Authentication Bypass
Monthly
Oracle Siebel CRM Integration (EAI component) versions 17.0 through 26.7 expose a network-reachable SOAP interface that fails to properly restrict operations for authenticated low-privileged users, letting an attacker read critical CRM data and perform limited unauthorized inserts, updates, or deletions. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N) and is rated 'easily exploitable' by the vendor, requiring only a valid low-privilege account and network reachability to the EAI endpoint. No public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis.
Oracle Siebel CRM Integration versions 23.6 through 26.7 expose the Event Publish and Subscribe component to unauthenticated attackers who can reach the server from the same network segment, allowing them to read, create, delete, or modify critical CRM data (CVSS 3.1 base 8.1, AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:N). Because the attack vector is adjacent network rather than internet-facing, exposure is gated by network topology rather than by credentials, and no public exploit code or CISA KEV entry is associated with this CVE at time of analysis. Exploitation probability scoring (EPSS) was not supplied with the source data, so prioritization should rest on asset criticality and segment reachability.
Oracle Siebel CRM Deployment (Server Infrastructure component), versions 17.0 through 26.7, allows an attacker who already holds a low-privileged logon on the host where the deployment component runs to read, create, modify, and delete all data accessible to that deployment. The vulnerability is locally exploitable with low complexity and no user interaction, but it does not grant entry to the host itself — it escalates what an existing low-privileged account can reach across the Siebel deployment layer, producing high confidentiality and integrity impact (CVSS 3.1 base 7.1) with no availability impact. No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score, CWE mapping, or confirmed fix version was supplied with the source data.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 contain an authentication-related flaw that lets a remote, unauthenticated attacker over HTTP read, create, delete, or modify critical deployment data - CVSS 3.1 base 7.4 with high confidentiality and integrity impact. Exploitation is rated difficult (AC:H), presumably because the attacker must meet a hard-to-satisfy protocol or timing condition, but no privileges or user interaction are required if that condition is met. Oracle has published a fix via its Critical Security Patch Update advisory; active exploitation is not confirmed and no public exploit code was identified in the supplied intelligence.
Improper access control in the Open UI component of Oracle Siebel CRM (End User) versions 17.0 through 26.7 lets an authenticated low-privilege user issue crafted HTTP requests that expose and modify data beyond their authorized scope. Successful exploitation yields high confidentiality impact — unauthorized read of critical Siebel data — plus limited integrity impact via unauthorized insert, update or delete operations; availability is unaffected (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). No CISA KEV listing, public exploit code or EPSS signal is present in the supplied intelligence, so this is currently a patch-cycle priority rather than a confirmed actively exploited issue.
Unauthenticated attackers with HTTP network reachability to the Siebel CRM Deployment component of Oracle Siebel CRM can bypass authentication and gain unauthorized access to critical data, plus limited ability to update, insert, or delete records. The flaw affects supported Siebel CRM versions 17.0 through 26.7 and carries a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N). No public exploit code or active exploitation has been identified from the available intelligence at time of analysis.
Unauthenticated remote attackers with HTTP access to the Reports component of Oracle Siebel CRM End User (versions 17.0 through 26.7) can bypass intended access controls and read data they should not be able to reach, giving them unauthorized access to critical data or the full set of data accessible to the Siebel CRM End User application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), meaning it is trivially reachable and requires no credentials or user interaction, but it does not permit data modification or denial of service. No public proof-of-concept, EPSS score, or CISA KEV listing was supplied with this report, so active exploitation is not confirmed at time of analysis.
Unauthenticated network attackers can reach the Open UI component of Oracle Siebel CRM End User (versions 17.0 through 26.7) over HTTP and gain unauthorized read access to critical data, limited insert/update/delete access, and the ability to partially degrade availability. Oracle rates the issue CVSS 3.1 base 8.6 (AV:N/AC:L/PR:N/UI:N), meaning no credentials or user interaction are needed; the accompanying tags indicate an authentication-bypass class flaw. There is no CISA KEV entry, no EPSS score, and no public exploit identified at time of analysis, and Oracle has published the fix through its Critical Security Patch Update advisory.
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7) lets an unauthenticated remote attacker reach the HTTP interface and take full read/write control of deployment data. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (score 9.1) confirms no credentials, no user interaction, and no non-default configuration are required; impact is confined to confidentiality and integrity, so data can be stolen or tampered with but the service cannot be disrupted (A:N). No public exploit code has been identified at time of analysis and CISA SSVC rates exploitation as 'none', though the flaw is rated automatable with total technical impact - making exposure reduction the key control while patching.
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (versions 17.0 through 26.7) lets an unauthenticated remote attacker reach critical CRM data over HTTP and read, create, delete, or modify it at will. Rated CVSS 3.1 base 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and classified CWE-287, the flaw requires no credentials and no user interaction - the only meaningful barrier is network reachability of the Siebel HTTP interface. No public exploit code exists and there is no confirmed active exploitation (CISA SSVC exploitation: none), but the issue is assessed as automatable with total technical impact, so exposure should be treated as urgent for internet-facing deployments; EPSS data was not provided for this CVE.
Oracle Siebel CRM's Financial Services module (Financial Accounts component) can be compromised by an unauthenticated attacker with network access over HTTP, exposing critical Financial Accounts data and enabling a hang or repeatable crash of the affected service. Supported versions 17.0 through 26.7 are impacted, and the assessed vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation is possible without credentials, user interaction, or non-default configuration, with impact limited to confidentiality and availability (no data modification). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); practical exposure is governed mainly by whether the Siebel HTTP endpoint is reachable from untrusted networks, since many deployments are intranet-facing.
Oracle Common Applications Calendar, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an application-layer access-control weakness that lets a low-privileged user with network access to the EBS HTTP interface create, delete or modify critical calendar data and read a subset of calendar records. The flaw is rated CVSS 3.1 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), meaning no user interaction is needed but a valid low-privileged account is a prerequisite. No public exploit code or CISA KEV listing was provided in the source data, and no EPSS score was supplied, so active exploitation is currently unconfirmed.
Oracle Common Applications, a shared framework component of Oracle E-Business Suite (CRM User Management Framework), fails to properly restrict actions for low-privileged users in versions 12.2.3 through 12.2.15, allowing them to create, delete, or modify critical CRM data and read data they should not access. Exploitation is network-based over HTTP with low complexity, but requires the attacker to already hold a valid low-privileged account and to persuade another user to interact with a crafted request (CVSS 7.3, AV:N/AC:L/PR:L/UI:R). No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score was provided in the source data.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a flaw in the Core component of the Application Object Library that allows a remote, unauthenticated attacker with HTTP access to bypass authentication and gain unauthorized read and write access to critical application data. Oracle rates the issue 7.4 with a high attack complexity, reflecting that exploitation is possible over the network without credentials but requires conditions an attacker must engineer or discover. No public exploit code has been identified and the issue is not listed in CISA KEV, so at time of analysis this is a patch-now, high-impact confidentiality and integrity risk rather than a confirmed active campaign.
Unauthenticated remote attackers can reach the Workspaces component of Oracle Siebel CRM Development over HTTP and obtain unauthorized read access to critical application data while also degrading service availability (CVSS 3.1 base 8.2, AV:N/AC:L/PR:N/UI:N). Affected are all Siebel CRM Development releases from 17.0 through 26.7. There is no public exploit code or CISA KEV listing confirmed in the supplied intelligence, so the practical priority depends on whether the Workspaces HTTP interface is exposed beyond trusted internal networks.
Oracle Common Applications Calendar, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be compromised by a low-privileged attacker who already holds a valid account and can reach the application over HTTP. Successful exploitation gives the attacker unauthorized read, creation, modification, and deletion access to Calendar data and can also cause a partial denial of service, though Oracle rates the flaw as difficult to exploit (CVSS 3.1 7.1, AV:N/AC:H/PR:L/UI:N). No public exploit code or CISA KEV entry was provided in the intelligence feed, and the only authoritative reference is Oracle's Critical Patch Update advisory cspusep2026.
Low-privileged users of Oracle One-to-One Fulfillment (the Documents component of Oracle E-Business Suite 12.2.3 through 12.2.15) can read, create, delete, or modify critical fulfillment and document data over HTTP without any user interaction. Oracle assigns it a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning the attacker only needs network reachability plus a low-privileged account, not administrative rights. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the source data.
Improper authorization in the Application Framework component of Oracle CRM Technical Foundation (Oracle E-Business Suite 12.2.3–12.2.15) lets a low-privileged user with ordinary HTTP access to the instance read and alter critical CRM data that should be restricted to higher-privileged roles — integrity and confidentiality are both rated High, availability is unaffected. Oracle scores it 8.1 (AV:N/AC:L/PR:L/UI:N), meaning exploitation is straightforward but requires a valid low-privilege account rather than anonymous access. No public exploit code or active exploitation has been reported in the supplied intelligence, and no EPSS value was provided, so it should be treated as a patch-priority issue rather than an emergency.
Oracle One-to-One Fulfillment, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes unauthorized access to critical data and can be partially disrupted by an attacker holding only a low-privileged account with HTTP access to the application. Per Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/A:L), the issue requires authentication but no user interaction, and yields high confidentiality loss plus a limited availability impact. There is no public exploit code and no CISA KEV entry at time of analysis, and no EPSS score was supplied; the vendor patch is published in the September 2026 Critical Patch Update advisory.
Oracle Sales Online, a component of Oracle E-Business Suite, is affected by an easily exploitable flaw in versions 12.2.3 through 12.2.15 that lets a low-privileged attacker with HTTP network access compromise the application and reach data outside its intended boundary (scope change). Successful exploitation can expose critical data or all Oracle Sales Online-accessible data, plus allow unauthorized insert, update, or delete of some records. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle's Critical Security Patch Update advisory (cspusep2026.html) is the authoritative fix reference and the CVSS 3.1 base score of 8.5 reflects high confidentiality and low integrity impact.
Authenticated low-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can exploit a difficult-to-trigger flaw in the One-to-One Fulfillment 'Documents' component to read critical data outside their authorized scope and partially degrade availability of the module. The vendor-assigned CVSS 3.1 base score is 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L), reflecting high confidentiality impact with no integrity impact and only partial denial of service; the scope-change flag indicates that exploitation can significantly affect resources beyond the vulnerable component. There is no CISA KEV listing, no public proof-of-concept identified, and no EPSS data supplied, so exploitation is not confirmed to be active at time of analysis.
An unauthenticated remote attacker with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can bypass access controls in the Oracle Application Object Library (FND) Core component and read critical application data, per Oracle's own disclosure (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/C:H/I:N/AN). The flaw is fully automatable — no credentials, no user interaction, low complexity — making it attractive for mass scanning, though its impact is limited to confidentiality (no integrity or availability loss). No public exploit code has been identified and it is not listed in CISA KEV at time of analysis, but no EPSS score was supplied, so real-world exploitation probability is unquantified.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a broken-authorization flaw in the Customer Interaction History module (Outcome-Result component) that allows a low-privileged user with HTTP access to read data well outside their intended privileges. Exploitation is trivial once an attacker holds any valid low-privileged EBS account, and Oracle's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) marks it as an easily exploitable, confidentiality-only issue whose scope change means other EBS modules can be affected. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the practical risk is driven by the enormous blast radius of an ERP holding financial, HR and customer records rather than by confirmed active exploitation.
