional Oracle products beyond the directly targeted component. The CVSS 3.1 base score of 8.5 reflects low attack complexity and no user interaction requirement, making exploitation straightforward for any holder of a valid low-privilege credential. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though the breadth of affected versions spanning nearly a decade of releases represents substantial organizational exposure.
Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) contains an authentication bypass flaw enabling unauthenticated network attackers to fully compromise data confidentiality and integrity over HTTPS. The 'Authentication Bypass' tag from the Oracle reporter confirms the vulnerability class: an attacker who satisfies the high-complexity exploitation condition can read all CRM data and perform unauthorized creation, modification, or deletion of records. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis.
Unauthenticated remote access to Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) exposes all CRM integration data to unauthorized disclosure and enables partial denial of service via plain HTTP. The vulnerability requires no credentials, no user interaction, and no special configuration beyond the REST interface being reachable, making it exploitable by any network-adjacent or internet-facing attacker. No public exploit has been identified at time of analysis, but Oracle's Critical Patch Update for August 2026 confirms the issue and its severity classification of CVSS 8.2.
Oracle Siebel CRM Deployment's Server Infrastructure component exposes versions 17.0 through 26.6 to an unauthenticated, network-based authentication bypass over HTTP that can result in complete compromise of CRM data confidentiality and integrity. The high complexity rating (AC:H) tempers immediate mass-exploitation risk, but the Authentication Bypass tag combined with C:H and I:H impact means a successful attacker achieves full read and write access to all CRM-accessible data - including customer records, sales pipelines, and service data - without presenting valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle's Critical Security Patch Update for August 2026 addresses this vulnerability.
Oracle Siebel CRM Deployment's Application Interface component (versions 17.0 through 26.6) exposes complete read and write access to all CRM data to unauthenticated attackers positioned on the adjacent network segment. The CVSS vector confirms zero authentication requirements and low attack complexity, meaning any actor with access to the physical communication segment hosting the Siebel server can silently exfiltrate or corrupt the entire CRM dataset. No active exploitation has been confirmed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, but the authentication bypass classification combined with high confidentiality and integrity impact makes this a credible priority for organizations with insufficiently segmented internal networks.
Full takeover of Oracle Payments (Oracle E-Business Suite, File Transmission component) is possible by remote unauthenticated attackers over HTTP, affecting supported releases 12.2.3 through 12.2.15. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network-facing profile makes it a top-tier patch priority.
Unauthorized data access and partial data manipulation is possible in Oracle Payments (E-Business Suite component: File Transmission) across versions 12.2.3 through 12.2.15 via an authentication bypass exploitable over HTTP. A low-privileged network attacker can obtain complete read access to all Oracle Payments data and perform unauthorized insert, update, or delete operations against a subset of that data. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'easily exploitable' vendor classification combined with low attack complexity elevates real-world risk for unpatched EBS environments.
Integrity and availability compromise in Oracle Siebel Apps - Marketing (versions 17.0 through 26.6) is reachable by any low-privileged, network-authenticated attacker over HTTP with no user interaction required. Successful exploitation allows unauthorized creation, deletion, or modification of critical Marketing data, and can cause a complete denial of service via persistent hang or crash of the Marketing component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a credible threat in environments running unpatched Siebel deployments.
Full takeover of Oracle General Ledger (versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker via HTTP, exploiting an undisclosed flaw in the Internal Operations component of Oracle E-Business Suite. The CVSS vector confirms complete confidentiality, integrity, and availability impact (C:H/I:H/A:H), consistent with application-level takeover. Notably, the intelligence tags classify this as 'Information Disclosure,' which conflicts with the described takeover impact - this discrepancy warrants verification against the Oracle August 2026 CSPU advisory. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Full takeover of Oracle Siebel Apps - Marketing is achievable by any low-privileged attacker with network access via HTTP, affecting all supported versions from 17.0 through 26.6. The CVSS 3.1 score of 8.8 reflects complete compromise of confidentiality, integrity, and availability, meaning an attacker can read, modify, or destroy data and disrupt service entirely. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a realistic threat for any internet- or intranet-exposed Siebel Marketing deployment.
Remote authentication bypass in Oracle Siebel CRM Integration's REST component affects all supported versions from 17.0 through 26.6, enabling unauthenticated network attackers to achieve full read and write access to critical CRM data via crafted HTTPS requests. The vulnerability is tagged Authentication Bypass, indicating that REST API access controls can be circumvented without credentials despite a high attack complexity (AC:H) rating that suggests exploitation requires precise crafting or internal state knowledge. No public exploit identified at time of analysis, but the combination of unauthenticated access and high confidentiality and integrity impact warrants priority patching under Oracle's August 2026 Critical Patch Update.
Full takeover of Oracle Siebel CRM's Marketing component is achievable by a low-privileged, network-accessible attacker exploiting a difficult-to-trigger condition via HTTP, affecting all supported versions from 17.0 through 26.6. Successful exploitation results in complete confidentiality, integrity, and availability compromise of the Marketing module - effectively a full component takeover. No public exploit code has been identified and the vulnerability is not listed in CISA's KEV catalog; however, Oracle's August 2026 Critical Patch Update confirms the flaw and releases a remediation.
Authentication bypass in Oracle Internet Procurement Connector (Oracle E-Business Suite versions 12.2.3 through 12.2.15) allows unauthenticated remote attackers to compromise the Internal Operations component via HTTP, resulting in unauthorized read access to or manipulation of critical procurement data. The CVSS 3.1 score of 7.4 reflects high confidentiality and integrity impacts moderated by high attack complexity (AC:H), meaning exploitation requires specific conditions to be met despite requiring no credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthorized data exfiltration and limited data manipulation in Oracle Siebel Artificial Intelligence (versions 25.12 through 26.6) is achievable by any low-privileged, network-adjacent attacker over HTTP, with no user interaction required. Oracle's own advisory classifies this as 'easily exploitable,' and the scope change metric confirms that successful exploitation can cascade beyond the AI component to impact additional Siebel CRM products. No public exploit or CISA KEV listing has been identified at time of analysis, though the low exploitation complexity and broad confidentiality impact (C:H) make this a high-priority patching target for Oracle Siebel deployments.
Unauthenticated adjacent-network exploitation of Oracle Siebel CRM's Search component allows complete read and write access to all CRM data across versions 17.0 through 26.6. Successful exploitation enables creation, deletion, and modification of critical data as well as full confidentiality compromise without any prior authentication or user interaction. No public exploit identified at time of analysis, and this vulnerability is not currently listed in CISA KEV, though its low-complexity, unauthenticated nature makes it a credible priority for organizations with exposed Siebel deployments.
Unauthenticated remote compromise of Oracle Siebel CRM's Siebel Apps - Marketing component (versions 17.0 through 26.6) allows a network attacker over HTTP to read all Marketing-accessible data and to force a complete, repeatable denial of service. The flaw is rated CVSS 3.1 9.1 and is tagged as an authentication bypass, meaning no credentials are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of no authentication, low attack complexity, and high confidentiality/availability impact makes it a high-priority patch.
Local privilege escalation in Oracle Siebel CRM Deployment (versions 17.0 through 26.6) allows a low-privileged local attacker to achieve full takeover of the affected installation, impacting confidentiality, integrity, and availability. The attack targets the Installation component and requires only logon access to the host infrastructure - no remote vector or user interaction is involved. No public exploit code and no active exploitation have been identified at time of analysis; however, the low attack complexity (AC:L) makes post-access exploitation straightforward.
Unauthorized data disclosure and partial service disruption affect Oracle Siebel CRM's Marketing component across versions 17.0 through 26.6, exploitable by a low-privileged authenticated attacker via HTTP without requiring user interaction. The flaw enables complete read access to all data within the Siebel Apps - Marketing scope alongside degraded service availability, as confirmed by Oracle's August 2026 Critical Security Patch Update. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog.
Full system takeover in Oracle Siebel CRM's Marketing component is achievable by low-privileged authenticated attackers over HTTP across all versions 17.0 through 26.6. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no user interaction required, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the straightforward exploitation conditions and full-triad impact make this a high-priority patch target for any organization running exposed Siebel Marketing instances.
Oracle General Ledger within E-Business Suite versions 12.2.3 through 12.2.15 exposes critical financial data to high-privileged network attackers through a flaw in the Internal Operations component accessible over HTTP. Successful exploitation grants complete read access to all General Ledger data and partial write capability, with a confirmed scope change meaning compromise can cascade to additional Oracle EBS products. Disclosed through Oracle's August 2026 Critical Patch Update, no public exploit code has been identified at time of analysis.
Complete system takeover of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61 through 8.63) is achievable by unauthenticated network attackers via HTTP, specifically through the PIA Core Technology component. Despite the high attack complexity rating (AC:H), successful exploitation yields full confidentiality, integrity, and availability compromise - effectively handing an attacker control over the PeopleSoft environment. No public exploit code or CISA KEV listing has been identified at time of analysis, but the severity of the impact warrants prioritized remediation through Oracle's August 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Web Services Manager (OWSM), part of Oracle Fusion Middleware's Web Services Security component, lets a remote unauthenticated attacker read, create, delete, or modify all OWSM-accessible data over HTTP. Tagged as an authentication bypass, it affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Compromise of Oracle WebCenter Portal's Composer component - versions 12.2.1.4.0 and 14.1.2.0.0 - allows an authenticated low-privilege attacker over HTTP to achieve high-integrity impact, including unauthorized creation, deletion, and modification of critical portal data, limited confidentiality exposure, and partial denial of service. The CVSS scope change (S:C) indicates exploitation can cascade to additional Oracle Fusion Middleware products beyond WebCenter Portal itself. Disclosed in Oracle's August 2026 Critical Security Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle WebCenter Portal is achievable by a low-privileged network attacker targeting the Composer component via Java RMI in versions 12.2.1.4.0 and 14.1.2.0.0. Oracle describes the vulnerability as 'easily exploitable,' with the CVSS 3.1 score of 8.8 reflecting complete Confidentiality, Integrity, and Availability compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and this CVE has not appeared in the CISA Known Exploited Vulnerabilities catalog, though it is disclosed as part of Oracle's Critical Patch Update for August 2026.
