Authentication Bypass
Monthly
Unauthorized data manipulation in Oracle Advanced Benefits 12.2.15 (Oracle E-Business Suite, Internal Operations component) lets a low-privileged attacker with HTTP network access create, delete, or modify critical data. Because the CVSS vector carries a scope change (S:C), successful attacks can significantly impact additional products beyond Advanced Benefits itself. The flaw is rated CVSS 3.1 7.7 with integrity-only impact (I:H, C:N, A:N); no public exploit is identified at time of analysis, and it was disclosed via Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle EDI Gateway (a module of Oracle E-Business Suite) is possible where a high-privileged, authenticated attacker with HTTP network access can achieve complete takeover of the component, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, affecting EBS versions 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Full compromise of Oracle Product Hub (Internal Operations component) in Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated, low-privileged attacker with HTTP network access to take over the product and, because of a scope change, significantly impact additional connected products. The flaw was disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 score of 8.5, though the vector rates it as difficult to exploit (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-based takeover of Oracle Product Hub (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to fully compromise the product via HTTP. Affected releases span EBS 12.2.3 through 12.2.15, and the CVSS 3.1 vector (8.8) reflects high confidentiality, integrity, and availability impact with low attack complexity. No public exploit identified at time of analysis; disclosed through Oracle's July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Product Hub (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the Product Hub application. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle tags it as an Authentication Bypass. There is no public exploit identified at time of analysis and no CISA KEV listing, but it is addressed in Oracle's July 2026 Critical Patch Update.
Unauthorized data disclosure in the Oracle In-Memory Cost Management for Discrete Industries component (Internal Operations) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows an unauthenticated, network-based attacker over HTTP to read critical or all data accessible to the product. The flaw is rated CVSS 3.1 7.5 with a pure confidentiality impact (C:H/I:N/A:N) and was disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, though the 'Authentication Bypass' tag and low attack complexity make it an attractive target for internet-exposed EBS instances.
Data compromise in Oracle Process Manufacturing Financials (Internal Operations component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged, network-adjacent attacker to read, create, modify, or delete all data accessible to the module over HTTP. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impact but no availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle EBS is a recurring target for post-authentication attacks.
Information disclosure and limited data tampering in Oracle E-Business Suite's Process Manufacturing Logistics module (Internal Operations component) lets a low-privileged, network-based attacker reach critical application data over HTTP. Affecting supported EBS releases 12.2.3 through 12.2.15, a successful attack yields full read access to all Process Manufacturing Logistics data plus partial write (insert/update/delete) capability. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS was not provided.
Broad data compromise in Oracle Customers Online (part of Oracle E-Business Suite, component: Internal Operations) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High), it carries full confidentiality and integrity impact with no availability impact, and Oracle tags it as an authentication-bypass-class weakness. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and modest privilege requirement make it a high-priority fix.
Takeover of Oracle Process Manufacturing (OPM) Product Development is possible in Oracle E-Business Suite 12.2.15 via its Quality Management Specs component, where a low-privileged attacker with HTTP network access can fully compromise the module. Oracle rates this 8.8 (High) with full confidentiality, integrity, and availability impact, and flags it as easily exploitable, meaning a valid but low-privilege application account is the only barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Process Manufacturing Systems (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with network HTTP access read, create, modify, or delete all data accessible to the Process Manufacturing module. Oracle rates it 8.1 (High) with confidentiality and integrity impact but no availability impact, and describes it as 'easily exploitable.' No public exploit identified at time of analysis; the fix ships in the Oracle Critical Patch Update of July 2026.
Full compromise of the Oracle Process Manufacturing Systems module in Oracle E-Business Suite 12.2.11 through 12.2.15 is achievable by a high-privileged, authenticated attacker sending crafted HTTP requests to the Internal Operations component. Successful exploitation yields complete takeover of the Process Manufacturing Systems application with high confidentiality, integrity, and availability impact (CVSS 7.2). No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access and partial denial of service in Oracle E-Business Suite's Document Management and Collaboration module (Attachments component) allows a remote unauthenticated attacker to read, insert, update, or delete a subset of application data over HTTP. Affecting supported EBS releases 12.2.3 through 12.2.15, the flaw is rated CVSS 7.3 and is described by Oracle as easily exploitable, requiring no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, unauthenticated network vector makes it a meaningful patching priority in a product family that has been a repeated target of mass-exploitation campaigns.