Unauthenticated attackers able to reach the HTTPS interface of Oracle E-Business Suite 12.2.3 through 12.2.15 can exploit a difficult-to-trigger flaw in the Oracle Application Object Library (Core component) to create, delete, or modify critical data and to read data they should never see. The CVSS 3.1 base score is 7.4 (AV:N/AC:H/PR:N/UI:N, high confidentiality and integrity impact, no availability impact), meaning no credentials or user interaction are needed but successful exploitation depends on conditions the attacker must satisfy. No public exploit code has been identified and the flaw is not listed in CISA KEV, so it should be treated as a high-severity patch obligation rather than an actively exploited emergency.
Authenticated low-privileged users can compromise Oracle Project Intelligence within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) over HTTP, gaining unauthorized create, delete, and modify access to critical data along with read access to a subset of application data. Oracle rates the issue CVSS 3.1 base 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), reflecting a trivial-to-execute, low-privilege attack whose dominant impact is data integrity rather than availability or broad disclosure. No EPSS score, CISA KEV listing, or public proof-of-concept was present in the supplied intelligence, so exploitation status is unconfirmed.
Oracle E-Business Suite Applications Manager 12.2.3 through 12.2.15 lets a low-privileged attacker who already holds a logon on the host running Applications Manager read and tamper with critical data through the Command Line - RapidClone component. The flaw is a local-only, low-complexity authorization weakness (CVSS 7.1, AV:L/PR:L/UI:N) that yields high confidentiality and integrity impact with no availability impact, and no scoped privilege escalation beyond the component. No public exploit code has been identified at time of analysis, and no EPSS or CISA KEV signal was supplied with this record.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 contains an easily exploitable flaw that lets a low-privileged attacker positioned on the physical communication segment adjacent to the Siebel Deployment host read critical data and repeatedly crash the service. Successful exploitation yields complete confidentiality loss of all data accessible to Siebel CRM Deployment plus a repeatable denial-of-service condition, per the Oracle CPU advisory. No public exploit code or CISA KEV listing was identified at time of analysis, and EPSS data was not supplied for this CVE.
Unauthenticated attackers with network reachability to the Siebel CRM Open UI SOAP interface can bypass authentication in Oracle Siebel CRM End User versions 17.0 through 26.7 and obtain full read, create, modify, and delete access to all data reachable through the affected component. Rated CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), the flaw requires no credentials, no user interaction, and has low attack complexity, though it carries no availability impact (A:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, so the primary real-world risk driver is whether the SOAP endpoint of a given deployment is exposed beyond trusted networks.
Improper authorization control in the Oracle Project Intelligence module of Oracle E-Business Suite allows a low-privileged authenticated user with network access to read, create, modify, or delete data across the module, including records the account should never reach. Affected releases are 12.2.3 through 12.2.15; the vendor's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N, base 8.1) indicates the flaw is trivially automatable once credentials exist, because no user interaction is needed. No public exploit code, KEV listing, or EPSS estimate was supplied with the available intelligence, so active exploitation should be treated as unconfirmed rather than assumed.
Unauthenticated attackers with network access to the SOAP interface of Oracle Service Delivery Platform (SDP) versions 12.2.1.4.0 and 14.1.2.0.0 can bypass authentication and achieve full takeover of the product, per CWE-287 and a CVSS 3.1 base score of 9.8. The flaw is remotely exploitable without privileges or user interaction (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. Real-world risk is concentrated in telecom environments where the Messaging Enabler component is deployed and network-reachable.
Oracle Siebel CRM 17.0 through 26.7 exposes a flaw in the Open UI component that lets a low-privileged, network-positioned attacker compromise a victim's Siebel CRM End User session once that victim is persuaded to interact with attacker-supplied content. Successful exploitation yields unauthorized read, creation, deletion or modification of critical and otherwise inaccessible CRM data, and the scope-change (S:C) rating means the fallout can extend to products beyond Siebel CRM End User itself. Rated CVSS 7.7 with high attack complexity, the bug is difficult to exploit reliably, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Low-privileged attackers with network access to the Siebel Apps - Customer Order Management module (Order Management component) in Oracle Siebel CRM versions 17.0 through 26.7 can craft HTTP requests that, once a second user is induced to interact, allow unauthorized read, creation, modification, and deletion of critical order data, with a scope change that can propagate impact to connected products. The flaw carries a CVSS 3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), but no EPSS score, CISA KEV listing, or public exploit code was provided in the source data, so active exploitation is not confirmed (no public exploit identified at time of analysis). It is an easily exploitable, low-complexity issue, making patch deployment a high priority for any organization running an affected Siebel release.
Unauthenticated network attackers can bypass authentication in the eDetailing component of the Siebel Apps - Life Sciences module shipped with Oracle Siebel CRM, affecting versions 17.0 through 26.7, and gain both read and write access to critical CRM data — provided a human other than the attacker is induced to interact with a crafted HTTP request. Oracle scores this 8.1 (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:N), reflecting full confidentiality and integrity compromise but no availability impact and only the Life Sciences vertical exposed. No public exploit code or active exploitation has been identified at time of analysis, and the vendor advisory is Oracle's September 2026 Critical Security Patch Update (cspusep2026.html).
Improper access control in Oracle Proposals, a module of Oracle E-Business Suite (component: Internal Operations), lets a low-privileged, authenticated attacker reach data outside their authorization boundary over HTTP. Supported releases 12.2.3 through 12.2.15 are affected, and successful exploitation yields unauthorized read access to critical Oracle Proposals data with a scope change that can extend impact to other EBS-backed products. Oracle rates the issue 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no public exploit code or CISA KEV entry is present in the supplied intelligence, so it should be treated as an unpatched-window exposure rather than a confirmed in-the-wild campaign.
Low-privileged, network-reachable users of Oracle Field Service can read data far beyond their authorized scope in Oracle E-Business Suite releases 12.2.3 through 12.2.15, potentially reaching critical data across additional products because the flaw crosses a security scope boundary (CVSS 3.1 7.7, C:H only). The vulnerability is exploitable over HTTP with no user interaction once a low-privileged session exists, and no public exploit code or active exploitation is identified at time of analysis. Oracle has published a Critical Security Patch Update advisory covering this issue; there is no CISA KEV listing and no EPSS score was supplied in the source data.
Oracle iStore, the e-commerce/shopping cart module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, is exposed to a cross-site style attack in which a low-privileged authenticated attacker with HTTP network access can induce a second user to interact with crafted content and thereby gain unauthorized read, create, modify, and delete access to iStore data — with the vendor warning the impact can extend to other EBS products. With CVSS 3.1 base 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), the flaw is trivially automatable once an attacker holds any low-privileged account, but exploitation still hinges on victim interaction, which materially lowers real-world risk. No public proof-of-concept, EPSS estimate, or CISA KEV entry was present in the supplied intelligence, so exploitation is assessed as not confirmed in the wild at time of analysis.
Low-privileged users of Oracle iStore in Oracle E-Business Suite 12.2.3 through 12.2.15 can reach data they should not be able to read through the Shopping Cart component over HTTP. Successful exploitation results in unauthorized access to critical data or complete read access to everything the iStore application can reach, and because the flaw carries a scope change it can also significantly affect other E-Business Suite products. Oracle rates it CVSS 3.1 7.7 (confidentiality only, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated information disclosure in Oracle iStore (Shopping Cart component) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a remote attacker with plain HTTP access read critical data exposed through the storefront, up to and including all data reachable by the iStore application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact) and is trivially automatable given the network vector and lack of credentials or user interaction. No CISA KEV entry, EPSS score, or public proof-of-concept was present in the supplied intelligence, so exploitation is assessed as possible but not confirmed in the wild at time of analysis.
Authenticated, low-privileged attackers with HTTP access to Oracle iStore in Oracle E-Business Suite 12.2.3 through 12.2.15 can read, create, modify, or delete critical shopping-cart, order, and customer data, giving them full read and write reach into all iStore-accessible records. The flaw sits in the Shopping Cart component and is rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning it is remotely reachable over HTTP with no user interaction and only a low-privilege account. No CISA KEV listing and no public exploit code were identified at time of analysis, so exploitation is currently presumed opportunistic rather than confirmed in the wild.
Oracle Web Applications Desktop Integrator (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) exposes a file download weakness that lets a low-privileged, network-connected user retrieve data they should not be able to reach. Exploitation is rated 'easily exploitable' by Oracle — HTTPS network vector, low complexity, no user interaction — and because the flaw can cross a security boundary (CVSS scope change), successful abuse may expose critical data belonging to other EBS components, not just the Desktop Integrator. CVSS 3.1 base score is 7.7 with confidentiality-only impact; no public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Oracle Sales, the sales module of Oracle E-Business Suite (supported versions 12.2.3 through 12.2.15), exposes critical business data to any low-privileged authenticated user who can reach its HTTP interface. A crafted request against the Internal Operations component bypasses the intended access boundary, and because the CVSS vector carries a scope change (S:C), the exposure is not limited to Oracle Sales — data reachable through additional Oracle products can be read as well. Oracle classifies it as 'easily exploitable' (AV:N/AC:L/PR:L/UI:N, CVSS 3.1 base 7.7, confidentiality-only impact); no public exploit code, EPSS score, or CISA KEV entry was provided in the source data.
Unauthenticated remote attackers with HTTP access to Oracle Sales Offline, a module of Oracle E-Business Suite, can read any data the application exposes on affected versions 12.2.3 through 12.2.15. The flaw sits in the Internal Operations component and requires no credentials, no user interaction and no non-default configuration, yielding a 7.5 confidentiality-only CVSS base score. Exploitation is highly automatable and attractive for bulk data theft, though at the time of analysis there is no public exploit code and no confirmed exploitation (no CISA KEV listing); EPSS is not available in the supplied intelligence.
Oracle Sales Offline, a module of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged authenticated user with HTTP access read critical data far beyond their intended authorization, and Oracle's own scoring marks the impact as a scope change, meaning the flaw in this component can also reach data owned by other EBS products. The CVSS 3.1 base score is 7.7 with high confidentiality impact and no integrity or availability impact, and no public exploit code or CISA KEV entry was identified at time of analysis.
Low-privileged attackers with network access over HTTP can compromise Oracle Sales Online in Oracle E-Business Suite releases 12.2.3 through 12.2.15, exposing critical sales data and allowing limited modification of records. Exploitation requires that a low-privileged account already be held and that a second person (not the attacker) be induced to interact with the application, yet the flaw's scope change means a successful attack can ripple into other E-Business Suite components beyond Sales Online itself. It carries a CVSS 3.1 base score of 7.6, but there is no CISA KEV listing, no public exploit code identified at time of analysis, and no EPSS score supplied in the intelligence feed.
Oracle Report Manager, a component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), exposes an internal-operations flaw that lets a low-privileged attacker with HTTPS network access read critical data and degrade service availability. Successful exploitation yields high confidentiality impact against all Report Manager-accessible data plus partial denial of service, giving the flaw a 7.1 CVSS base score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). There is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is not confirmed to be active; risk is concentrated in internet- or broadly-reachable EBS Report Manager deployments where ordinary authenticated users exist.