Privilege-escalating account/system takeover in Oracle WebCenter Portal (Fusion Middleware, Composer component) versions 12.2.1.4.0 and 14.1.2.0.0 lets an authenticated low-privileged attacker reach full compromise over HTTP. Because the flaw carries a scope change (S:C), successful exploitation can pivot beyond WebCenter Portal to impact additional products, and Oracle rates it CVSS 9.9. No public exploit identified at time of analysis, but the near-maximum score, low attack complexity, and minimal privilege requirement make it a top-tier patch priority.
Full takeover of Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged, network-authenticated attacker targeting the Composer component over HTTP. Oracle's own advisory characterizes the vulnerability as 'easily exploitable,' with high impact across confidentiality, integrity, and availability and no user interaction required. No public exploit or CISA KEV listing exists at time of analysis, but the combination of low attack complexity, low privilege requirement, and complete portal compromise warrants urgent patching priority for all affected deployments.
Unauthenticated data compromise and denial of service in Oracle WebCenter Portal (Fusion Middleware, Portlet Services component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A remote attacker with only HTTP network access and no credentials can read or fully access all portal-accessible data and can force a hang or repeatable crash (complete DoS) of the portal. Oracle rates it CVSS 3.1 9.1 and flags it as easily exploitable; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Identity Manager (Oracle Fusion Middleware) affects the OIM Legacy UI component in versions 12.2.1.4.0 and 14.1.2.1.0, allowing an unauthenticated attacker with only HTTP network access to fully compromise the identity-management platform. The maximum CVSS 3.1 base score of 9.8 reflects complete loss of confidentiality, integrity, and availability, and because OIM governs enterprise identity and access, compromise cascades to every system it provisions. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile makes it a high priority for immediate patching.
Remote network compromise of Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 enables a low-privileged authenticated attacker to achieve full system takeover via the Authentication Engine over HTTP, with no user interaction required. Oracle's August 2026 Critical Patch Update advisory rates this CVSS 8.8 (High) and explicitly describes it as 'easily exploitable,' with complete confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Oracle Identity Manager (OIM Legacy UI) in versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware allows a low-privileged remote attacker to fully take over the identity management platform via the T3 and IIOP protocols. The attack requires no user interaction and low complexity, resulting in complete confidentiality, integrity, and availability compromise of the OIM system. No public exploit has been identified at time of analysis, but the low barrier to exploitation makes this a critical patching priority for any enterprise running the affected versions.
Full product takeover in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (Legacy UI component) allows a remote, unauthenticated attacker to compromise the identity-governance platform over HTTP. Rated CVSS 9.8 with high confidentiality, integrity, and availability impact, this issue is trivially exploitable and requires no user interaction; at time of analysis there is no public exploit identified and it is not listed in CISA KEV. Because OIM brokers provisioning and access to downstream enterprise systems, a takeover here has cascading blast radius across connected accounts and applications.
Full compromise of Oracle Identity Manager (OIM Legacy UI component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 is achievable by a low-privileged attacker over HTTP, resulting in complete takeover of the OIM instance. Because the flaw carries a scope change, successful exploitation can significantly impact additional connected products beyond OIM itself, elevating this from a single-product compromise to a potential identity-fabric breach. Disclosed in Oracle's August 2026 Critical Patch Update with a CVSS 3.1 base score of 9.9; no public exploit identified at time of analysis.
Full system takeover of Oracle Identity Manager is achievable by low-privileged network attackers via the OIM Legacy UI component using the T3 or IIOP protocols. Affected versions are 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware's Identity Manager product. Successful exploitation yields complete compromise of confidentiality, integrity, and availability, effectively handing an attacker full control over the identity management platform. No public exploit has been identified at the time of analysis, and this issue is disclosed as part of Oracle's Critical Patch Update for August 2026.
Full takeover of Oracle Identity Manager via its Legacy UI component is achievable by any low-privileged, network-authenticated attacker over HTTP. Affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, with complete confidentiality, integrity, and availability impact - Oracle's own advisory characterizes the outcome as system takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity (AC:L) and minimal privilege bar (PR:L) make this a realistic target once any authenticated foothold exists in an exposed OIM deployment.
Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 expose a high-severity Security component flaw enabling authenticated high-privileged attackers to compromise the system via HTTP, with confirmed scope change affecting additional downstream products. Exploitation allows complete unauthorized read and write access to all OIM-accessible data, including critical identity and access management records. No public exploit has been identified at time of analysis, and this vulnerability was disclosed as part of Oracle's Critical Patch Update for August 2026.
Remote takeover of Oracle WebLogic Server is possible when a low-privileged attacker reaches the server over the T3 or IIOP protocols, abusing a flaw in the Core component to fully compromise the host. Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, and because the attack carries a scope change it can significantly impact products beyond WebLogic itself. Oracle rates it CVSS 9.9; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the CVSS profile matches historically weaponized WebLogic T3/IIOP deserialization bugs.
Unauthenticated remote data disclosure in Oracle WebLogic Server Core allows network-accessible attackers to exfiltrate all data reachable by the server via the T3 or IIOP protocols, with confirmed scope change impact on additional downstream systems. Tagged as an Authentication Bypass by Oracle, this affects four active release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - making it a broad exposure across the WebLogic installed base. No public exploit identified at time of analysis, and remediation is available through Oracle's Critical Patch Update (CPU) August 2026.
Remote takeover of Oracle WebLogic Server is possible when an unauthenticated attacker reaches the server's IIOP interface over the network, letting them fully compromise the Core component with high confidentiality, integrity, and availability impact. The flaw affects supported releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and is rated CVSS 9.8 by Oracle. No public exploit identified at time of analysis, but the pattern matches prior high-impact WebLogic IIOP deserialization flaws that were rapidly weaponized.
Unauthenticated remote takeover in Oracle WebLogic Server (Fusion Middleware Core) lets a network attacker fully compromise the server via the T3 and IIOP protocols with no credentials and no user interaction. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and Oracle rates it CVSS 9.8 with full confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, but the class of flaw and the low attack complexity make it a top-priority patch.
Unauthorized data access and modification in Oracle General Ledger (E-Business Suite versions 12.2.3-12.2.15) can be achieved by a low-privileged network attacker targeting the Internal Operations component via HTTP. Successful exploitation grants complete read and write access to critical GL financial data plus partial availability disruption - a severe outcome for any organization relying on EBS for financial record integrity. The 'Authentication Bypass' tag suggests the vulnerability allows a low-privileged authenticated user to escalate effective access beyond their authorization level; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote integrity compromise and denial-of-service in Oracle WebLogic Server's Core component allows a low-privileged, network-accessible attacker to corrupt or destroy critical application data and crash the server via HTTP. All currently supported release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are affected, giving this vulnerability a wide blast radius across enterprise Oracle Fusion Middleware deployments. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified, but Oracle's own characterization of the flaw as 'easily exploitable' combined with only a low-privilege account requirement makes patching under the August 2026 CPU urgent.
Full server takeover of Oracle WebLogic Server is achievable by a low-privileged network attacker exploiting a flaw in the Core component via the T3 or IIOP protocols. All four currently supported versions - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are confirmed affected per Oracle's Critical Patch Update for August 2026. Although High Attack Complexity (AC:H) limits opportunistic mass exploitation, successful attacks yield complete confidentiality, integrity, and availability compromise; no public exploit identified at time of analysis.
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a remote, unauthenticated attacker with network access via the T3 or IIOP protocols to completely compromise affected instances (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0). The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity and availability impact and requires no privileges or user interaction. There is no public exploit identified at time of analysis, but WebLogic T3/IIOP deserialization flaws are historically rapid targets for weaponization.
Remote unauthenticated denial-of-service and partial data integrity compromise in Oracle MySQL Cluster's NDB Operator component allows network attackers to crash or hang the cluster and perform unauthorized data modifications. Affected versions span three active release lines: 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the low attack complexity and zero authentication requirement make exploitation straightforward against exposed deployments.
Unauthenticated data tampering and denial of service in Oracle Hospitality Simphony POS (versions 19.8-19.8.5, 19.9-19.9.3, 19.10-19.10.1) lets a remote attacker with only HTTP network access create, delete, or modify all Simphony-accessible data and force a repeatable crash. Oracle rates it CVSS 3.1 9.1 with high integrity and availability impact and describes it as easily exploitable, though there is no public exploit identified at time of analysis. It was reported by Oracle's own security team and fixed in the August 2026 Critical Patch Update.
Unauthenticated remote access to Oracle Hospitality Simphony's POS component enables complete unauthorized read access to all application data via an HTTP-based authentication bypass across three actively supported release lines. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms that no credentials, interaction, or special configuration are required - any network-reachable attacker can exploit the flaw. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated remote data exposure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows any network-accessible attacker to read critical or all data managed by the platform via HTTP, without any credentials or user interaction. The Lifecycle Management component contains an authentication bypass (per vendor tags) that collapses access controls entirely, exposing sensitive enterprise performance management data. No public exploit or CISA KEV listing is confirmed at time of analysis, but the low-complexity, zero-privilege CVSS vector indicates straightforward exploitability for any attacker with network reach.
Unauthenticated remote access to sensitive financial data is possible in Oracle Hyperion Financial Reporting version 11.2.25.0.000 via an authentication bypass in its Server component, exploitable over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no interaction, and no special configuration is required - making this trivially exploitable from any network-reachable position. Impact is limited to confidentiality, but the data exposed (financial reporting data) carries significant business and regulatory risk. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Privilege escalation in Blueprint Studio (versions prior to 2.5.2) allows any authenticated Home Assistant user to access and invoke administrator-only backend API actions - including arbitrary Home Assistant service calls, configuration file reads and writes, template rendering, file uploads, and terminal helper access - because the Python backend in api.py authenticated requests for valid HA user identity but never verified admin status. The fix in 2.5.2, released 2026-05-26, introduces a consistent `_require_admin()` guard across all GET, POST, stream, upload, and WebSocket handlers. No public exploit or active exploitation has been identified at time of analysis, but the authorization bypass is structurally trivial for any non-admin HA account holder.
Two-Factor Authentication is fully bypassed in Froxlor's API layer (versions prior to 2.3.7), allowing any holder of a valid API key and secret to invoke all API operations - including management of domains, DNS records, SSL certificates, email, FTP, and databases - without supplying the configured TOTP code. The web UI enforces 2FA correctly via `FroxlorTwoFactorAuth::verifyCode()`, but the API authentication function `FroxlorRPC::validateAuth` in `lib/Froxlor/Api/FroxlorRPC.php` checks only key validity, expiration, API permission, and account status, with zero references to 2FA logic across the entire `lib/Froxlor/Api/` directory. Publicly available exploit code exists per the GHSA advisory, which documents a confirmed PoC environment against Froxlor 2.3.5 with a 2FA-enabled admin account.
Full account takeover is possible in Keycloak's legacy client-initiated account-linking endpoint due to a predictable hash (CWE-341) used as a CSRF-like protection mechanism. An attacker who controls a registered OIDC client in the target realm can forge a valid linking URL that silently binds a victim's Keycloak account to the attacker's external identity, enabling subsequent login as the victim. No public exploit or CISA KEV listing is identified at time of analysis; Red Hat has released patches via RHSA-2026:56523 and RHSA-2026:56524.
Credential and 2FA-secret disclosure in the Froxlor hosting control panel (versions before 2.3.8) lets an authenticated API caller retrieve password hashes and Base32 TOTP seeds through the Customers, Admins, and Ftps API commands. The affected get()/listing() endpoints run full-row queries (SELECT *) and return the raw rows via $this->response(...) without stripping the password, type_2fa, or data_2fa fields. A detailed proof-of-concept exists (curl calls plus a Python TOTP-code generator); there is no public exploit identified as being used in active attacks and the issue is not in CISA KEV.
Privilege escalation and authorization bypass in Netflix Lemur before 1.9.3 permits any authenticated non-read-only user to revoke arbitrary TLS certificates fleet-wide, causing denial of service across all managed endpoints. Two chained API flaws - an unchecked upload endpoint and a row-scoped revocation check - allow an attacker to manufacture a shadow Lemur database record aliasing any real CA-side certificate, then trigger the issuer plugin to revoke the genuine certificate using stored authority credentials. No public exploit code has been identified, but the attack path is fully disclosed in the GitHub security advisory GHSA-pxmc-2ffp-8j67 and the fix commit.
Broken object-level authorization in Netflix Lemur versions 0.5.0 through 1.9.3 permits any authenticated non-read-only user to silently hijack TLS certificate lifecycle management for certificates they do not own. By supplying arbitrary certificate identifiers in the replaces[] or replacements field of create, upload, or edit requests, an attacker triggers an append listener that suppresses the victim certificate's expiry notifications, marks it as replaced, and excludes it from get_all_pending_reissue - after which certificate_rotate may deploy the attacker's certificate to production endpoints previously serving the victim. No public exploit code has been identified at time of analysis, and no KEV entry exists, but the integrity and availability impact on managed TLS fleets is high; the fix shipped in version 1.9.3.
Credential exposure in Netflix Lemur's destination API allows any authenticated low-privilege user to retrieve plaintext SFTP passwords and private key passphrases stored in destination plugin configurations. Affected versions prior to 1.9.3 expose GET /api/1/destinations endpoints without the admin_permission guard applied to sibling write handlers, and DestinationOutputSchema serializes raw plugin options - including fields marked as storing passwords - without redaction. The CVSS Scope:Changed rating reflects that the exposed SFTP credentials extend attacker reach beyond Lemur itself to remote certificate-deployment infrastructure. No public exploit code has been identified, though the fix commit is publicly available and the attack path is trivially constructable from the diff.
Authorization bypass in FUXA (a web-based SCADA/HMI/dashboard platform) versions 1.3.2 and earlier lets a remote unauthenticated attacker escalate to full runtime control when the Node-RED integration is enabled in secure mode. The allowDashboard gate in server/integrations/node-red/index.js verifies a JWT's signature but never inspects the decoded identity, so a low-privilege guest token that anyone can mint from POST /api/heartbeat is accepted for the privileged Node-RED editor and flow-deployment API. With no second adminAuth gate on Node-RED, the attacker deploys function nodes or calls fuxa.runScript to seize project data, configuration, scripts, and - where nodeRedUnsafeModules is enabled - operating-system command execution. No public exploit identified at time of analysis, but the fix (v1.3.3) and PR diff publicly reveal the flaw.
Insufficient session expiration in FUXA 1.3.2 and earlier allows a former privileged user to continue minting valid privileged JWTs long after their account has been deleted, disabled, demoted, or had roles removed. The refresh endpoint falls back to stale group data embedded in the token rather than enforcing a live database check, and the heartbeat endpoint re-signs inbound JWT claims without validating the current database record, enabling indefinite session extension through cookie rotation. No public exploit code has been identified at time of analysis, but the fix is available in v1.3.3 and the GitHub advisory and patch commit are public.
Privilege escalation in NVIDIA NVOS network switch operating system occurs when PKA-only SSH mode is enabled, inadvertently activating a secondary authentication channel that can be exploited if the default device password has not been rotated per NVIDIA's hardening guidance. An adjacent-network attacker who discovers this condition can authenticate via the alternative path using default credentials, bypassing the intended PKA-only enforcement and gaining elevated access to the switch. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis, but the infrastructure impact of a compromised network switch is significant.
Authentication bypass in the GBIF Integrated Publishing Toolkit (IPT) before version 3.3.4 lets a remote attacker reach the initial-setup functionality, which stays unauthenticated and exposed until the server's first reboot, and abuse it to seize administrative control of the instance. The flaw was reported by Mandiant, a vendor patch (3.3.4) is available, and there is no public exploit identified at time of analysis. Rated CVSS 4.0 9.1 (Critical), exploitation is gated by a timing/deployment window rather than by raw network reach.
Authentication bypass in the GBIF Integrated Publishing Toolkit (IPT) before version 3.3.4 lets remote attackers gain full administrative control by reaching initial-setup functionality that is never disabled after installation completes. Because the setup workflow - meant to run once on a fresh, unconfigured instance - stays reachable on production servers, an attacker can re-drive it to seize the admin role. Reported by Mandiant (MNDT-2026-0014); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Missing authorization enforcement in Dell PowerStore storage appliances allows any attacker who has gained control of a mapped host connected to the array to read from or write to LUNs beyond those assigned to that initiator, effectively nullifying per-initiator LUN masking. Affected models span the full PowerStore T and Q product lines (500T through 7000T and beyond), as disclosed by Dell under advisory DSA-2026-330. No public exploit code or CISA KEV listing has been identified at time of analysis, but the complete C/I/A impact triplet reflects the severity of unrestricted storage access, particularly in multi-tenant or converged infrastructure environments where multiple workloads share the same array.
Account pre-registration hijacking in Saleor's GraphQL `accountRegister` and `confirmAccount` mutation flow allows an unauthenticated attacker to claim a victim's identity by registering an account under the victim's email address before the legitimate user does. When the victim clicks the activation link sent to their inbox, Saleor activates the attacker-created account and - across versions 2.10.0rc1 through the respective patched releases - automatically merges anonymous orders and gift-card data for that email without verifying the account password or any additional authentication factor, exposing order history, names, postal addresses, and phone numbers to the attacker. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is low-friction and fully reconstructible from the public GitHub advisory.
Broken object-level authorization in authentik's enterprise Remote Access Control (RAC) module exposes every configured RDP, SSH, and VNC endpoint - including stored connection credentials - to any authenticated user, irrespective of their assigned application access. Versions prior to 2026.2.6 and 2026.5.5 are affected; the flaw exists in both the endpoint listing API (which omits per-user access filtering) and the connection initiation flow (which does not validate that the requested endpoint belongs to the application through which the user is launching). No public exploit has been identified at time of analysis, though the attack requires only a valid authentik account and delivers full interactive access to infrastructure the attacker was never authorized to reach.
Device trust bypass in authentik enterprise Google Chrome stages allows an authenticated attacker to skip Google Verified Access API attestation and complete authentication from an unverified device. Enterprise deployments using either the Google Chrome Endpoint stage with mode=REQUIRED or the deprecated Google Chrome Device Trust Connector (GDTC) stage are affected in all supported versions prior to 2026.2.6 and 2026.5.5. No public exploit is identified at time of analysis, but the bypass requires only that the attacker submit the stage form without triggering the verification iframe - a trivially reproducible action for any credential holder.
Authentication bypass in @neo4j/graphql exposes admin-restricted custom-resolver fields to any authenticated user holding a legitimately issued, non-admin JWT. When both a type-level @authentication directive and a stricter field-level @authentication directive are declared on the same Query or Mutation type, the library silently discards the field-level rule and evaluates only the coarser type-level check - meaning a roles: ["user"] token is sufficient to invoke a field that requires roles_INCLUDES: "admin". Affected across three major branches (5.2.0-5.12.14, 6.0.0-6.6.4, 7.0.0-7.5.x); no public exploit or CISA KEV listing identified at time of analysis.
Product review management in Vvveb CMS prior to 1.0.8.4 exposes a broken object-level authorization flaw (CWE-639) allowing any authenticated low-privileged Vendor to read, modify, and delete product reviews belonging to other Vendors. The backend SQL queries for all supported database drivers (mysqli, pgsql, sqlite) accept a caller-controlled product_review_id without validating ownership against the requesting admin_id, enabling cross-Vendor review manipulation. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS 7.6 High score reflects significant integrity impact in multi-vendor marketplace deployments.
Post revision operations in Vvveb CMS prior to 1.0.8.4 expose an Insecure Direct Object Reference that allows any authenticated Author-role user to read, restore, or delete revision records belonging to other authors. The affected controller passes caller-supplied post_id, language_id, and created_at values directly to SQL queries without enforcing admin_id ownership, enabling cross-author access across list, read, restore, and delete operations. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 1.0.8.4.