Oracle E-Business Suite Order Management (versions 12.2.5 through 12.2.15) exposes order data through its Product Diagnostic Tools component to any low-privileged user who can reach the HTTP interface. The flaw is easily exploitable — network vector, low complexity, no user interaction — and Oracle notes the impact can spread beyond Order Management into interconnected products, resulting in unauthorized access to critical data or complete access to all Order Management data. No public exploit code or CISA KEV listing was provided at time of analysis; no patch version is specified in the available references beyond the linked Oracle advisory.
Unauthenticated remote attackers can read sensitive data from Oracle Applications Manager within Oracle E-Business Suite 12.2.3 through 12.2.15 by sending crafted HTTP requests to the RapidClone command-line component. The issue is scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning exploitation needs no credentials, no user interaction, and only affects confidentiality — an attacker gains unauthorized access to critical data or all data reachable through Applications Manager. No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis, so exploitation appears opportunistic rather than confirmed in the wild.
Low-privileged authenticated users with HTTP access to Oracle Quality in Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Quality records and make limited unauthorized changes to them, because the Internal Operations component fails to enforce proper authorization on its requests. Oracle scores this 7.1 with a network vector, low attack complexity and no user interaction, so exploitation is straightforward for anyone who already holds any valid EBS account. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied in the input.
Low-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can leverage a hard-to-reach flaw in the Oracle Partner Management module (Internal Operations component) to read critical data and modify records far beyond their authorization, with the impact crossing into other EBS components because the vulnerability carries a scope change. Oracle rates it CVSS 7.1 and characterizes it as difficult to exploit, and a fix is published in the 2026 Critical Patch Update. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote attackers can read any data reachable through the Audience component of Oracle Marketing in Oracle E-Business Suite versions 12.2.3 through 12.2.15 by sending crafted HTTP requests, with no user interaction required. The flaw is scored 7.5 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:N) and is confidentiality-only - integrity and availability of the affected module are unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS probability was supplied with the source data.
Unrestricted network access to Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 allows unauthenticated attackers to bypass authentication in the Forms Services C/S/Charmode component and take over the application, with CVSS 9.8 and no user interaction. No public exploit or CISA KEV listing is present in the supplied intelligence, but the Oracle advisory confirms the affected versions. Organizations running these releases should treat the flaw as critical and patch immediately.
Improper authentication in the Oracle Forms Client/Server (C/S) Charmode runtime allows an unauthenticated, network-reachable attacker to bypass authentication and operate with the data privileges granted to the Oracle Forms application, yielding high confidentiality and integrity impact (CVSS 3.1 base 9.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Oracle Forms 12.2.1.19.0 and 14.1.2.0.0, as shipped in Oracle Fusion Middleware (Forms Services, C/S, Charmode), are affected; the vector requires no credentials and no user interaction, and there is no availability impact. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and exposure is limited to deployments whose C/S Charmode listener is network-reachable over TCP from an untrusted network.
Unauthenticated network attackers can reach Oracle Forms Services (including the C/S and Charmode components) over HTTP and achieve unauthorized access to, or modification and deletion of, critical data held in the application, in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0. Oracle rates the issue 7.4 with high confidentiality and integrity impact but explicitly characterizes it as difficult to exploit (AC:H), meaning a favorable timing or state condition is required rather than simple request replay. At the time of analysis there is no confirmed CISA KEV listing and no public exploit code identified; exploitability details remain largely undisclosed by the vendor.
Unauthenticated remote takeover of Oracle Forms is achievable through the Forms Services C/S Charmode component in versions 12.2.1.19.0 and 14.1.2.0.0, where an improper-authentication flaw (CWE-287) lets any attacker who can reach the HTTP endpoint seize full control of the affected service, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N). Based on the available intelligence there is no public exploit code identified at time of analysis and no CISA KEV listing, so urgency is driven by exposure rather than observed exploitation. Real-world risk is constrained mainly by deployment reality: Oracle Forms is legacy enterprise middleware that is usually published through web or application tiers rather than directly to the internet, and the C/S Charmode vector specifically points at character-mode client/server installations.
Unauthenticated remote takeover of Oracle Forms is possible in the Forms Services (C/S, Charmode) component of Oracle Fusion Middleware running versions 12.2.1.19.0 and 14.1.2.0.0. An attacker who can reach the Forms HTTP interface with no credentials, no user interaction, and no special privileges can bypass authentication and gain full control of the affected deployment, and the CVSS scope-change flag (S:C) indicates the compromise can significantly impact additional products tied to the same environment. The vendor-rated CVSS 3.1 base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and the flaw is described as easily exploitable, though no public exploit identified at time of analysis.
Full takeover of Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 is achievable by an unauthenticated remote attacker exploiting an improper-authentication flaw (CWE-287) in the Forms Services C/S (Charmode) component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) confirms there are no credential, user-interaction, or special-complexity prerequisites - only HTTP reachability to an affected Forms deployment is required. No public exploit code has been identified at time of analysis, and real-world exposure is bounded by how widely the legacy C/S Charmode mode is deployed and whether the Forms HTTP endpoint is exposed beyond the internal network.
Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 (Fusion Middleware, components Forms Services, C/S and Charmode) can be compromised by a low-privileged attacker with network access over HTTP, resulting in full read/write access to Forms-accessible data plus a partial denial of service. Exploitation is difficult (AC:H) and depends on a victim other than the attacker performing some action (UI:R), but the flaw carries a scope change, meaning a successful attack can significantly affect products beyond the vulnerable component itself. Oracle rates it CVSS 3.1 7.9; no public exploit code, KEV listing or EPSS score was present in the supplied intelligence at time of analysis.
Unauthenticated remote attackers with HTTP reachability to the Oracle Forms Services listener can bypass authentication and take over Oracle Forms deployments in Oracle Fusion Middleware versions 12.2.1.19.0 and 14.1.2.0.0, specifically the Forms Services, C/S, and Charmode components. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), matching our independent assessment, meaning no credentials and no user interaction are required and the only practical precondition is network access to the Forms endpoint on default configurations. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a high-priority patch candidate - particularly for any instance exposed to the internet or to untrusted internal segments - rather than a currently exploited threat.
Authentication bypass in Oracle Forms (Oracle Fusion Middleware) 12.2.1.19.0 and 14.1.2.0.0 lets an unauthenticated, network-positioned attacker take over the Forms Services component - including its C/S and Charmode channels - over HTTP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are stated prerequisites, and the impact is rated complete loss of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). No CISA KEV entry or public exploit code was identified at time of analysis (EPSS was not provided in the available data); the practical limiting factor is exposure, since Forms Services is frequently shielded behind internal networks, reverse proxies, or VPNs rather than being internet-facing. Our assessment concurs with the vendor vector and classifies this as a genuine high-priority vulnerability.
Authentication bypass in Oracle Forms (component: Forms Services, C/S, Charmode) allows an unauthenticated remote attacker with HTTP access to reach data and functionality that should require a valid session, affecting versions 12.2.1.19.0 and 14.1.2.0.0. The flaw carries a CVSS 3.1 base score of 8.6 with a scope-change flag, meaning a compromise of Oracle Forms can pivot to impact other products connected to or served by the Forms tier. Only high confidentiality impact is documented (no integrity or availability impact per the vector), and there is no public exploit code or CISA KEV listing at time of analysis.
Low-privileged attackers with network access to Oracle Field Service can read and modify critical data and cause a partial denial of service, exploiting a difficult-to-trigger flaw in the Internal Operations component of Oracle E-Business Suite. All supported Oracle Field Service releases from 12.2.3 through 12.2.15 are affected. No public exploit code was identified and there is no CISA KEV listing at time of analysis, but the CVSS 3.1 base score of 7.1 with high confidentiality and integrity impact makes this a candidate for prioritization once patch data is verified.
Oracle Field Service, a component of Oracle E-Business Suite (Internal Operations module), is affected by an easily exploitable flaw in versions 12.2.3 through 12.2.15 that lets a low-privileged attacker with HTTP network access read critical data, modify or delete records, and partially disrupt service availability. The vulnerability carries a CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L), indicating high confidentiality impact with limited integrity and availability effects, and it does not require user interaction. No public exploit code or CISA KEV entry was present in the supplied intelligence, and there is no confirmed evidence of active exploitation at time of analysis.
Oracle Alert, a component of Oracle E-Business Suite (12.2.3 through 12.2.15), exposes an authorization weakness in its Internal Operations component that lets a low-privileged, network-positioned attacker read and manipulate critical Alert data over HTTP. The flaw carries a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:N), reflecting high confidentiality and integrity impact with no user interaction required. No public exploit code has been identified at time of analysis, and the issue has not been confirmed as actively exploited (CISA KEV); remediation is available through Oracle's Critical Security Patch Update cycle, so patching should be prioritized for internet- or partner-facing EBS deployments.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 contain a flaw in the Siebel Cloud Manager component that lets a low-privileged, network-positioned user read and modify critical CRM data, with impact extending beyond the vulnerable component (scope change). The CVSS 3.1 base score is 8.2 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N), reflecting high attack complexity and the need for a valid low-privileged account rather than anonymity. No public exploit code and no CISA KEV entry were identified at time of analysis, so exploitation is confirmed only as theoretically practical, not known to be active.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 expose a flaw in the Siebel Cloud Manager component that lets an attacker already holding a low-privileged account on the platform, and positioned on the same physical/adjacent network segment as the hosting hardware, read essentially all CRM data, modify or delete some of it, and partially disrupt service. The CVSS 3.1 base score is 8.2 (AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L), and the scope-change metric indicates the compromise can spill over into additional products beyond Siebel itself. No public exploit code has been identified and the issue is not listed in CISA KEV, but it should not be ignored: the confidentiality impact is total, Oracle rates exploitability as 'easily exploitable', and no EPSS score or CWE mapping was supplied to further refine the risk picture.
Oracle E-Business Suite's Marketing module (Audience component) in versions 12.2.3 through 12.2.15 exposes critical data to any attacker holding a low-privileged, authenticated account, who can reach the vulnerable component over HTTP and read information well beyond their intended authorization boundary. Oracle scores it 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — a scope-changing, confidentiality-only flaw with no integrity or availability impact. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the immediate driver is the breadth of affected enterprise deployments rather than confirmed in-the-wild activity.
Oracle Marketing, a module of Oracle E-Business Suite (Audience component), versions 12.2.3 through 12.2.15, exposes an easily exploitable flaw that lets a low-privileged, network-connected attacker read critical data and modify some records through the HTTP interface — with a scope change that can extend impact to other EBS products. Oracle rates it CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) and released a fix in its Critical Security Patch Update (cspusep2026.html). No public exploit code or CISA KEV listing was present in the supplied intelligence, so exploitation is currently assessed as opportunistic rather than confirmed active.
Oracle Banking Corporate Lending versions 14.5.0.0.0 through 14.9.0.0.0 contain an unauthenticated, hard-to-trigger flaw in the Core component that lets an attacker positioned on an adjacent network segment read and modify critical lending data, with a scope change that can extend impact to connected Oracle Financial Services products. The CVSS 3.1 base score is 8.0 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting high confidentiality and integrity impact on a non-internet-exposed attack surface. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so real-world exploitation is currently unconfirmed.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 contain a flaw in the Siebel Cloud Manager component that a high-privileged attacker with a logon to the underlying infrastructure can use to read and modify critical Siebel data and, through a scope change, impact additional products. The CVSS 3.1 base score is 7.9 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), so exploitation is rated easy once the attacker already holds elevated local access — this is an insider/privileged-tenant risk rather than a remotely reachable pre-auth bug. No public exploit code and no CISA KEV entry were present in the supplied intelligence, and no EPSS data was provided, so active exploitation is not confirmed.
Unauthenticated attackers who can reach the HTTP interface of Oracle Siebel CRM Cloud Applications, specifically the Siebel Cloud Manager component, can bypass authentication and gain full read access to critical CRM data plus limited ability to insert, update or delete records. The flaw affects supported releases 22.3 through 26.7 and carries a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N), meaning it is remotely reachable, low complexity and requires no credentials or user interaction. No public exploit code or CISA KEV listing was present in the supplied intelligence, so exploitation status is unconfirmed at time of analysis.
Unauthenticated attackers with HTTP network access can read critical data from Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 by exploiting an authentication bypass in the Siebel Cloud Manager component. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) with high confidentiality impact only - integrity and availability are unaffected - meaning a successful hit exposes all data reachable through the affected component. No public exploit code, EPSS score, or CISA KEV entry was supplied in the intelligence feed, so active exploitation is currently unconfirmed.
Unauthenticated attackers with network reachability to the SSH interface of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.7) can bypass authentication and gain unauthorized access to critical CRM data through the Siebel Cloud Manager component. Oracle scores the flaw 8.6 with a scope change, meaning a successful compromise can extend beyond the Siebel deployment to affect additional products. No public exploit code, EPSS score, or CISA KEV entry was provided at the time of analysis, although the low-complexity, no-credentials attack profile makes rapid weaponization plausible.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 expose the Siebel Cloud Manager component to unauthenticated attackers who can reach the host over an adjacent network segment, allowing full read and write access to critical CRM data. The flaw is rated CVSS 8.1 (AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:N) and is tagged as an authentication bypass, meaning no credentials or user interaction are required once an attacker is positioned on the same physical or logical communication segment as the affected service. There is no CISA KEV listing and no public exploit identified at time of analysis, but the low attack complexity and lack of authentication make the vulnerability highly automatable for anyone who already holds a foothold inside the hosting network or cloud subnet.
Authenticated low-privileged users of Oracle E-Business Suite 12.2.3 through 12.2.15 can abuse the Applications Framework 'Search Bean' component to read, create, delete, or modify critical data they should not be able to touch, giving an attacker with a basic application account broad confidentiality and integrity impact across the framework. The vulnerability is remotely reachable over HTTP with low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1), so any valid low-privilege credential is effectively a stepping stone to full data compromise. There is no public exploit code and no CISA KEV listing at time of analysis, but the Oracle quarterly patch referenced in the advisory is the only reliable fix.
Oracle PeopleSoft Enterprise PRTL Interaction Hub 9.1 (Enterprise Portal component) permits a low-privileged user with HTTP access to the portal to read data well beyond their assigned role, exposing critical enterprise data and, because the flaw crosses a trust boundary, potentially data held in other PeopleSoft products reachable through the portal. Oracle scores it 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — confidentiality-only with a scope change — and fixed it in the 2026 Critical Patch Update. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the source data.
Missing authorization enforcement in the Core component of Oracle Enterprise Manager for Oracle Database 24.1 allows an authenticated, low-privileged attacker with HTTP access to read any data the management platform can reach, including data belonging to managed database targets, a confidentiality-only compromise that also changes scope (CVSS 3.1: 7.7). Oracle rates it easily exploitable because it needs only a valid low-privilege account and network reach to the console, and no public exploit identified at time of analysis. Oracle has published a fix in its Critical Security Patch Update advisory for the affected 24.1 release.
Unauthenticated remote attackers can achieve full takeover of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 by reaching the OID LDAP Server through its exposed T3 or IIOP remoting listeners, requiring no credentials and no user interaction (CVSS 3.1 base score 9.8; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The root cause is an authentication-bypass condition (CWE-287) in the Fusion Middleware OID LDAP Server component, and successful exploitation yields complete loss of confidentiality, integrity and availability across the directory service. No CISA KEV entry and no public exploit code were identified at time of analysis, so this is not confirmed active exploitation; however, the pre-authentication, network-reachable attack path means internet-facing or broadly reachable OID/WebLogic deployments carry the highest risk, while instances confined to trusted management networks are substantially harder to reach because the only real gating factor is network access to the T3/IIOP listener.
Authentication bypass in Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network access to the OID LDAP Server component to take over the directory service, with high confidentiality, integrity and availability impact (CVSS 3.1 base score 9.8). Exploitation requires no credentials, no user interaction and no non-default configuration per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); the principal practical constraint is reachability of the LDAP listener, since directory servers are normally deployed on internal or segmented networks rather than exposed to the internet. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but Oracle's 'easily exploitable' characterization and the complete compromise outcome make this a high-priority patch target for any organization running the affected versions.
Unauthenticated attackers with network access to the OID LDAP Server component can fully compromise Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0, achieving complete loss of confidentiality, integrity, and availability of the directory service (CVSS 3.1 base score 9.8). Because the flaw is an improper authentication weakness (CWE-287) reachable over LDAP with no credentials, no user interaction, and no special configuration - Oracle itself characterizes it as 'easily exploitable' - any directory deployment whose LDAP listener is exposed to an untrusted network is directly at risk of takeover. No public exploit code has been identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (no CISA KEV listing), so the practical risk is driven primarily by network exposure of the OID LDAP port.
Unauthenticated remote takeover of Oracle Internet Directory is achievable through its OID LDAP Server component in versions 12.2.1.4.0 and 14.1.2.1.0. The flaw is an improper-authentication weakness (CWE-287) rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning an attacker who can reach the LDAP listener needs no credentials, no user interaction, and no non-default configuration to gain full control of confidentiality, integrity, and availability of the directory service. Our assessment concurs with this vector and flags it as a genuine top-tier priority; no public exploit code and no confirmed active exploitation were identified at time of analysis, so the practical risk hinges mainly on whether OID LDAP ports (default 389/636) are exposed beyond trusted internal or management networks.
Takeover of Oracle Internet Directory via its LDAP server component allows unauthenticated remote attackers to fully compromise the directory service. Affected versions are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability is rated CVSS 10.0 with scope change; no public exploit or CISA KEV listing was identified in the provided data.
Authentication bypass in the OID LDAP Server component of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker with network access to the LDAP listener to take full control of the directory service, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the flaw sits in the authentication path itself (CWE-287) and requires no credentials, no user interaction, and no special configuration, any instance whose LDAP port (typically 389, or 636 for LDAPS) is reachable from an untrusted network should be treated as exposed. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and no EPSS score was supplied, but the pre-authentication nature and the directory's role as a central identity store make this a genuine high-priority issue rather than a high-score/low-risk artifact.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Runtime Tools component that allows an attacker who already controls a high-privileged account to reach past that account's authorization boundary over HTTP, gaining unauthorized read access to critical portal data and limited ability to modify it, with a documented scope change that can affect connected products. Oracle rates it CVSS 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N) — network-reachable but gated behind strong privileges. No public exploit code and no CISA KEV listing were identified at time of analysis, so this reads as a post-compromise privilege escalation and data-exposure issue rather than a remotely exploitable pre-auth break.
Unauthenticated attackers with HTTP network access to Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 can read data they should not be able to reach, including critical application data, via a flaw in the Runtime Tools component. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), making it trivially automatable against any internet- or intranet-exposed instance that has not applied the referenced Oracle Critical Security Patch Update. There is no public exploit code identified at time of analysis and no CISA KEV listing, so exploitation appears opportunistic rather than confirmed in the wild.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Runtime Tools component that lets a low-privileged, network-positioned attacker read and partially modify portal data via HTTP. Oracle rates it 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L), meaning exploitation is trivial once any valid low-privileged account is held, with full confidentiality impact against the portal's accessible data. No CISA KEV listing, public exploit code, or EPSS score was supplied with the source data, so active exploitation is unconfirmed at time of analysis.
Low-privileged attackers with HTTP network access can exploit the Security Framework component of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 to gain unauthorized read access to critical data and limited write/delete access, with the impact extending to additional connected products (CVSS scope change). At CVSS 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) the flaw is trivially automatable once any valid low-privileged account exists, but exploitation requires authentication, so it is not an unauthenticated internet-wide attack. Exploitation status: no public exploit identified at time of analysis; the CVE is not listed in CISA KEV and no EPSS score was supplied in the source data, so real-world activity is unconfirmed.
Authenticated but low-privileged users with HTTP access to Oracle WebCenter Portal can reach data well beyond their intended permissions through a flaw in the Runtime Tools component, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Oracle scores it CVSS 7.7 with a scope change, meaning the portal's compromise can ripple into additional products reachable from it, with the impact limited to confidentiality. Neither CISA KEV listing nor public exploit code has been identified at time of analysis, and no EPSS probability was supplied, though the low attack complexity and absence of user interaction make weaponization plausible.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 contain an authentication-bypass flaw in the Runtime Tools component that can be triggered by an unauthenticated attacker over HTTP, giving access to critical portal data as well as the ability to modify or delete some of it. Oracle rates the issue CVSS 8.2 (C:H/I:L, no availability impact) with network vector, low complexity, and no privileges or user interaction required, making it trivially automatable against any internet- or intranet-reachable deployment that has not applied the referenced Critical Patch Update. No public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis, so exploitation is assessed as possible but not confirmed in the wild.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 ship a flaw in the Runtime Tools component that lets any authenticated low-privileged user read critical portal data and partially degrade portal availability over HTTP. Oracle rates it as easily exploitable (CVSS 7.1, AV:N/AC:L/PR:L/UI:N, C:H/A:L), so no user interaction and no administrative role is needed beyond a valid account. No public exploit code and no CISA KEV entry were identified at time of analysis, but the data-exposure impact on an enterprise portal makes it worth prompt patching.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contain an easily exploited authorization flaw in the Runtime Tools component that lets a low-privileged, network-connected user reach and manipulate data well outside their intended scope, including data belonging to connected products (CVSS 8.5, scope change, high confidentiality and low integrity impact). Exploitation requires only a valid low-privilege portal account and standard HTTP access — no user interaction — making it attractive for lateral movement inside enterprise portal deployments. There is no public exploit identified at time of analysis, and no CISA KEV listing or EPSS score was supplied in the available intelligence.
Oracle Siebel CRM Integration (EAI component) versions 17.0 through 26.7 expose a network-reachable SOAP interface that fails to properly restrict operations for authenticated low-privileged users, letting an attacker read critical CRM data and perform limited unauthorized inserts, updates, or deletions. The flaw carries a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L/A:N) and is rated 'easily exploitable' by the vendor, requiring only a valid low-privilege account and network reachability to the EAI endpoint. No public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis.
Oracle Siebel CRM Integration versions 23.6 through 26.7 expose the Event Publish and Subscribe component to unauthenticated attackers who can reach the server from the same network segment, allowing them to read, create, delete, or modify critical CRM data (CVSS 3.1 base 8.1, AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:N). Because the attack vector is adjacent network rather than internet-facing, exposure is gated by network topology rather than by credentials, and no public exploit code or CISA KEV entry is associated with this CVE at time of analysis. Exploitation probability scoring (EPSS) was not supplied with the source data, so prioritization should rest on asset criticality and segment reachability.