Authorization bypass in Vvveb CMS prior to version 1.0.8.4 allows authenticated low-privileged Vendor accounts to perform unauthorized read, edit, status-change, and delete operations on product Q&A entries belonging to other Vendors. The backend SQL query files for all three supported database engines (MySQL, PostgreSQL, SQLite) accepted a caller-controlled product_question_id without joining the product table to verify that the question belongs to a product owned by the current admin_id. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the fix is confirmed in the released version 1.0.8.4 via GitHub advisory GHSA-cjhq-xqq3-6xv8.
Insecure direct object reference in Vvveb CMS prior to 1.0.8.4 allows any authenticated Vendor-role user to read, restore, and delete product revision records belonging to other Vendors by supplying arbitrary caller-controlled product_id values to the backend revision controller. All Vvveb multi-vendor deployments running versions before 1.0.8.4 are affected across MySQL, PostgreSQL, and SQLite database backends. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low barrier to entry - only a valid Vendor session is required - makes lateral abuse within shared storefronts realistic.
Insecure Direct Object Reference in Vvveb CMS prior to 1.0.8.4 allows any authenticated low-privileged Vendor to read, duplicate, or delete products belonging to other Vendors by submitting arbitrary product_id values in backend product operations. The root cause is that the products.php controller passes caller-controlled product_id values to SQL operations without consistently enforcing admin_id scoping - the fix required adding conditional admin_id filtering across six DELETE statements in both MySQL and PostgreSQL query files. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the low exploitation complexity makes it a meaningful business-logic risk for any multi-vendor Vvveb deployment.
Multi-factor authentication bypass in Joomla! CMS versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 allows remote attackers to circumvent 2FA controls and gain authenticated access using only the first-factor credential. Insufficient state validation in the MFA flow exposes a logic path that skips the second-factor verification step entirely. No public exploit or CISA KEV listing has been identified at the time of analysis, though the vulnerability's network accessibility and lack of required privileges make it a meaningful account-takeover risk for any Joomla site with MFA-enrolled users.
Inconsistent access control enforcement in Joomla! CMS REST API webservice endpoints allows authenticated users with insufficient permissions to perform mutation operations that are explicitly restricted in the backend UI, effectively bypassing the platform's ACL system. Affected deployments span Joomla 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2, covering both actively maintained long-term and current release branches. No public exploit code or active exploitation has been confirmed at time of analysis, though the Authentication Bypass classification and CWE-284 root cause indicate the ACL gap is structurally straightforward to discover and abuse by any user with a valid session.
Insecure Direct Object Reference (IDOR) in Vvveb CMS prior to 1.0.8.4 enables any authenticated Author-role user to bypass ownership enforcement and access, duplicate, or permanently delete posts belonging to other authors. The PHP controller `admin/controller/content/posts.php` accepts a caller-controlled `filter[admin_id]` parameter that overrides the server-assigned identity restriction, and the underlying SQL layer (MySQL, PostgreSQL, and SQLite backends) lacked consistent `admin_id` enforcement on delete and list operations. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the patch is available as of release 1.0.8.4.
Insecure Direct Object Reference (IDOR) in Vvveb CMS prior to 1.0.8.4 allows authenticated low-privileged Authors to perform unauthorized comment operations across author boundaries in the admin backend. The admin/controller/content/comment.php and comments.php controllers accept caller-controlled comment_id values without validating that the referenced comment's parent post belongs to the requesting author, enabling cross-author comment enumeration, content manipulation, status changes, and deletion. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network-accessible attack surface make this straightforward for any authenticated low-privilege user to abuse.
Broken object-level authorization in Vvveb CMS prior to 1.0.8.4 allows an authenticated low-privilege Vendor to access, modify, or delete digital assets belonging to any other Vendor by supplying arbitrary digital_asset_id values to the admin digital asset controllers. The flaw spans listing, read, edit, and delete operations across both MySQL and PostgreSQL backends, enabling cross-tenant metadata disclosure, resource link corruption, and permanent data loss. No public exploit code or CISA KEV listing exists at time of analysis, but exploitation is technically trivial for any authenticated Vendor in a multi-vendor deployment.
Broken access control in the Charitable WordPress donation plugin (versions 1.8.11.3 and earlier) allows unauthenticated remote attackers to perform unauthorized write operations against protected plugin functionality. Classified under CWE-862 (Missing Authorization), the flaw reflects absent or bypassed capability and nonce checks on one or more plugin endpoints, enabling integrity-impacting actions without any credentials. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, but the unauthenticated, low-complexity attack surface warrants prompt patching on any internet-exposed WordPress installation running this plugin.
Broken access control in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows unauthenticated remote attackers to perform privileged administrative actions without any credentials. The flaw stems from missing authorization checks (CWE-862), meaning the plugin executes sensitive operations without validating the requester's identity or permission level. With a CVSS 3.1 score of 7.5 and an attack vector of network/no-privileges-required, exploitation is trivially achievable against any WordPress site running the affected plugin; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated arbitrary content deletion in the Breeze WordPress caching plugin (≤ 2.5.12, by Cloudways) exposes any WordPress site running this plugin to remote content destruction without credentials. The missing authorization check (CWE-862) on deletion-capable endpoints allows any internet-facing attacker to trigger content removal, producing high availability impact and minor integrity impact per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H vector. No public exploit or CISA KEV listing has been identified at time of analysis, but the trivial exploitation profile makes rapid weaponization probable once a proof-of-concept surfaces.
Unauthenticated broken access control in ThumbPress WordPress plugin (all versions before 6.5) exposes restricted functionality to remote unauthenticated attackers, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and low attack complexity, making it trivially automatable against any internet-facing WordPress site running the affected plugin. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, vendor-patched version 6.5 is available.
Unauthenticated broken access control in the Online Contact Widget WordPress plugin (versions ≤ 1.3.0) permits any network-accessible attacker to bypass authorization checks entirely, yielding high confidentiality impact against affected WordPress installations. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and minimal complexity, making the attack trivially repeatable at scale. No public exploit code or active exploitation has been confirmed at time of analysis, though the low complexity substantially reduces the barrier for independent exploit development.
Unauthenticated broken access control in the FormyChat WordPress plugin (versions 2.15.7 and earlier) allows remote, unauthenticated attackers to access restricted plugin functionality or data due to missing authorization checks. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) confirms this is exploitable from the network without credentials, with high confidentiality impact but no integrity or availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication requirements make this straightforwardly exploitable on any exposed WordPress installation running the affected plugin.
WP Sort Order WordPress plugin versions 1.3.5 and below expose an unauthenticated broken access control flaw (CWE-862: Missing Authorization) that allows remote attackers without any credentials to invoke restricted plugin functionality. The CVSS vector confirms network-accessible, zero-complexity, unauthenticated exploitation with high confidentiality impact, meaning protected data can be read by any external party. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Device identity replay in UNITRONIX BetterDesk through version 2.3.0 permits unauthenticated clients to resurrect soft-deleted peer registrations by presenting a known deleted device ID, bypassing administrator-enforced device exclusion controls. The root cause is an implicit SQL upsert that cleared soft-deletion flags on any conflicting registration insert, meaning deletion was not enforced at the database layer. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, CVSS AC:H reflects the non-trivial but realistic prerequisite of possessing a previously issued device identifier.
Access-control mitigation bypass in the Firefox Add-ons Manager component allows attackers to circumvent a security protection that Mozilla had previously put in place around add-on handling, affecting Firefox before 154 and Firefox ESR before 153.1. Mozilla assigned this a 9.8 CVSS score with a fully remote, unauthenticated, no-user-interaction vector, though the terse advisory text does not detail the exact protection defeated. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Same-origin policy enforcement in Firefox's DOM Service Workers component can be bypassed, allowing a malicious web page to access resources, responses, or cached content belonging to another origin. The flaw affects Firefox before version 154 and Firefox ESR before 153.1, and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the network, no-authentication, no-interaction vector makes it attractive for drive-by attacks.
Protection-mechanism bypass in the Firefox JavaScript engine's garbage collector (JavaScript: GC) undermines a built-in exploit mitigation, weakening a defense that normally hinders memory-corruption exploitation. The flaw affects Mozilla Firefox and Firefox ESR and was addressed by the vendor in Firefox 154 and Firefox ESR 153.1. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported internally by Mozilla.
Protection mechanism failure in Firefox's Data Loss Prevention (DLP) component allows remote attackers, with user interaction, to bypass DLP controls, resulting in high confidentiality and integrity impact. Affected versions span the standard Firefox release channel (prior to 154) and both active ESR branches (ESR 140.x prior to 140.14, ESR 153.x prior to 153.1). No public exploit exists and EPSS sits at 0.17% (7th percentile), indicating low observed exploitation probability despite the high CVSS score - no active exploitation is confirmed via CISA KEV.
Unauthenticated remote exploitation of Oracle Siebel CRM Integration's REST component across versions 17.0 through 26.6 can yield complete loss of data confidentiality and integrity. Tagged as an authentication bypass, the vulnerability permits network-accessible attackers to read all CRM data and perform unauthorized create, delete, or modify operations without credentials. No public exploit has been identified at time of analysis, and Oracle's August 2026 Critical Patch Update addresses the issue.
Local privilege escalation with scope change in Oracle Siebel CRM's Email Marketing component affects versions 17.0 through 26.6, confirmed via the Oracle August 2026 Critical Security Update advisory (EUVD-2026-61438). Low-privileged attackers with existing logon access to the Siebel infrastructure can, under difficult-to-reproduce conditions, bypass access controls to read or modify critical marketing data and cascade impacts to other integrated Siebel products. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated network exploitation of the Oracle Siebel CRM Marketing component enables critical data theft and unauthorized modification across all Marketing-accessible records. Tagged explicitly as an Authentication Bypass, the flaw allows a remote attacker with no credentials to compromise the confidentiality and integrity of sensitive CRM marketing data via HTTP, affecting all supported versions from 17.0 through 26.6. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the PR:N/UI:N vector means no user interaction or account is required, making the authentication bypass self-sufficient once the high-complexity exploitation conditions are met.
Unauthorized access to critical CRM data and partial data manipulation in Oracle Siebel CRM Deployment (versions 17.0-26.6) is achievable via the Migration component by any low-privileged attacker with HTTP network access, with a documented scope change indicating that successful exploitation can cascade to affect additional Oracle products beyond the directly targeted component. The CVSS 3.1 base score of 8.5 reflects low attack complexity and no user interaction requirement, making exploitation straightforward for any holder of a valid low-privilege credential. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though the breadth of affected versions spanning nearly a decade of releases represents substantial organizational exposure.
Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) contains an authentication bypass flaw enabling unauthenticated network attackers to fully compromise data confidentiality and integrity over HTTPS. The 'Authentication Bypass' tag from the Oracle reporter confirms the vulnerability class: an attacker who satisfies the high-complexity exploitation condition can read all CRM data and perform unauthorized creation, modification, or deletion of records. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis.
Unauthenticated remote access to Oracle Siebel CRM Integration's REST component (versions 17.0 through 26.6) exposes all CRM integration data to unauthorized disclosure and enables partial denial of service via plain HTTP. The vulnerability requires no credentials, no user interaction, and no special configuration beyond the REST interface being reachable, making it exploitable by any network-adjacent or internet-facing attacker. No public exploit has been identified at time of analysis, but Oracle's Critical Patch Update for August 2026 confirms the issue and its severity classification of CVSS 8.2.
Oracle Siebel CRM Deployment's Server Infrastructure component exposes versions 17.0 through 26.6 to an unauthenticated, network-based authentication bypass over HTTP that can result in complete compromise of CRM data confidentiality and integrity. The high complexity rating (AC:H) tempers immediate mass-exploitation risk, but the Authentication Bypass tag combined with C:H and I:H impact means a successful attacker achieves full read and write access to all CRM-accessible data - including customer records, sales pipelines, and service data - without presenting valid credentials. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle's Critical Security Patch Update for August 2026 addresses this vulnerability.
Oracle Siebel CRM Deployment's Application Interface component (versions 17.0 through 26.6) exposes complete read and write access to all CRM data to unauthenticated attackers positioned on the adjacent network segment. The CVSS vector confirms zero authentication requirements and low attack complexity, meaning any actor with access to the physical communication segment hosting the Siebel server can silently exfiltrate or corrupt the entire CRM dataset. No active exploitation has been confirmed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, but the authentication bypass classification combined with high confidentiality and integrity impact makes this a credible priority for organizations with insufficiently segmented internal networks.
Full takeover of Oracle Payments (Oracle E-Business Suite, File Transmission component) is possible by remote unauthenticated attackers over HTTP, affecting supported releases 12.2.3 through 12.2.15. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network-facing profile makes it a top-tier patch priority.
Unauthorized data access and partial data manipulation is possible in Oracle Payments (E-Business Suite component: File Transmission) across versions 12.2.3 through 12.2.15 via an authentication bypass exploitable over HTTP. A low-privileged network attacker can obtain complete read access to all Oracle Payments data and perform unauthorized insert, update, or delete operations against a subset of that data. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'easily exploitable' vendor classification combined with low attack complexity elevates real-world risk for unpatched EBS environments.
Integrity and availability compromise in Oracle Siebel Apps - Marketing (versions 17.0 through 26.6) is reachable by any low-privileged, network-authenticated attacker over HTTP with no user interaction required. Successful exploitation allows unauthorized creation, deletion, or modification of critical Marketing data, and can cause a complete denial of service via persistent hang or crash of the Marketing component. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a credible threat in environments running unpatched Siebel deployments.
Full takeover of Oracle General Ledger (versions 12.2.3 through 12.2.15) is achievable by a low-privileged, network-authenticated attacker via HTTP, exploiting an undisclosed flaw in the Internal Operations component of Oracle E-Business Suite. The CVSS vector confirms complete confidentiality, integrity, and availability impact (C:H/I:H/A:H), consistent with application-level takeover. Notably, the intelligence tags classify this as 'Information Disclosure,' which conflicts with the described takeover impact - this discrepancy warrants verification against the Oracle August 2026 CSPU advisory. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Full takeover of Oracle Siebel Apps - Marketing is achievable by any low-privileged attacker with network access via HTTP, affecting all supported versions from 17.0 through 26.6. The CVSS 3.1 score of 8.8 reflects complete compromise of confidentiality, integrity, and availability, meaning an attacker can read, modify, or destroy data and disrupt service entirely. No public exploit has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a realistic threat for any internet- or intranet-exposed Siebel Marketing deployment.
Remote authentication bypass in Oracle Siebel CRM Integration's REST component affects all supported versions from 17.0 through 26.6, enabling unauthenticated network attackers to achieve full read and write access to critical CRM data via crafted HTTPS requests. The vulnerability is tagged Authentication Bypass, indicating that REST API access controls can be circumvented without credentials despite a high attack complexity (AC:H) rating that suggests exploitation requires precise crafting or internal state knowledge. No public exploit identified at time of analysis, but the combination of unauthenticated access and high confidentiality and integrity impact warrants priority patching under Oracle's August 2026 Critical Patch Update.
Full takeover of Oracle Siebel CRM's Marketing component is achievable by a low-privileged, network-accessible attacker exploiting a difficult-to-trigger condition via HTTP, affecting all supported versions from 17.0 through 26.6. Successful exploitation results in complete confidentiality, integrity, and availability compromise of the Marketing module - effectively a full component takeover. No public exploit code has been identified and the vulnerability is not listed in CISA's KEV catalog; however, Oracle's August 2026 Critical Patch Update confirms the flaw and releases a remediation.
Authentication bypass in Oracle Internet Procurement Connector (Oracle E-Business Suite versions 12.2.3 through 12.2.15) allows unauthenticated remote attackers to compromise the Internal Operations component via HTTP, resulting in unauthorized read access to or manipulation of critical procurement data. The CVSS 3.1 score of 7.4 reflects high confidentiality and integrity impacts moderated by high attack complexity (AC:H), meaning exploitation requires specific conditions to be met despite requiring no credentials. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Unauthorized data exfiltration and limited data manipulation in Oracle Siebel Artificial Intelligence (versions 25.12 through 26.6) is achievable by any low-privileged, network-adjacent attacker over HTTP, with no user interaction required. Oracle's own advisory classifies this as 'easily exploitable,' and the scope change metric confirms that successful exploitation can cascade beyond the AI component to impact additional Siebel CRM products. No public exploit or CISA KEV listing has been identified at time of analysis, though the low exploitation complexity and broad confidentiality impact (C:H) make this a high-priority patching target for Oracle Siebel deployments.
Unauthenticated adjacent-network exploitation of Oracle Siebel CRM's Search component allows complete read and write access to all CRM data across versions 17.0 through 26.6. Successful exploitation enables creation, deletion, and modification of critical data as well as full confidentiality compromise without any prior authentication or user interaction. No public exploit identified at time of analysis, and this vulnerability is not currently listed in CISA KEV, though its low-complexity, unauthenticated nature makes it a credible priority for organizations with exposed Siebel deployments.
Unauthenticated remote compromise of Oracle Siebel CRM's Siebel Apps - Marketing component (versions 17.0 through 26.6) allows a network attacker over HTTP to read all Marketing-accessible data and to force a complete, repeatable denial of service. The flaw is rated CVSS 3.1 9.1 and is tagged as an authentication bypass, meaning no credentials are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of no authentication, low attack complexity, and high confidentiality/availability impact makes it a high-priority patch.
Local privilege escalation in Oracle Siebel CRM Deployment (versions 17.0 through 26.6) allows a low-privileged local attacker to achieve full takeover of the affected installation, impacting confidentiality, integrity, and availability. The attack targets the Installation component and requires only logon access to the host infrastructure - no remote vector or user interaction is involved. No public exploit code and no active exploitation have been identified at time of analysis; however, the low attack complexity (AC:L) makes post-access exploitation straightforward.
Unauthorized data disclosure and partial service disruption affect Oracle Siebel CRM's Marketing component across versions 17.0 through 26.6, exploitable by a low-privileged authenticated attacker via HTTP without requiring user interaction. The flaw enables complete read access to all data within the Siebel Apps - Marketing scope alongside degraded service availability, as confirmed by Oracle's August 2026 Critical Security Patch Update. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog.
Full system takeover in Oracle Siebel CRM's Marketing component is achievable by low-privileged authenticated attackers over HTTP across all versions 17.0 through 26.6. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no user interaction required, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the straightforward exploitation conditions and full-triad impact make this a high-priority patch target for any organization running exposed Siebel Marketing instances.
Oracle General Ledger within E-Business Suite versions 12.2.3 through 12.2.15 exposes critical financial data to high-privileged network attackers through a flaw in the Internal Operations component accessible over HTTP. Successful exploitation grants complete read access to all General Ledger data and partial write capability, with a confirmed scope change meaning compromise can cascade to additional Oracle EBS products. Disclosed through Oracle's August 2026 Critical Patch Update, no public exploit code has been identified at time of analysis.