Oracle Siebel CRM Deployment (Server Infrastructure component), versions 17.0 through 26.7, allows an attacker who already holds a low-privileged logon on the host where the deployment component runs to read, create, modify, and delete all data accessible to that deployment. The vulnerability is locally exploitable with low complexity and no user interaction, but it does not grant entry to the host itself — it escalates what an existing low-privileged account can reach across the Siebel deployment layer, producing high confidentiality and integrity impact (CVSS 3.1 base 7.1) with no availability impact. No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score, CWE mapping, or confirmed fix version was supplied with the source data.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 contain an authentication-related flaw that lets a remote, unauthenticated attacker over HTTP read, create, delete, or modify critical deployment data - CVSS 3.1 base 7.4 with high confidentiality and integrity impact. Exploitation is rated difficult (AC:H), presumably because the attacker must meet a hard-to-satisfy protocol or timing condition, but no privileges or user interaction are required if that condition is met. Oracle has published a fix via its Critical Security Patch Update advisory; active exploitation is not confirmed and no public exploit code was identified in the supplied intelligence.
Improper access control in the Open UI component of Oracle Siebel CRM (End User) versions 17.0 through 26.7 lets an authenticated low-privilege user issue crafted HTTP requests that expose and modify data beyond their authorized scope. Successful exploitation yields high confidentiality impact — unauthorized read of critical Siebel data — plus limited integrity impact via unauthorized insert, update or delete operations; availability is unaffected (CVSS 3.1 base 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). No CISA KEV listing, public exploit code or EPSS signal is present in the supplied intelligence, so this is currently a patch-cycle priority rather than a confirmed actively exploited issue.
Unauthenticated attackers with HTTP network reachability to the Siebel CRM Deployment component of Oracle Siebel CRM can bypass authentication and gain unauthorized access to critical data, plus limited ability to update, insert, or delete records. The flaw affects supported Siebel CRM versions 17.0 through 26.7 and carries a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N). No public exploit code or active exploitation has been identified from the available intelligence at time of analysis.
Unauthenticated remote attackers with HTTP access to the Reports component of Oracle Siebel CRM End User (versions 17.0 through 26.7) can bypass intended access controls and read data they should not be able to reach, giving them unauthorized access to critical data or the full set of data accessible to the Siebel CRM End User application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), meaning it is trivially reachable and requires no credentials or user interaction, but it does not permit data modification or denial of service. No public proof-of-concept, EPSS score, or CISA KEV listing was supplied with this report, so active exploitation is not confirmed at time of analysis.
Unauthenticated network attackers can reach the Open UI component of Oracle Siebel CRM End User (versions 17.0 through 26.7) over HTTP and gain unauthorized read access to critical data, limited insert/update/delete access, and the ability to partially degrade availability. Oracle rates the issue CVSS 3.1 base 8.6 (AV:N/AC:L/PR:N/UI:N), meaning no credentials or user interaction are needed; the accompanying tags indicate an authentication-bypass class flaw. There is no CISA KEV entry, no EPSS score, and no public exploit identified at time of analysis, and Oracle has published the fix through its Critical Security Patch Update advisory.
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (supported versions 17.0 through 26.7) lets an unauthenticated remote attacker reach the HTTP interface and take full read/write control of deployment data. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (score 9.1) confirms no credentials, no user interaction, and no non-default configuration are required; impact is confined to confidentiality and integrity, so data can be stolen or tampered with but the service cannot be disrupted (A:N). No public exploit code has been identified at time of analysis and CISA SSVC rates exploitation as 'none', though the flaw is rated automatable with total technical impact - making exposure reduction the key control while patching.
Authentication bypass in the Server Infrastructure component of Oracle Siebel CRM Deployment (versions 17.0 through 26.7) lets an unauthenticated remote attacker reach critical CRM data over HTTP and read, create, delete, or modify it at will. Rated CVSS 3.1 base 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and classified CWE-287, the flaw requires no credentials and no user interaction - the only meaningful barrier is network reachability of the Siebel HTTP interface. No public exploit code exists and there is no confirmed active exploitation (CISA SSVC exploitation: none), but the issue is assessed as automatable with total technical impact, so exposure should be treated as urgent for internet-facing deployments; EPSS data was not provided for this CVE.
Oracle Siebel CRM's Financial Services module (Financial Accounts component) can be compromised by an unauthenticated attacker with network access over HTTP, exposing critical Financial Accounts data and enabling a hang or repeatable crash of the affected service. Supported versions 17.0 through 26.7 are impacted, and the assessed vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation is possible without credentials, user interaction, or non-default configuration, with impact limited to confidentiality and availability (no data modification). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); practical exposure is governed mainly by whether the Siebel HTTP endpoint is reachable from untrusted networks, since many deployments are intranet-facing.
Oracle Common Applications Calendar, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes an application-layer access-control weakness that lets a low-privileged user with network access to the EBS HTTP interface create, delete or modify critical calendar data and read a subset of calendar records. The flaw is rated CVSS 3.1 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), meaning no user interaction is needed but a valid low-privileged account is a prerequisite. No public exploit code or CISA KEV listing was provided in the source data, and no EPSS score was supplied, so active exploitation is currently unconfirmed.
Oracle Common Applications, a shared framework component of Oracle E-Business Suite (CRM User Management Framework), fails to properly restrict actions for low-privileged users in versions 12.2.3 through 12.2.15, allowing them to create, delete, or modify critical CRM data and read data they should not access. Exploitation is network-based over HTTP with low complexity, but requires the attacker to already hold a valid low-privileged account and to persuade another user to interact with a crafted request (CVSS 7.3, AV:N/AC:L/PR:L/UI:R). No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score was provided in the source data.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a flaw in the Core component of the Application Object Library that allows a remote, unauthenticated attacker with HTTP access to bypass authentication and gain unauthorized read and write access to critical application data. Oracle rates the issue 7.4 with a high attack complexity, reflecting that exploitation is possible over the network without credentials but requires conditions an attacker must engineer or discover. No public exploit code has been identified and the issue is not listed in CISA KEV, so at time of analysis this is a patch-now, high-impact confidentiality and integrity risk rather than a confirmed active campaign.
Unauthenticated remote attackers can reach the Workspaces component of Oracle Siebel CRM Development over HTTP and obtain unauthorized read access to critical application data while also degrading service availability (CVSS 3.1 base 8.2, AV:N/AC:L/PR:N/UI:N). Affected are all Siebel CRM Development releases from 17.0 through 26.7. There is no public exploit code or CISA KEV listing confirmed in the supplied intelligence, so the practical priority depends on whether the Workspaces HTTP interface is exposed beyond trusted internal networks.
Oracle Common Applications Calendar, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be compromised by a low-privileged attacker who already holds a valid account and can reach the application over HTTP. Successful exploitation gives the attacker unauthorized read, creation, modification, and deletion access to Calendar data and can also cause a partial denial of service, though Oracle rates the flaw as difficult to exploit (CVSS 3.1 7.1, AV:N/AC:H/PR:L/UI:N). No public exploit code or CISA KEV entry was provided in the intelligence feed, and the only authoritative reference is Oracle's Critical Patch Update advisory cspusep2026.
Low-privileged users of Oracle One-to-One Fulfillment (the Documents component of Oracle E-Business Suite 12.2.3 through 12.2.15) can read, create, delete, or modify critical fulfillment and document data over HTTP without any user interaction. Oracle assigns it a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning the attacker only needs network reachability plus a low-privileged account, not administrative rights. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied in the source data.
Improper authorization in the Application Framework component of Oracle CRM Technical Foundation (Oracle E-Business Suite 12.2.3–12.2.15) lets a low-privileged user with ordinary HTTP access to the instance read and alter critical CRM data that should be restricted to higher-privileged roles — integrity and confidentiality are both rated High, availability is unaffected. Oracle scores it 8.1 (AV:N/AC:L/PR:L/UI:N), meaning exploitation is straightforward but requires a valid low-privilege account rather than anonymous access. No public exploit code or active exploitation has been reported in the supplied intelligence, and no EPSS value was provided, so it should be treated as a patch-priority issue rather than an emergency.
Oracle One-to-One Fulfillment, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, exposes unauthorized access to critical data and can be partially disrupted by an attacker holding only a low-privileged account with HTTP access to the application. Per Oracle's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/A:L), the issue requires authentication but no user interaction, and yields high confidentiality loss plus a limited availability impact. There is no public exploit code and no CISA KEV entry at time of analysis, and no EPSS score was supplied; the vendor patch is published in the September 2026 Critical Patch Update advisory.
Oracle Sales Online, a component of Oracle E-Business Suite, is affected by an easily exploitable flaw in versions 12.2.3 through 12.2.15 that lets a low-privileged attacker with HTTP network access compromise the application and reach data outside its intended boundary (scope change). Successful exploitation can expose critical data or all Oracle Sales Online-accessible data, plus allow unauthorized insert, update, or delete of some records. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle's Critical Security Patch Update advisory (cspusep2026.html) is the authoritative fix reference and the CVSS 3.1 base score of 8.5 reflects high confidentiality and low integrity impact.
Authenticated low-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can exploit a difficult-to-trigger flaw in the One-to-One Fulfillment 'Documents' component to read critical data outside their authorized scope and partially degrade availability of the module. The vendor-assigned CVSS 3.1 base score is 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L), reflecting high confidentiality impact with no integrity impact and only partial denial of service; the scope-change flag indicates that exploitation can significantly affect resources beyond the vulnerable component. There is no CISA KEV listing, no public proof-of-concept identified, and no EPSS data supplied, so exploitation is not confirmed to be active at time of analysis.
An unauthenticated remote attacker with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can bypass access controls in the Oracle Application Object Library (FND) Core component and read critical application data, per Oracle's own disclosure (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/C:H/I:N/AN). The flaw is fully automatable — no credentials, no user interaction, low complexity — making it attractive for mass scanning, though its impact is limited to confidentiality (no integrity or availability loss). No public exploit code has been identified and it is not listed in CISA KEV at time of analysis, but no EPSS score was supplied, so real-world exploitation probability is unquantified.
Oracle E-Business Suite 12.2.3 through 12.2.15 contains a broken-authorization flaw in the Customer Interaction History module (Outcome-Result component) that allows a low-privileged user with HTTP access to read data well outside their intended privileges. Exploitation is trivial once an attacker holds any valid low-privileged EBS account, and Oracle's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, 7.7) marks it as an easily exploitable, confidentiality-only issue whose scope change means other EBS modules can be affected. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the practical risk is driven by the enormous blast radius of an ERP holding financial, HR and customer records rather than by confirmed active exploitation.
Unauthenticated attackers able to reach the HTTPS interface of Oracle E-Business Suite 12.2.3 through 12.2.15 can exploit a difficult-to-trigger flaw in the Oracle Application Object Library (Core component) to create, delete, or modify critical data and to read data they should never see. The CVSS 3.1 base score is 7.4 (AV:N/AC:H/PR:N/UI:N, high confidentiality and integrity impact, no availability impact), meaning no credentials or user interaction are needed but successful exploitation depends on conditions the attacker must satisfy. No public exploit code has been identified and the flaw is not listed in CISA KEV, so it should be treated as a high-severity patch obligation rather than an actively exploited emergency.
Authenticated low-privileged users can compromise Oracle Project Intelligence within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) over HTTP, gaining unauthorized create, delete, and modify access to critical data along with read access to a subset of application data. Oracle rates the issue CVSS 3.1 base 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N), reflecting a trivial-to-execute, low-privilege attack whose dominant impact is data integrity rather than availability or broad disclosure. No EPSS score, CISA KEV listing, or public proof-of-concept was present in the supplied intelligence, so exploitation status is unconfirmed.
Oracle E-Business Suite Applications Manager 12.2.3 through 12.2.15 lets a low-privileged attacker who already holds a logon on the host running Applications Manager read and tamper with critical data through the Command Line - RapidClone component. The flaw is a local-only, low-complexity authorization weakness (CVSS 7.1, AV:L/PR:L/UI:N) that yields high confidentiality and integrity impact with no availability impact, and no scoped privilege escalation beyond the component. No public exploit code has been identified at time of analysis, and no EPSS or CISA KEV signal was supplied with this record.
Oracle Siebel CRM Deployment (Server Infrastructure component) versions 17.0 through 26.7 contains an easily exploitable flaw that lets a low-privileged attacker positioned on the physical communication segment adjacent to the Siebel Deployment host read critical data and repeatedly crash the service. Successful exploitation yields complete confidentiality loss of all data accessible to Siebel CRM Deployment plus a repeatable denial-of-service condition, per the Oracle CPU advisory. No public exploit code or CISA KEV listing was identified at time of analysis, and EPSS data was not supplied for this CVE.
Unauthenticated attackers with network reachability to the Siebel CRM Open UI SOAP interface can bypass authentication in Oracle Siebel CRM End User versions 17.0 through 26.7 and obtain full read, create, modify, and delete access to all data reachable through the affected component. Rated CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), the flaw requires no credentials, no user interaction, and has low attack complexity, though it carries no availability impact (A:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, so the primary real-world risk driver is whether the SOAP endpoint of a given deployment is exposed beyond trusted networks.
Improper authorization control in the Oracle Project Intelligence module of Oracle E-Business Suite allows a low-privileged authenticated user with network access to read, create, modify, or delete data across the module, including records the account should never reach. Affected releases are 12.2.3 through 12.2.15; the vendor's own CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N, base 8.1) indicates the flaw is trivially automatable once credentials exist, because no user interaction is needed. No public exploit code, KEV listing, or EPSS estimate was supplied with the available intelligence, so active exploitation should be treated as unconfirmed rather than assumed.
Unauthenticated attackers with network access to the SOAP interface of Oracle Service Delivery Platform (SDP) versions 12.2.1.4.0 and 14.1.2.0.0 can bypass authentication and achieve full takeover of the product, per CWE-287 and a CVSS 3.1 base score of 9.8. The flaw is remotely exploitable without privileges or user interaction (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. Real-world risk is concentrated in telecom environments where the Messaging Enabler component is deployed and network-reachable.
Oracle Siebel CRM 17.0 through 26.7 exposes a flaw in the Open UI component that lets a low-privileged, network-positioned attacker compromise a victim's Siebel CRM End User session once that victim is persuaded to interact with attacker-supplied content. Successful exploitation yields unauthorized read, creation, deletion or modification of critical and otherwise inaccessible CRM data, and the scope-change (S:C) rating means the fallout can extend to products beyond Siebel CRM End User itself. Rated CVSS 7.7 with high attack complexity, the bug is difficult to exploit reliably, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Low-privileged attackers with network access to the Siebel Apps - Customer Order Management module (Order Management component) in Oracle Siebel CRM versions 17.0 through 26.7 can craft HTTP requests that, once a second user is induced to interact, allow unauthorized read, creation, modification, and deletion of critical order data, with a scope change that can propagate impact to connected products. The flaw carries a CVSS 3.1 base score of 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), but no EPSS score, CISA KEV listing, or public exploit code was provided in the source data, so active exploitation is not confirmed (no public exploit identified at time of analysis). It is an easily exploitable, low-complexity issue, making patch deployment a high priority for any organization running an affected Siebel release.
Unauthenticated network attackers can bypass authentication in the eDetailing component of the Siebel Apps - Life Sciences module shipped with Oracle Siebel CRM, affecting versions 17.0 through 26.7, and gain both read and write access to critical CRM data — provided a human other than the attacker is induced to interact with a crafted HTTP request. Oracle scores this 8.1 (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:N), reflecting full confidentiality and integrity compromise but no availability impact and only the Life Sciences vertical exposed. No public exploit code or active exploitation has been identified at time of analysis, and the vendor advisory is Oracle's September 2026 Critical Security Patch Update (cspusep2026.html).
Improper access control in Oracle Proposals, a module of Oracle E-Business Suite (component: Internal Operations), lets a low-privileged, authenticated attacker reach data outside their authorization boundary over HTTP. Supported releases 12.2.3 through 12.2.15 are affected, and successful exploitation yields unauthorized read access to critical Oracle Proposals data with a scope change that can extend impact to other EBS-backed products. Oracle rates the issue 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no public exploit code or CISA KEV entry is present in the supplied intelligence, so it should be treated as an unpatched-window exposure rather than a confirmed in-the-wild campaign.
Low-privileged, network-reachable users of Oracle Field Service can read data far beyond their authorized scope in Oracle E-Business Suite releases 12.2.3 through 12.2.15, potentially reaching critical data across additional products because the flaw crosses a security scope boundary (CVSS 3.1 7.7, C:H only). The vulnerability is exploitable over HTTP with no user interaction once a low-privileged session exists, and no public exploit code or active exploitation is identified at time of analysis. Oracle has published a Critical Security Patch Update advisory covering this issue; there is no CISA KEV listing and no EPSS score was supplied in the source data.
Oracle iStore, the e-commerce/shopping cart module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, is exposed to a cross-site style attack in which a low-privileged authenticated attacker with HTTP network access can induce a second user to interact with crafted content and thereby gain unauthorized read, create, modify, and delete access to iStore data — with the vendor warning the impact can extend to other EBS products. With CVSS 3.1 base 8.7 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), the flaw is trivially automatable once an attacker holds any low-privileged account, but exploitation still hinges on victim interaction, which materially lowers real-world risk. No public proof-of-concept, EPSS estimate, or CISA KEV entry was present in the supplied intelligence, so exploitation is assessed as not confirmed in the wild at time of analysis.
Low-privileged users of Oracle iStore in Oracle E-Business Suite 12.2.3 through 12.2.15 can reach data they should not be able to read through the Shopping Cart component over HTTP. Successful exploitation results in unauthorized access to critical data or complete read access to everything the iStore application can reach, and because the flaw carries a scope change it can also significantly affect other E-Business Suite products. Oracle rates it CVSS 3.1 7.7 (confidentiality only, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N); no public exploit code and no CISA KEV entry were identified at time of analysis.
Unauthenticated information disclosure in Oracle iStore (Shopping Cart component) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a remote attacker with plain HTTP access read critical data exposed through the storefront, up to and including all data reachable by the iStore application. The flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact) and is trivially automatable given the network vector and lack of credentials or user interaction. No CISA KEV entry, EPSS score, or public proof-of-concept was present in the supplied intelligence, so exploitation is assessed as possible but not confirmed in the wild at time of analysis.
Authenticated, low-privileged attackers with HTTP access to Oracle iStore in Oracle E-Business Suite 12.2.3 through 12.2.15 can read, create, modify, or delete critical shopping-cart, order, and customer data, giving them full read and write reach into all iStore-accessible records. The flaw sits in the Shopping Cart component and is rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning it is remotely reachable over HTTP with no user interaction and only a low-privilege account. No CISA KEV listing and no public exploit code were identified at time of analysis, so exploitation is currently presumed opportunistic rather than confirmed in the wild.
Oracle Web Applications Desktop Integrator (a component of Oracle E-Business Suite 12.2.3 through 12.2.15) exposes a file download weakness that lets a low-privileged, network-connected user retrieve data they should not be able to reach. Exploitation is rated 'easily exploitable' by Oracle — HTTPS network vector, low complexity, no user interaction — and because the flaw can cross a security boundary (CVSS scope change), successful abuse may expose critical data belonging to other EBS components, not just the Desktop Integrator. CVSS 3.1 base score is 7.7 with confidentiality-only impact; no public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Oracle Sales, the sales module of Oracle E-Business Suite (supported versions 12.2.3 through 12.2.15), exposes critical business data to any low-privileged authenticated user who can reach its HTTP interface. A crafted request against the Internal Operations component bypasses the intended access boundary, and because the CVSS vector carries a scope change (S:C), the exposure is not limited to Oracle Sales — data reachable through additional Oracle products can be read as well. Oracle classifies it as 'easily exploitable' (AV:N/AC:L/PR:L/UI:N, CVSS 3.1 base 7.7, confidentiality-only impact); no public exploit code, EPSS score, or CISA KEV entry was provided in the source data.
Unauthenticated remote attackers with HTTP access to Oracle Sales Offline, a module of Oracle E-Business Suite, can read any data the application exposes on affected versions 12.2.3 through 12.2.15. The flaw sits in the Internal Operations component and requires no credentials, no user interaction and no non-default configuration, yielding a 7.5 confidentiality-only CVSS base score. Exploitation is highly automatable and attractive for bulk data theft, though at the time of analysis there is no public exploit code and no confirmed exploitation (no CISA KEV listing); EPSS is not available in the supplied intelligence.
Oracle Sales Offline, a module of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged authenticated user with HTTP access read critical data far beyond their intended authorization, and Oracle's own scoring marks the impact as a scope change, meaning the flaw in this component can also reach data owned by other EBS products. The CVSS 3.1 base score is 7.7 with high confidentiality impact and no integrity or availability impact, and no public exploit code or CISA KEV entry was identified at time of analysis.
Low-privileged attackers with network access over HTTP can compromise Oracle Sales Online in Oracle E-Business Suite releases 12.2.3 through 12.2.15, exposing critical sales data and allowing limited modification of records. Exploitation requires that a low-privileged account already be held and that a second person (not the attacker) be induced to interact with the application, yet the flaw's scope change means a successful attack can ripple into other E-Business Suite components beyond Sales Online itself. It carries a CVSS 3.1 base score of 7.6, but there is no CISA KEV listing, no public exploit code identified at time of analysis, and no EPSS score supplied in the intelligence feed.
Oracle Report Manager, a component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), exposes an internal-operations flaw that lets a low-privileged attacker with HTTPS network access read critical data and degrade service availability. Successful exploitation yields high confidentiality impact against all Report Manager-accessible data plus partial denial of service, giving the flaw a 7.1 CVSS base score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L). There is no public exploit code and no CISA KEV listing at time of analysis, so exploitation is not confirmed to be active; risk is concentrated in internet- or broadly-reachable EBS Report Manager deployments where ordinary authenticated users exist.
Oracle E-Business Suite Order Management (versions 12.2.5 through 12.2.15) exposes order data through its Product Diagnostic Tools component to any low-privileged user who can reach the HTTP interface. The flaw is easily exploitable — network vector, low complexity, no user interaction — and Oracle notes the impact can spread beyond Order Management into interconnected products, resulting in unauthorized access to critical data or complete access to all Order Management data. No public exploit code or CISA KEV listing was provided at time of analysis; no patch version is specified in the available references beyond the linked Oracle advisory.