Complete system takeover of Oracle PeopleSoft Enterprise PeopleTools (versions 8.61 through 8.63) is achievable by unauthenticated network attackers via HTTP, specifically through the PIA Core Technology component. Despite the high attack complexity rating (AC:H), successful exploitation yields full confidentiality, integrity, and availability compromise - effectively handing an attacker control over the PeopleSoft environment. No public exploit code or CISA KEV listing has been identified at time of analysis, but the severity of the impact warrants prioritized remediation through Oracle's August 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Web Services Manager (OWSM), part of Oracle Fusion Middleware's Web Services Security component, lets a remote unauthenticated attacker read, create, delete, or modify all OWSM-accessible data over HTTP. Tagged as an authentication bypass, it affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Compromise of Oracle WebCenter Portal's Composer component - versions 12.2.1.4.0 and 14.1.2.0.0 - allows an authenticated low-privilege attacker over HTTP to achieve high-integrity impact, including unauthorized creation, deletion, and modification of critical portal data, limited confidentiality exposure, and partial denial of service. The CVSS scope change (S:C) indicates exploitation can cascade to additional Oracle Fusion Middleware products beyond WebCenter Portal itself. Disclosed in Oracle's August 2026 Critical Security Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle WebCenter Portal is achievable by a low-privileged network attacker targeting the Composer component via Java RMI in versions 12.2.1.4.0 and 14.1.2.0.0. Oracle describes the vulnerability as 'easily exploitable,' with the CVSS 3.1 score of 8.8 reflecting complete Confidentiality, Integrity, and Availability compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and this CVE has not appeared in the CISA Known Exploited Vulnerabilities catalog, though it is disclosed as part of Oracle's Critical Patch Update for August 2026.
Privilege-escalating account/system takeover in Oracle WebCenter Portal (Fusion Middleware, Composer component) versions 12.2.1.4.0 and 14.1.2.0.0 lets an authenticated low-privileged attacker reach full compromise over HTTP. Because the flaw carries a scope change (S:C), successful exploitation can pivot beyond WebCenter Portal to impact additional products, and Oracle rates it CVSS 9.9. No public exploit identified at time of analysis, but the near-maximum score, low attack complexity, and minimal privilege requirement make it a top-tier patch priority.
Full takeover of Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged, network-authenticated attacker targeting the Composer component over HTTP. Oracle's own advisory characterizes the vulnerability as 'easily exploitable,' with high impact across confidentiality, integrity, and availability and no user interaction required. No public exploit or CISA KEV listing exists at time of analysis, but the combination of low attack complexity, low privilege requirement, and complete portal compromise warrants urgent patching priority for all affected deployments.
Unauthenticated data compromise and denial of service in Oracle WebCenter Portal (Fusion Middleware, Portlet Services component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A remote attacker with only HTTP network access and no credentials can read or fully access all portal-accessible data and can force a hang or repeatable crash (complete DoS) of the portal. Oracle rates it CVSS 3.1 9.1 and flags it as easily exploitable; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Identity Manager (Oracle Fusion Middleware) affects the OIM Legacy UI component in versions 12.2.1.4.0 and 14.1.2.1.0, allowing an unauthenticated attacker with only HTTP network access to fully compromise the identity-management platform. The maximum CVSS 3.1 base score of 9.8 reflects complete loss of confidentiality, integrity, and availability, and because OIM governs enterprise identity and access, compromise cascades to every system it provisions. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile makes it a high priority for immediate patching.
Remote network compromise of Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 enables a low-privileged authenticated attacker to achieve full system takeover via the Authentication Engine over HTTP, with no user interaction required. Oracle's August 2026 Critical Patch Update advisory rates this CVSS 8.8 (High) and explicitly describes it as 'easily exploitable,' with complete confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Oracle Identity Manager (OIM Legacy UI) in versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware allows a low-privileged remote attacker to fully take over the identity management platform via the T3 and IIOP protocols. The attack requires no user interaction and low complexity, resulting in complete confidentiality, integrity, and availability compromise of the OIM system. No public exploit has been identified at time of analysis, but the low barrier to exploitation makes this a critical patching priority for any enterprise running the affected versions.
Full product takeover in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (Legacy UI component) allows a remote, unauthenticated attacker to compromise the identity-governance platform over HTTP. Rated CVSS 9.8 with high confidentiality, integrity, and availability impact, this issue is trivially exploitable and requires no user interaction; at time of analysis there is no public exploit identified and it is not listed in CISA KEV. Because OIM brokers provisioning and access to downstream enterprise systems, a takeover here has cascading blast radius across connected accounts and applications.
Full compromise of Oracle Identity Manager (OIM Legacy UI component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 is achievable by a low-privileged attacker over HTTP, resulting in complete takeover of the OIM instance. Because the flaw carries a scope change, successful exploitation can significantly impact additional connected products beyond OIM itself, elevating this from a single-product compromise to a potential identity-fabric breach. Disclosed in Oracle's August 2026 Critical Patch Update with a CVSS 3.1 base score of 9.9; no public exploit identified at time of analysis.
Full system takeover of Oracle Identity Manager is achievable by low-privileged network attackers via the OIM Legacy UI component using the T3 or IIOP protocols. Affected versions are 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware's Identity Manager product. Successful exploitation yields complete compromise of confidentiality, integrity, and availability, effectively handing an attacker full control over the identity management platform. No public exploit has been identified at the time of analysis, and this issue is disclosed as part of Oracle's Critical Patch Update for August 2026.
Full takeover of Oracle Identity Manager via its Legacy UI component is achievable by any low-privileged, network-authenticated attacker over HTTP. Affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, with complete confidentiality, integrity, and availability impact - Oracle's own advisory characterizes the outcome as system takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity (AC:L) and minimal privilege bar (PR:L) make this a realistic target once any authenticated foothold exists in an exposed OIM deployment.
Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 expose a high-severity Security component flaw enabling authenticated high-privileged attackers to compromise the system via HTTP, with confirmed scope change affecting additional downstream products. Exploitation allows complete unauthorized read and write access to all OIM-accessible data, including critical identity and access management records. No public exploit has been identified at time of analysis, and this vulnerability was disclosed as part of Oracle's Critical Patch Update for August 2026.
Remote takeover of Oracle WebLogic Server is possible when a low-privileged attacker reaches the server over the T3 or IIOP protocols, abusing a flaw in the Core component to fully compromise the host. Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, and because the attack carries a scope change it can significantly impact products beyond WebLogic itself. Oracle rates it CVSS 9.9; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the CVSS profile matches historically weaponized WebLogic T3/IIOP deserialization bugs.
Unauthenticated remote data disclosure in Oracle WebLogic Server Core allows network-accessible attackers to exfiltrate all data reachable by the server via the T3 or IIOP protocols, with confirmed scope change impact on additional downstream systems. Tagged as an Authentication Bypass by Oracle, this affects four active release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - making it a broad exposure across the WebLogic installed base. No public exploit identified at time of analysis, and remediation is available through Oracle's Critical Patch Update (CPU) August 2026.
Remote takeover of Oracle WebLogic Server is possible when an unauthenticated attacker reaches the server's IIOP interface over the network, letting them fully compromise the Core component with high confidentiality, integrity, and availability impact. The flaw affects supported releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and is rated CVSS 9.8 by Oracle. No public exploit identified at time of analysis, but the pattern matches prior high-impact WebLogic IIOP deserialization flaws that were rapidly weaponized.
Unauthenticated remote takeover in Oracle WebLogic Server (Fusion Middleware Core) lets a network attacker fully compromise the server via the T3 and IIOP protocols with no credentials and no user interaction. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and Oracle rates it CVSS 9.8 with full confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, but the class of flaw and the low attack complexity make it a top-priority patch.
Unauthorized data access and modification in Oracle General Ledger (E-Business Suite versions 12.2.3-12.2.15) can be achieved by a low-privileged network attacker targeting the Internal Operations component via HTTP. Successful exploitation grants complete read and write access to critical GL financial data plus partial availability disruption - a severe outcome for any organization relying on EBS for financial record integrity. The 'Authentication Bypass' tag suggests the vulnerability allows a low-privileged authenticated user to escalate effective access beyond their authorization level; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote integrity compromise and denial-of-service in Oracle WebLogic Server's Core component allows a low-privileged, network-accessible attacker to corrupt or destroy critical application data and crash the server via HTTP. All currently supported release lines - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are affected, giving this vulnerability a wide blast radius across enterprise Oracle Fusion Middleware deployments. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified, but Oracle's own characterization of the flaw as 'easily exploitable' combined with only a low-privilege account requirement makes patching under the August 2026 CPU urgent.
Full server takeover of Oracle WebLogic Server is achievable by a low-privileged network attacker exploiting a flaw in the Core component via the T3 or IIOP protocols. All four currently supported versions - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 - are confirmed affected per Oracle's Critical Patch Update for August 2026. Although High Attack Complexity (AC:H) limits opportunistic mass exploitation, successful attacks yield complete confidentiality, integrity, and availability compromise; no public exploit identified at time of analysis.
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a remote, unauthenticated attacker with network access via the T3 or IIOP protocols to completely compromise affected instances (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0). The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity and availability impact and requires no privileges or user interaction. There is no public exploit identified at time of analysis, but WebLogic T3/IIOP deserialization flaws are historically rapid targets for weaponization.
Remote unauthenticated denial-of-service and partial data integrity compromise in Oracle MySQL Cluster's NDB Operator component allows network attackers to crash or hang the cluster and perform unauthorized data modifications. Affected versions span three active release lines: 8.0.0-8.0.47, 8.4.0-8.4.10, and 9.7.0-9.7.1. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, but the low attack complexity and zero authentication requirement make exploitation straightforward against exposed deployments.
Unauthenticated data tampering and denial of service in Oracle Hospitality Simphony POS (versions 19.8-19.8.5, 19.9-19.9.3, 19.10-19.10.1) lets a remote attacker with only HTTP network access create, delete, or modify all Simphony-accessible data and force a repeatable crash. Oracle rates it CVSS 3.1 9.1 with high integrity and availability impact and describes it as easily exploitable, though there is no public exploit identified at time of analysis. It was reported by Oracle's own security team and fixed in the August 2026 Critical Patch Update.
Unauthenticated remote access to Oracle Hospitality Simphony's POS component enables complete unauthorized read access to all application data via an HTTP-based authentication bypass across three actively supported release lines. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N confirms that no credentials, interaction, or special configuration are required - any network-reachable attacker can exploit the flaw. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated remote data exposure in Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 allows any network-accessible attacker to read critical or all data managed by the platform via HTTP, without any credentials or user interaction. The Lifecycle Management component contains an authentication bypass (per vendor tags) that collapses access controls entirely, exposing sensitive enterprise performance management data. No public exploit or CISA KEV listing is confirmed at time of analysis, but the low-complexity, zero-privilege CVSS vector indicates straightforward exploitability for any attacker with network reach.