Unauthenticated remote attackers can read sensitive data from Oracle Applications Manager within Oracle E-Business Suite 12.2.3 through 12.2.15 by sending crafted HTTP requests to the RapidClone command-line component. The issue is scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), meaning exploitation needs no credentials, no user interaction, and only affects confidentiality — an attacker gains unauthorized access to critical data or all data reachable through Applications Manager. No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis, so exploitation appears opportunistic rather than confirmed in the wild.
Low-privileged authenticated users with HTTP access to Oracle Quality in Oracle E-Business Suite 12.2.3 through 12.2.15 can read critical Quality records and make limited unauthorized changes to them, because the Internal Operations component fails to enforce proper authorization on its requests. Oracle scores this 7.1 with a network vector, low attack complexity and no user interaction, so exploitation is straightforward for anyone who already holds any valid EBS account. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied in the input.
Low-privileged users with HTTP access to Oracle E-Business Suite 12.2.3 through 12.2.15 can leverage a hard-to-reach flaw in the Oracle Partner Management module (Internal Operations component) to read critical data and modify records far beyond their authorization, with the impact crossing into other EBS components because the vulnerability carries a scope change. Oracle rates it CVSS 7.1 and characterizes it as difficult to exploit, and a fix is published in the 2026 Critical Patch Update. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated remote attackers can read any data reachable through the Audience component of Oracle Marketing in Oracle E-Business Suite versions 12.2.3 through 12.2.15 by sending crafted HTTP requests, with no user interaction required. The flaw is scored 7.5 on CVSS 3.1 (AV:N/AC:L/PR:N/UI:N) and is confidentiality-only - integrity and availability of the affected module are unaffected. No public exploit code or CISA KEV listing has been identified at time of analysis, and no EPSS probability was supplied with the source data.
Unrestricted network access to Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 allows unauthenticated attackers to bypass authentication in the Forms Services C/S/Charmode component and take over the application, with CVSS 9.8 and no user interaction. No public exploit or CISA KEV listing is present in the supplied intelligence, but the Oracle advisory confirms the affected versions. Organizations running these releases should treat the flaw as critical and patch immediately.
Improper authentication in the Oracle Forms Client/Server (C/S) Charmode runtime allows an unauthenticated, network-reachable attacker to bypass authentication and operate with the data privileges granted to the Oracle Forms application, yielding high confidentiality and integrity impact (CVSS 3.1 base 9.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Oracle Forms 12.2.1.19.0 and 14.1.2.0.0, as shipped in Oracle Fusion Middleware (Forms Services, C/S, Charmode), are affected; the vector requires no credentials and no user interaction, and there is no availability impact. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and exposure is limited to deployments whose C/S Charmode listener is network-reachable over TCP from an untrusted network.
Unauthenticated network attackers can reach Oracle Forms Services (including the C/S and Charmode components) over HTTP and achieve unauthorized access to, or modification and deletion of, critical data held in the application, in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0. Oracle rates the issue 7.4 with high confidentiality and integrity impact but explicitly characterizes it as difficult to exploit (AC:H), meaning a favorable timing or state condition is required rather than simple request replay. At the time of analysis there is no confirmed CISA KEV listing and no public exploit code identified; exploitability details remain largely undisclosed by the vendor.
Unauthenticated remote takeover of Oracle Forms is achievable through the Forms Services C/S Charmode component in versions 12.2.1.19.0 and 14.1.2.0.0, where an improper-authentication flaw (CWE-287) lets any attacker who can reach the HTTP endpoint seize full control of the affected service, with complete confidentiality, integrity and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N). Based on the available intelligence there is no public exploit code identified at time of analysis and no CISA KEV listing, so urgency is driven by exposure rather than observed exploitation. Real-world risk is constrained mainly by deployment reality: Oracle Forms is legacy enterprise middleware that is usually published through web or application tiers rather than directly to the internet, and the C/S Charmode vector specifically points at character-mode client/server installations.
Unauthenticated remote takeover of Oracle Forms is possible in the Forms Services (C/S, Charmode) component of Oracle Fusion Middleware running versions 12.2.1.19.0 and 14.1.2.0.0. An attacker who can reach the Forms HTTP interface with no credentials, no user interaction, and no special privileges can bypass authentication and gain full control of the affected deployment, and the CVSS scope-change flag (S:C) indicates the compromise can significantly impact additional products tied to the same environment. The vendor-rated CVSS 3.1 base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and the flaw is described as easily exploitable, though no public exploit identified at time of analysis.
Full takeover of Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 is achievable by an unauthenticated remote attacker exploiting an improper-authentication flaw (CWE-287) in the Forms Services C/S (Charmode) component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) confirms there are no credential, user-interaction, or special-complexity prerequisites - only HTTP reachability to an affected Forms deployment is required. No public exploit code has been identified at time of analysis, and real-world exposure is bounded by how widely the legacy C/S Charmode mode is deployed and whether the Forms HTTP endpoint is exposed beyond the internal network.
Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 (Fusion Middleware, components Forms Services, C/S and Charmode) can be compromised by a low-privileged attacker with network access over HTTP, resulting in full read/write access to Forms-accessible data plus a partial denial of service. Exploitation is difficult (AC:H) and depends on a victim other than the attacker performing some action (UI:R), but the flaw carries a scope change, meaning a successful attack can significantly affect products beyond the vulnerable component itself. Oracle rates it CVSS 3.1 7.9; no public exploit code, KEV listing or EPSS score was present in the supplied intelligence at time of analysis.
Unauthenticated remote attackers with HTTP reachability to the Oracle Forms Services listener can bypass authentication and take over Oracle Forms deployments in Oracle Fusion Middleware versions 12.2.1.19.0 and 14.1.2.0.0, specifically the Forms Services, C/S, and Charmode components. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), matching our independent assessment, meaning no credentials and no user interaction are required and the only practical precondition is network access to the Forms endpoint on default configurations. No public exploit code and no confirmed active exploitation were identified at time of analysis, so this is a high-priority patch candidate - particularly for any instance exposed to the internet or to untrusted internal segments - rather than a currently exploited threat.
Authentication bypass in Oracle Forms (Oracle Fusion Middleware) 12.2.1.19.0 and 14.1.2.0.0 lets an unauthenticated, network-positioned attacker take over the Forms Services component - including its C/S and Charmode channels - over HTTP. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no credentials, user interaction, or non-default configuration are stated prerequisites, and the impact is rated complete loss of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). No CISA KEV entry or public exploit code was identified at time of analysis (EPSS was not provided in the available data); the practical limiting factor is exposure, since Forms Services is frequently shielded behind internal networks, reverse proxies, or VPNs rather than being internet-facing. Our assessment concurs with the vendor vector and classifies this as a genuine high-priority vulnerability.
Authentication bypass in Oracle Forms (component: Forms Services, C/S, Charmode) allows an unauthenticated remote attacker with HTTP access to reach data and functionality that should require a valid session, affecting versions 12.2.1.19.0 and 14.1.2.0.0. The flaw carries a CVSS 3.1 base score of 8.6 with a scope-change flag, meaning a compromise of Oracle Forms can pivot to impact other products connected to or served by the Forms tier. Only high confidentiality impact is documented (no integrity or availability impact per the vector), and there is no public exploit code or CISA KEV listing at time of analysis.
Low-privileged attackers with network access to Oracle Field Service can read and modify critical data and cause a partial denial of service, exploiting a difficult-to-trigger flaw in the Internal Operations component of Oracle E-Business Suite. All supported Oracle Field Service releases from 12.2.3 through 12.2.15 are affected. No public exploit code was identified and there is no CISA KEV listing at time of analysis, but the CVSS 3.1 base score of 7.1 with high confidentiality and integrity impact makes this a candidate for prioritization once patch data is verified.
Oracle Field Service, a component of Oracle E-Business Suite (Internal Operations module), is affected by an easily exploitable flaw in versions 12.2.3 through 12.2.15 that lets a low-privileged attacker with HTTP network access read critical data, modify or delete records, and partially disrupt service availability. The vulnerability carries a CVSS 3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L), indicating high confidentiality impact with limited integrity and availability effects, and it does not require user interaction. No public exploit code or CISA KEV entry was present in the supplied intelligence, and there is no confirmed evidence of active exploitation at time of analysis.
Oracle Alert, a component of Oracle E-Business Suite (12.2.3 through 12.2.15), exposes an authorization weakness in its Internal Operations component that lets a low-privileged, network-positioned attacker read and manipulate critical Alert data over HTTP. The flaw carries a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:N), reflecting high confidentiality and integrity impact with no user interaction required. No public exploit code has been identified at time of analysis, and the issue has not been confirmed as actively exploited (CISA KEV); remediation is available through Oracle's Critical Security Patch Update cycle, so patching should be prioritized for internet- or partner-facing EBS deployments.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 contain a flaw in the Siebel Cloud Manager component that lets a low-privileged, network-positioned user read and modify critical CRM data, with impact extending beyond the vulnerable component (scope change). The CVSS 3.1 base score is 8.2 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N), reflecting high attack complexity and the need for a valid low-privileged account rather than anonymity. No public exploit code and no CISA KEV entry were identified at time of analysis, so exploitation is confirmed only as theoretically practical, not known to be active.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 expose a flaw in the Siebel Cloud Manager component that lets an attacker already holding a low-privileged account on the platform, and positioned on the same physical/adjacent network segment as the hosting hardware, read essentially all CRM data, modify or delete some of it, and partially disrupt service. The CVSS 3.1 base score is 8.2 (AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L), and the scope-change metric indicates the compromise can spill over into additional products beyond Siebel itself. No public exploit code has been identified and the issue is not listed in CISA KEV, but it should not be ignored: the confidentiality impact is total, Oracle rates exploitability as 'easily exploitable', and no EPSS score or CWE mapping was supplied to further refine the risk picture.
Oracle E-Business Suite's Marketing module (Audience component) in versions 12.2.3 through 12.2.15 exposes critical data to any attacker holding a low-privileged, authenticated account, who can reach the vulnerable component over HTTP and read information well beyond their intended authorization boundary. Oracle scores it 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — a scope-changing, confidentiality-only flaw with no integrity or availability impact. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so the immediate driver is the breadth of affected enterprise deployments rather than confirmed in-the-wild activity.
Oracle Marketing, a module of Oracle E-Business Suite (Audience component), versions 12.2.3 through 12.2.15, exposes an easily exploitable flaw that lets a low-privileged, network-connected attacker read critical data and modify some records through the HTTP interface — with a scope change that can extend impact to other EBS products. Oracle rates it CVSS 3.1 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) and released a fix in its Critical Security Patch Update (cspusep2026.html). No public exploit code or CISA KEV listing was present in the supplied intelligence, so exploitation is currently assessed as opportunistic rather than confirmed active.
Oracle Banking Corporate Lending versions 14.5.0.0.0 through 14.9.0.0.0 contain an unauthenticated, hard-to-trigger flaw in the Core component that lets an attacker positioned on an adjacent network segment read and modify critical lending data, with a scope change that can extend impact to connected Oracle Financial Services products. The CVSS 3.1 base score is 8.0 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N), reflecting high confidentiality and integrity impact on a non-internet-exposed attack surface. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was supplied, so real-world exploitation is currently unconfirmed.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 contain a flaw in the Siebel Cloud Manager component that a high-privileged attacker with a logon to the underlying infrastructure can use to read and modify critical Siebel data and, through a scope change, impact additional products. The CVSS 3.1 base score is 7.9 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), so exploitation is rated easy once the attacker already holds elevated local access — this is an insider/privileged-tenant risk rather than a remotely reachable pre-auth bug. No public exploit code and no CISA KEV entry were present in the supplied intelligence, and no EPSS data was provided, so active exploitation is not confirmed.
Unauthenticated attackers who can reach the HTTP interface of Oracle Siebel CRM Cloud Applications, specifically the Siebel Cloud Manager component, can bypass authentication and gain full read access to critical CRM data plus limited ability to insert, update or delete records. The flaw affects supported releases 22.3 through 26.7 and carries a CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N), meaning it is remotely reachable, low complexity and requires no credentials or user interaction. No public exploit code or CISA KEV listing was present in the supplied intelligence, so exploitation status is unconfirmed at time of analysis.
Unauthenticated attackers with HTTP network access can read critical data from Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 by exploiting an authentication bypass in the Siebel Cloud Manager component. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) with high confidentiality impact only - integrity and availability are unaffected - meaning a successful hit exposes all data reachable through the affected component. No public exploit code, EPSS score, or CISA KEV entry was supplied in the intelligence feed, so active exploitation is currently unconfirmed.
Unauthenticated attackers with network reachability to the SSH interface of Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.7) can bypass authentication and gain unauthorized access to critical CRM data through the Siebel Cloud Manager component. Oracle scores the flaw 8.6 with a scope change, meaning a successful compromise can extend beyond the Siebel deployment to affect additional products. No public exploit code, EPSS score, or CISA KEV entry was provided at the time of analysis, although the low-complexity, no-credentials attack profile makes rapid weaponization plausible.
Oracle Siebel CRM Cloud Applications versions 22.3 through 26.7 expose the Siebel Cloud Manager component to unauthenticated attackers who can reach the host over an adjacent network segment, allowing full read and write access to critical CRM data. The flaw is rated CVSS 8.1 (AV:A/AC:L/PR:N/UI:N, C:H/I:H/A:N) and is tagged as an authentication bypass, meaning no credentials or user interaction are required once an attacker is positioned on the same physical or logical communication segment as the affected service. There is no CISA KEV listing and no public exploit identified at time of analysis, but the low attack complexity and lack of authentication make the vulnerability highly automatable for anyone who already holds a foothold inside the hosting network or cloud subnet.
Authenticated low-privileged users of Oracle E-Business Suite 12.2.3 through 12.2.15 can abuse the Applications Framework 'Search Bean' component to read, create, delete, or modify critical data they should not be able to touch, giving an attacker with a basic application account broad confidentiality and integrity impact across the framework. The vulnerability is remotely reachable over HTTP with low attack complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1), so any valid low-privilege credential is effectively a stepping stone to full data compromise. There is no public exploit code and no CISA KEV listing at time of analysis, but the Oracle quarterly patch referenced in the advisory is the only reliable fix.
Oracle PeopleSoft Enterprise PRTL Interaction Hub 9.1 (Enterprise Portal component) permits a low-privileged user with HTTP access to the portal to read data well beyond their assigned role, exposing critical enterprise data and, because the flaw crosses a trust boundary, potentially data held in other PeopleSoft products reachable through the portal. Oracle scores it 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — confidentiality-only with a scope change — and fixed it in the 2026 Critical Patch Update. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the source data.
Missing authorization enforcement in the Core component of Oracle Enterprise Manager for Oracle Database 24.1 allows an authenticated, low-privileged attacker with HTTP access to read any data the management platform can reach, including data belonging to managed database targets, a confidentiality-only compromise that also changes scope (CVSS 3.1: 7.7). Oracle rates it easily exploitable because it needs only a valid low-privilege account and network reach to the console, and no public exploit identified at time of analysis. Oracle has published a fix in its Critical Security Patch Update advisory for the affected 24.1 release.
Unauthenticated remote attackers can achieve full takeover of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 by reaching the OID LDAP Server through its exposed T3 or IIOP remoting listeners, requiring no credentials and no user interaction (CVSS 3.1 base score 9.8; AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The root cause is an authentication-bypass condition (CWE-287) in the Fusion Middleware OID LDAP Server component, and successful exploitation yields complete loss of confidentiality, integrity and availability across the directory service. No CISA KEV entry and no public exploit code were identified at time of analysis, so this is not confirmed active exploitation; however, the pre-authentication, network-reachable attack path means internet-facing or broadly reachable OID/WebLogic deployments carry the highest risk, while instances confined to trusted management networks are substantially harder to reach because the only real gating factor is network access to the T3/IIOP listener.
Authentication bypass in Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network access to the OID LDAP Server component to take over the directory service, with high confidentiality, integrity and availability impact (CVSS 3.1 base score 9.8). Exploitation requires no credentials, no user interaction and no non-default configuration per the assessed vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); the principal practical constraint is reachability of the LDAP listener, since directory servers are normally deployed on internal or segmented networks rather than exposed to the internet. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but Oracle's 'easily exploitable' characterization and the complete compromise outcome make this a high-priority patch target for any organization running the affected versions.
Unauthenticated attackers with network access to the OID LDAP Server component can fully compromise Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0, achieving complete loss of confidentiality, integrity, and availability of the directory service (CVSS 3.1 base score 9.8). Because the flaw is an improper authentication weakness (CWE-287) reachable over LDAP with no credentials, no user interaction, and no special configuration - Oracle itself characterizes it as 'easily exploitable' - any directory deployment whose LDAP listener is exposed to an untrusted network is directly at risk of takeover. No public exploit code has been identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (no CISA KEV listing), so the practical risk is driven primarily by network exposure of the OID LDAP port.
Unauthenticated remote takeover of Oracle Internet Directory is achievable through its OID LDAP Server component in versions 12.2.1.4.0 and 14.1.2.1.0. The flaw is an improper-authentication weakness (CWE-287) rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning an attacker who can reach the LDAP listener needs no credentials, no user interaction, and no non-default configuration to gain full control of confidentiality, integrity, and availability of the directory service. Our assessment concurs with this vector and flags it as a genuine top-tier priority; no public exploit code and no confirmed active exploitation were identified at time of analysis, so the practical risk hinges mainly on whether OID LDAP ports (default 389/636) are exposed beyond trusted internal or management networks.
Takeover of Oracle Internet Directory via its LDAP server component allows unauthenticated remote attackers to fully compromise the directory service. Affected versions are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability is rated CVSS 10.0 with scope change; no public exploit or CISA KEV listing was identified in the provided data.
Authentication bypass in the OID LDAP Server component of Oracle Internet Directory 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker with network access to the LDAP listener to take full control of the directory service, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the flaw sits in the authentication path itself (CWE-287) and requires no credentials, no user interaction, and no special configuration, any instance whose LDAP port (typically 389, or 636 for LDAPS) is reachable from an untrusted network should be treated as exposed. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and no EPSS score was supplied, but the pre-authentication nature and the directory's role as a central identity store make this a genuine high-priority issue rather than a high-score/low-risk artifact.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Runtime Tools component that allows an attacker who already controls a high-privileged account to reach past that account's authorization boundary over HTTP, gaining unauthorized read access to critical portal data and limited ability to modify it, with a documented scope change that can affect connected products. Oracle rates it CVSS 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N) — network-reachable but gated behind strong privileges. No public exploit code and no CISA KEV listing were identified at time of analysis, so this reads as a post-compromise privilege escalation and data-exposure issue rather than a remotely exploitable pre-auth break.
Unauthenticated attackers with HTTP network access to Oracle WebCenter Portal 12.2.1.4.0 or 14.1.2.0.0 can read data they should not be able to reach, including critical application data, via a flaw in the Runtime Tools component. The CVSS 3.1 base score is 7.5 (AV:N/AC:L/PR:N/UI:N, confidentiality-only impact), making it trivially automatable against any internet- or intranet-exposed instance that has not applied the referenced Oracle Critical Security Patch Update. There is no public exploit code identified at time of analysis and no CISA KEV listing, so exploitation appears opportunistic rather than confirmed in the wild.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Runtime Tools component that lets a low-privileged, network-positioned attacker read and partially modify portal data via HTTP. Oracle rates it 7.1 (AV:N/AC:L/PR:L/UI:N, C:H/I:L), meaning exploitation is trivial once any valid low-privileged account is held, with full confidentiality impact against the portal's accessible data. No CISA KEV listing, public exploit code, or EPSS score was supplied with the source data, so active exploitation is unconfirmed at time of analysis.
Low-privileged attackers with HTTP network access can exploit the Security Framework component of Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 to gain unauthorized read access to critical data and limited write/delete access, with the impact extending to additional connected products (CVSS scope change). At CVSS 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) the flaw is trivially automatable once any valid low-privileged account exists, but exploitation requires authentication, so it is not an unauthenticated internet-wide attack. Exploitation status: no public exploit identified at time of analysis; the CVE is not listed in CISA KEV and no EPSS score was supplied in the source data, so real-world activity is unconfirmed.
Authenticated but low-privileged users with HTTP access to Oracle WebCenter Portal can reach data well beyond their intended permissions through a flaw in the Runtime Tools component, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Oracle scores it CVSS 7.7 with a scope change, meaning the portal's compromise can ripple into additional products reachable from it, with the impact limited to confidentiality. Neither CISA KEV listing nor public exploit code has been identified at time of analysis, and no EPSS probability was supplied, though the low attack complexity and absence of user interaction make weaponization plausible.
Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 contain an authentication-bypass flaw in the Runtime Tools component that can be triggered by an unauthenticated attacker over HTTP, giving access to critical portal data as well as the ability to modify or delete some of it. Oracle rates the issue CVSS 8.2 (C:H/I:L, no availability impact) with network vector, low complexity, and no privileges or user interaction required, making it trivially automatable against any internet- or intranet-reachable deployment that has not applied the referenced Critical Patch Update. No public exploit code or CISA KEV entry was present in the supplied intelligence at time of analysis, so exploitation is assessed as possible but not confirmed in the wild.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 ship a flaw in the Runtime Tools component that lets any authenticated low-privileged user read critical portal data and partially degrade portal availability over HTTP. Oracle rates it as easily exploitable (CVSS 7.1, AV:N/AC:L/PR:L/UI:N, C:H/A:L), so no user interaction and no administrative role is needed beyond a valid account. No public exploit code and no CISA KEV entry were identified at time of analysis, but the data-exposure impact on an enterprise portal makes it worth prompt patching.
Oracle WebCenter Portal 12.2.1.4.0 and 14.1.2.0.0 contain an easily exploited authorization flaw in the Runtime Tools component that lets a low-privileged, network-connected user reach and manipulate data well outside their intended scope, including data belonging to connected products (CVSS 8.5, scope change, high confidentiality and low integrity impact). Exploitation requires only a valid low-privilege portal account and standard HTTP access — no user interaction — making it attractive for lateral movement inside enterprise portal deployments. There is no public exploit identified at time of analysis, and no CISA KEV listing or EPSS score was supplied in the available intelligence.