Unauthenticated remote access to sensitive financial data is possible in Oracle Hyperion Financial Reporting version 11.2.25.0.000 via an authentication bypass in its Server component, exploitable over HTTP. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no interaction, and no special configuration is required - making this trivially exploitable from any network-reachable position. Impact is limited to confidentiality, but the data exposed (financial reporting data) carries significant business and regulatory risk. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Privilege escalation in Blueprint Studio (versions prior to 2.5.2) allows any authenticated Home Assistant user to access and invoke administrator-only backend API actions - including arbitrary Home Assistant service calls, configuration file reads and writes, template rendering, file uploads, and terminal helper access - because the Python backend in api.py authenticated requests for valid HA user identity but never verified admin status. The fix in 2.5.2, released 2026-05-26, introduces a consistent `_require_admin()` guard across all GET, POST, stream, upload, and WebSocket handlers. No public exploit or active exploitation has been identified at time of analysis, but the authorization bypass is structurally trivial for any non-admin HA account holder.
Two-Factor Authentication is fully bypassed in Froxlor's API layer (versions prior to 2.3.7), allowing any holder of a valid API key and secret to invoke all API operations - including management of domains, DNS records, SSL certificates, email, FTP, and databases - without supplying the configured TOTP code. The web UI enforces 2FA correctly via `FroxlorTwoFactorAuth::verifyCode()`, but the API authentication function `FroxlorRPC::validateAuth` in `lib/Froxlor/Api/FroxlorRPC.php` checks only key validity, expiration, API permission, and account status, with zero references to 2FA logic across the entire `lib/Froxlor/Api/` directory. Publicly available exploit code exists per the GHSA advisory, which documents a confirmed PoC environment against Froxlor 2.3.5 with a 2FA-enabled admin account.
Full account takeover is possible in Keycloak's legacy client-initiated account-linking endpoint due to a predictable hash (CWE-341) used as a CSRF-like protection mechanism. An attacker who controls a registered OIDC client in the target realm can forge a valid linking URL that silently binds a victim's Keycloak account to the attacker's external identity, enabling subsequent login as the victim. No public exploit or CISA KEV listing is identified at time of analysis; Red Hat has released patches via RHSA-2026:56523 and RHSA-2026:56524.
Credential and 2FA-secret disclosure in the Froxlor hosting control panel (versions before 2.3.8) lets an authenticated API caller retrieve password hashes and Base32 TOTP seeds through the Customers, Admins, and Ftps API commands. The affected get()/listing() endpoints run full-row queries (SELECT *) and return the raw rows via $this->response(...) without stripping the password, type_2fa, or data_2fa fields. A detailed proof-of-concept exists (curl calls plus a Python TOTP-code generator); there is no public exploit identified as being used in active attacks and the issue is not in CISA KEV.
Privilege escalation and authorization bypass in Netflix Lemur before 1.9.3 permits any authenticated non-read-only user to revoke arbitrary TLS certificates fleet-wide, causing denial of service across all managed endpoints. Two chained API flaws - an unchecked upload endpoint and a row-scoped revocation check - allow an attacker to manufacture a shadow Lemur database record aliasing any real CA-side certificate, then trigger the issuer plugin to revoke the genuine certificate using stored authority credentials. No public exploit code has been identified, but the attack path is fully disclosed in the GitHub security advisory GHSA-pxmc-2ffp-8j67 and the fix commit.
Broken object-level authorization in Netflix Lemur versions 0.5.0 through 1.9.3 permits any authenticated non-read-only user to silently hijack TLS certificate lifecycle management for certificates they do not own. By supplying arbitrary certificate identifiers in the replaces[] or replacements field of create, upload, or edit requests, an attacker triggers an append listener that suppresses the victim certificate's expiry notifications, marks it as replaced, and excludes it from get_all_pending_reissue - after which certificate_rotate may deploy the attacker's certificate to production endpoints previously serving the victim. No public exploit code has been identified at time of analysis, and no KEV entry exists, but the integrity and availability impact on managed TLS fleets is high; the fix shipped in version 1.9.3.
Credential exposure in Netflix Lemur's destination API allows any authenticated low-privilege user to retrieve plaintext SFTP passwords and private key passphrases stored in destination plugin configurations. Affected versions prior to 1.9.3 expose GET /api/1/destinations endpoints without the admin_permission guard applied to sibling write handlers, and DestinationOutputSchema serializes raw plugin options - including fields marked as storing passwords - without redaction. The CVSS Scope:Changed rating reflects that the exposed SFTP credentials extend attacker reach beyond Lemur itself to remote certificate-deployment infrastructure. No public exploit code has been identified, though the fix commit is publicly available and the attack path is trivially constructable from the diff.
Authorization bypass in FUXA (a web-based SCADA/HMI/dashboard platform) versions 1.3.2 and earlier lets a remote unauthenticated attacker escalate to full runtime control when the Node-RED integration is enabled in secure mode. The allowDashboard gate in server/integrations/node-red/index.js verifies a JWT's signature but never inspects the decoded identity, so a low-privilege guest token that anyone can mint from POST /api/heartbeat is accepted for the privileged Node-RED editor and flow-deployment API. With no second adminAuth gate on Node-RED, the attacker deploys function nodes or calls fuxa.runScript to seize project data, configuration, scripts, and - where nodeRedUnsafeModules is enabled - operating-system command execution. No public exploit identified at time of analysis, but the fix (v1.3.3) and PR diff publicly reveal the flaw.
Insufficient session expiration in FUXA 1.3.2 and earlier allows a former privileged user to continue minting valid privileged JWTs long after their account has been deleted, disabled, demoted, or had roles removed. The refresh endpoint falls back to stale group data embedded in the token rather than enforcing a live database check, and the heartbeat endpoint re-signs inbound JWT claims without validating the current database record, enabling indefinite session extension through cookie rotation. No public exploit code has been identified at time of analysis, but the fix is available in v1.3.3 and the GitHub advisory and patch commit are public.
Privilege escalation in NVIDIA NVOS network switch operating system occurs when PKA-only SSH mode is enabled, inadvertently activating a secondary authentication channel that can be exploited if the default device password has not been rotated per NVIDIA's hardening guidance. An adjacent-network attacker who discovers this condition can authenticate via the alternative path using default credentials, bypassing the intended PKA-only enforcement and gaining elevated access to the switch. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis, but the infrastructure impact of a compromised network switch is significant.
Authentication bypass in the GBIF Integrated Publishing Toolkit (IPT) before version 3.3.4 lets a remote attacker reach the initial-setup functionality, which stays unauthenticated and exposed until the server's first reboot, and abuse it to seize administrative control of the instance. The flaw was reported by Mandiant, a vendor patch (3.3.4) is available, and there is no public exploit identified at time of analysis. Rated CVSS 4.0 9.1 (Critical), exploitation is gated by a timing/deployment window rather than by raw network reach.
Authentication bypass in the GBIF Integrated Publishing Toolkit (IPT) before version 3.3.4 lets remote attackers gain full administrative control by reaching initial-setup functionality that is never disabled after installation completes. Because the setup workflow - meant to run once on a fresh, unconfigured instance - stays reachable on production servers, an attacker can re-drive it to seize the admin role. Reported by Mandiant (MNDT-2026-0014); no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Missing authorization enforcement in Dell PowerStore storage appliances allows any attacker who has gained control of a mapped host connected to the array to read from or write to LUNs beyond those assigned to that initiator, effectively nullifying per-initiator LUN masking. Affected models span the full PowerStore T and Q product lines (500T through 7000T and beyond), as disclosed by Dell under advisory DSA-2026-330. No public exploit code or CISA KEV listing has been identified at time of analysis, but the complete C/I/A impact triplet reflects the severity of unrestricted storage access, particularly in multi-tenant or converged infrastructure environments where multiple workloads share the same array.
Account pre-registration hijacking in Saleor's GraphQL `accountRegister` and `confirmAccount` mutation flow allows an unauthenticated attacker to claim a victim's identity by registering an account under the victim's email address before the legitimate user does. When the victim clicks the activation link sent to their inbox, Saleor activates the attacker-created account and - across versions 2.10.0rc1 through the respective patched releases - automatically merges anonymous orders and gift-card data for that email without verifying the account password or any additional authentication factor, exposing order history, names, postal addresses, and phone numbers to the attacker. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is low-friction and fully reconstructible from the public GitHub advisory.
Broken object-level authorization in authentik's enterprise Remote Access Control (RAC) module exposes every configured RDP, SSH, and VNC endpoint - including stored connection credentials - to any authenticated user, irrespective of their assigned application access. Versions prior to 2026.2.6 and 2026.5.5 are affected; the flaw exists in both the endpoint listing API (which omits per-user access filtering) and the connection initiation flow (which does not validate that the requested endpoint belongs to the application through which the user is launching). No public exploit has been identified at time of analysis, though the attack requires only a valid authentik account and delivers full interactive access to infrastructure the attacker was never authorized to reach.
Device trust bypass in authentik enterprise Google Chrome stages allows an authenticated attacker to skip Google Verified Access API attestation and complete authentication from an unverified device. Enterprise deployments using either the Google Chrome Endpoint stage with mode=REQUIRED or the deprecated Google Chrome Device Trust Connector (GDTC) stage are affected in all supported versions prior to 2026.2.6 and 2026.5.5. No public exploit is identified at time of analysis, but the bypass requires only that the attacker submit the stage form without triggering the verification iframe - a trivially reproducible action for any credential holder.
Authentication bypass in @neo4j/graphql exposes admin-restricted custom-resolver fields to any authenticated user holding a legitimately issued, non-admin JWT. When both a type-level @authentication directive and a stricter field-level @authentication directive are declared on the same Query or Mutation type, the library silently discards the field-level rule and evaluates only the coarser type-level check - meaning a roles: ["user"] token is sufficient to invoke a field that requires roles_INCLUDES: "admin". Affected across three major branches (5.2.0-5.12.14, 6.0.0-6.6.4, 7.0.0-7.5.x); no public exploit or CISA KEV listing identified at time of analysis.
Product review management in Vvveb CMS prior to 1.0.8.4 exposes a broken object-level authorization flaw (CWE-639) allowing any authenticated low-privileged Vendor to read, modify, and delete product reviews belonging to other Vendors. The backend SQL queries for all supported database drivers (mysqli, pgsql, sqlite) accept a caller-controlled product_review_id without validating ownership against the requesting admin_id, enabling cross-Vendor review manipulation. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS 7.6 High score reflects significant integrity impact in multi-vendor marketplace deployments.
Post revision operations in Vvveb CMS prior to 1.0.8.4 expose an Insecure Direct Object Reference that allows any authenticated Author-role user to read, restore, or delete revision records belonging to other authors. The affected controller passes caller-supplied post_id, language_id, and created_at values directly to SQL queries without enforcing admin_id ownership, enabling cross-author access across list, read, restore, and delete operations. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 1.0.8.4.
Authorization bypass in Vvveb CMS prior to version 1.0.8.4 allows authenticated low-privileged Vendor accounts to perform unauthorized read, edit, status-change, and delete operations on product Q&A entries belonging to other Vendors. The backend SQL query files for all three supported database engines (MySQL, PostgreSQL, SQLite) accepted a caller-controlled product_question_id without joining the product table to verify that the question belongs to a product owned by the current admin_id. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the fix is confirmed in the released version 1.0.8.4 via GitHub advisory GHSA-cjhq-xqq3-6xv8.
Insecure direct object reference in Vvveb CMS prior to 1.0.8.4 allows any authenticated Vendor-role user to read, restore, and delete product revision records belonging to other Vendors by supplying arbitrary caller-controlled product_id values to the backend revision controller. All Vvveb multi-vendor deployments running versions before 1.0.8.4 are affected across MySQL, PostgreSQL, and SQLite database backends. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low barrier to entry - only a valid Vendor session is required - makes lateral abuse within shared storefronts realistic.
Insecure Direct Object Reference in Vvveb CMS prior to 1.0.8.4 allows any authenticated low-privileged Vendor to read, duplicate, or delete products belonging to other Vendors by submitting arbitrary product_id values in backend product operations. The root cause is that the products.php controller passes caller-controlled product_id values to SQL operations without consistently enforcing admin_id scoping - the fix required adding conditional admin_id filtering across six DELETE statements in both MySQL and PostgreSQL query files. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the low exploitation complexity makes it a meaningful business-logic risk for any multi-vendor Vvveb deployment.
Multi-factor authentication bypass in Joomla! CMS versions 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2 allows remote attackers to circumvent 2FA controls and gain authenticated access using only the first-factor credential. Insufficient state validation in the MFA flow exposes a logic path that skips the second-factor verification step entirely. No public exploit or CISA KEV listing has been identified at the time of analysis, though the vulnerability's network accessibility and lack of required privileges make it a meaningful account-takeover risk for any Joomla site with MFA-enrolled users.
Inconsistent access control enforcement in Joomla! CMS REST API webservice endpoints allows authenticated users with insufficient permissions to perform mutation operations that are explicitly restricted in the backend UI, effectively bypassing the platform's ACL system. Affected deployments span Joomla 4.0.0 through 5.4.7 and 6.0.0 through 6.1.2, covering both actively maintained long-term and current release branches. No public exploit code or active exploitation has been confirmed at time of analysis, though the Authentication Bypass classification and CWE-284 root cause indicate the ACL gap is structurally straightforward to discover and abuse by any user with a valid session.
Insecure Direct Object Reference (IDOR) in Vvveb CMS prior to 1.0.8.4 enables any authenticated Author-role user to bypass ownership enforcement and access, duplicate, or permanently delete posts belonging to other authors. The PHP controller `admin/controller/content/posts.php` accepts a caller-controlled `filter[admin_id]` parameter that overrides the server-assigned identity restriction, and the underlying SQL layer (MySQL, PostgreSQL, and SQLite backends) lacked consistent `admin_id` enforcement on delete and list operations. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the patch is available as of release 1.0.8.4.
Insecure Direct Object Reference (IDOR) in Vvveb CMS prior to 1.0.8.4 allows authenticated low-privileged Authors to perform unauthorized comment operations across author boundaries in the admin backend. The admin/controller/content/comment.php and comments.php controllers accept caller-controlled comment_id values without validating that the referenced comment's parent post belongs to the requesting author, enabling cross-author comment enumeration, content manipulation, status changes, and deletion. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network-accessible attack surface make this straightforward for any authenticated low-privilege user to abuse.
Broken object-level authorization in Vvveb CMS prior to 1.0.8.4 allows an authenticated low-privilege Vendor to access, modify, or delete digital assets belonging to any other Vendor by supplying arbitrary digital_asset_id values to the admin digital asset controllers. The flaw spans listing, read, edit, and delete operations across both MySQL and PostgreSQL backends, enabling cross-tenant metadata disclosure, resource link corruption, and permanent data loss. No public exploit code or CISA KEV listing exists at time of analysis, but exploitation is technically trivial for any authenticated Vendor in a multi-vendor deployment.
Broken access control in the Charitable WordPress donation plugin (versions 1.8.11.3 and earlier) allows unauthenticated remote attackers to perform unauthorized write operations against protected plugin functionality. Classified under CWE-862 (Missing Authorization), the flaw reflects absent or bypassed capability and nonce checks on one or more plugin endpoints, enabling integrity-impacting actions without any credentials. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, but the unauthenticated, low-complexity attack surface warrants prompt patching on any internet-exposed WordPress installation running this plugin.
Broken access control in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows unauthenticated remote attackers to perform privileged administrative actions without any credentials. The flaw stems from missing authorization checks (CWE-862), meaning the plugin executes sensitive operations without validating the requester's identity or permission level. With a CVSS 3.1 score of 7.5 and an attack vector of network/no-privileges-required, exploitation is trivially achievable against any WordPress site running the affected plugin; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated arbitrary content deletion in the Breeze WordPress caching plugin (≤ 2.5.12, by Cloudways) exposes any WordPress site running this plugin to remote content destruction without credentials. The missing authorization check (CWE-862) on deletion-capable endpoints allows any internet-facing attacker to trigger content removal, producing high availability impact and minor integrity impact per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H vector. No public exploit or CISA KEV listing has been identified at time of analysis, but the trivial exploitation profile makes rapid weaponization probable once a proof-of-concept surfaces.
Unauthenticated broken access control in ThumbPress WordPress plugin (all versions before 6.5) exposes restricted functionality to remote unauthenticated attackers, resulting in high confidentiality impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and low attack complexity, making it trivially automatable against any internet-facing WordPress site running the affected plugin. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, vendor-patched version 6.5 is available.
Unauthenticated broken access control in the Online Contact Widget WordPress plugin (versions ≤ 1.3.0) permits any network-accessible attacker to bypass authorization checks entirely, yielding high confidentiality impact against affected WordPress installations. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms exploitation requires no credentials, no user interaction, and minimal complexity, making the attack trivially repeatable at scale. No public exploit code or active exploitation has been confirmed at time of analysis, though the low complexity substantially reduces the barrier for independent exploit development.
Unauthenticated broken access control in the FormyChat WordPress plugin (versions 2.15.7 and earlier) allows remote, unauthenticated attackers to access restricted plugin functionality or data due to missing authorization checks. The CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) confirms this is exploitable from the network without credentials, with high confidentiality impact but no integrity or availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication requirements make this straightforwardly exploitable on any exposed WordPress installation running the affected plugin.
WP Sort Order WordPress plugin versions 1.3.5 and below expose an unauthenticated broken access control flaw (CWE-862: Missing Authorization) that allows remote attackers without any credentials to invoke restricted plugin functionality. The CVSS vector confirms network-accessible, zero-complexity, unauthenticated exploitation with high confidentiality impact, meaning protected data can be read by any external party. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Device identity replay in UNITRONIX BetterDesk through version 2.3.0 permits unauthenticated clients to resurrect soft-deleted peer registrations by presenting a known deleted device ID, bypassing administrator-enforced device exclusion controls. The root cause is an implicit SQL upsert that cleared soft-deletion flags on any conflicting registration insert, meaning deletion was not enforced at the database layer. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, CVSS AC:H reflects the non-trivial but realistic prerequisite of possessing a previously issued device identifier.
Access-control mitigation bypass in the Firefox Add-ons Manager component allows attackers to circumvent a security protection that Mozilla had previously put in place around add-on handling, affecting Firefox before 154 and Firefox ESR before 153.1. Mozilla assigned this a 9.8 CVSS score with a fully remote, unauthenticated, no-user-interaction vector, though the terse advisory text does not detail the exact protection defeated. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Same-origin policy enforcement in Firefox's DOM Service Workers component can be bypassed, allowing a malicious web page to access resources, responses, or cached content belonging to another origin. The flaw affects Firefox before version 154 and Firefox ESR before 153.1, and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the network, no-authentication, no-interaction vector makes it attractive for drive-by attacks.
Protection-mechanism bypass in the Firefox JavaScript engine's garbage collector (JavaScript: GC) undermines a built-in exploit mitigation, weakening a defense that normally hinders memory-corruption exploitation. The flaw affects Mozilla Firefox and Firefox ESR and was addressed by the vendor in Firefox 154 and Firefox ESR 153.1. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported internally by Mozilla.
Protection mechanism failure in Firefox's Data Loss Prevention (DLP) component allows remote attackers, with user interaction, to bypass DLP controls, resulting in high confidentiality and integrity impact. Affected versions span the standard Firefox release channel (prior to 154) and both active ESR branches (ESR 140.x prior to 140.14, ESR 153.x prior to 153.1). No public exploit exists and EPSS sits at 0.17% (7th percentile), indicating low observed exploitation probability despite the high CVSS score - no active exploitation is confirmed via CISA KEV.