Full takeover of Oracle PeopleSoft Enterprise FIN Manufacturing Brazil 9.1 is possible when an unauthenticated remote attacker reaches the vulnerable Integration component over HTTPS. Oracle rates this 9.8 (CVSS 3.1) with high confidentiality, integrity, and availability impact and describes it as easily exploitable, meaning no authentication, privileges, or user interaction are required. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low-complexity unauthenticated profile makes it a priority patch in the Oracle July 2026 Critical Patch Update.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise FIN Manufacturing Argentina 9.1 (Manufacturing component) lets a remote attacker read, create, modify, or delete all data accessible to the module over HTTP with no credentials. Oracle rates it CVSS 3.1 9.1 (Confidentiality and Integrity High, Availability None); it was disclosed in the Oracle Critical Patch Update of July 2026 and carries an 'Authentication Bypass' tag. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Staffing component) lets a low-privileged, authenticated attacker send crafted HTTP requests to fully compromise the module and, due to a scope change, impact adjacent PeopleSoft products and data. Rated CVSS 9.9 with full confidentiality, integrity, and availability loss, this is disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eSettlements component) lets an unauthenticated attacker on the adjacent network segment read confidential PeopleSoft data and make limited unauthorized modifications. The flaw carries a scope change, so a successful attack can significantly impact products beyond the vulnerable module. No public exploit identified at time of analysis, and no EPSS or KEV signal is provided; the 8.2 CVSS score is driven by high confidentiality impact plus scope change rather than remote internet exploitability.
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement component) allows a remote, unauthenticated attacker to reach the module over HTTP and achieve high-impact modification of critical data, limited data disclosure, and a partial denial of service. Because Oracle assigns a scope change (S:C), a successful attack can reach beyond the vulnerable module and significantly impact additional PeopleSoft products, which drives the 9.9 CVSS score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement component) allows a remote, unauthenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. The CVSS 3.1 base score is 9.1 (C:H/I:H, no availability impact) and the flaw is described by Oracle as easily exploitable, with an "Authentication Bypass" tag reinforcing the PR:N vector. No public exploit is identified at time of analysis and it is not listed in CISA KEV; a fix ships in the Oracle Critical Patch Update of July 2026.
Unauthenticated remote compromise of Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Integration component) allows a network attacker to reach critical data and, because of a scope change, to impact additional PeopleSoft products beyond the vulnerable module. The flaw is rated CVSS 3.1 9.9 and is trivially exploitable over HTTP with no authentication or user interaction, yielding full read of accessible data plus partial write and partial denial-of-service. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the near-maximal score and unauthenticated network vector make it a high-priority patching candidate.
Unauthenticated information disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Staffing component) lets a remote attacker send crafted HTTP requests to read critical data, potentially achieving complete access to all data accessible to the affected module. Oracle rates it easily exploitable with a CVSS 3.1 base score of 7.5, but the impact is confined to confidentiality (no integrity or availability effect). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle PeopleSoft Enterprise HCM Global Payroll Switzerland 9.2 is possible via network-facing HTTP by an attacker who already holds high application privileges, per Oracle's July 2026 Critical Patch Update. Because the flaw carries a scope change, successful attacks can reach beyond the Global Payroll Switzerland component into additional PeopleSoft products, yielding full confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, but the low attack complexity (CVSS 9.1) makes it a priority patch for organizations running this payroll module.
Data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (eProcurement component) lets a remote unauthenticated attacker read, create, modify, or delete all data accessible to the module over HTTP. The flaw is rated CVSS 3.1 7.4 with high confidentiality and integrity impact but no availability impact, and is difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor advisory ties the fix to the Oracle July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Common Objects component) allows a remote unauthenticated attacker to reach and read critical financial data over HTTP. Oracle rates it easily exploitable with a CVSS 3.1 base of 7.5 and confidentiality-only impact (C:H/I:N/A:N), and it is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Takeover of Oracle Communications Converged Application Server 8.3 is possible via a flaw in its RTP Proxy component, exploitable only by a high-privileged attacker with local logon to the host where the server runs. The CVSS 3.1 vector (AV:L/AC:H/PR:H/S:C) reflects difficult exploitation requiring existing elevated access, but a scope change means a successful attack can impact additional products beyond the server itself, with full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Full compromise (takeover) of Oracle Communications Converged Application Server 8.3 is possible via its Security component, where a high-privileged attacker with TLS network access can achieve confidentiality, integrity, and availability loss that also crosses a trust boundary to affect additional products (scope change). CVSS 3.1 scores this 8.0 despite high attack complexity and a high-privilege prerequisite. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS value was supplied.
Full takeover of Oracle Communications Converged Application Server 8.2 and 8.3 is possible for a remote, unauthenticated attacker over TCP/IP, per Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 9.0 with a scope change (S:C), a successful attack can compromise confidentiality, integrity, and availability of the server and significantly impact additional connected products, though high attack complexity (AC:H) makes exploitation non-trivial. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broad data compromise in Oracle E-Business Suite Secure Enterprise Search (Search Integration Engine) affects EBS versions 12.2.3 through 12.2.15, where a network attacker with only low-level authenticated access over HTTP can read, create, modify, or delete all data accessible to the Secure Enterprise Search component. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N) rates it 8.1 High, reflecting low attack complexity and full confidentiality and integrity impact without availability loss. No public exploit identified at time of analysis, though the vendor's 'Authentication Bypass' tagging suggests weak access-control enforcement in the affected component.
Full takeover of the Oracle Database RDBMS component is possible for a low-privileged attacker who holds the Execute DBMS_CLOUD privilege and can reach the server over Oracle Net, affecting Database 19.3-19.31 and 23.4.0-23.26.2. Because the CVSS vector carries a scope change (S:C), a successful attack can pivot beyond the database to significantly impact additional products, yielding full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; the 9.9 base score is driven by low attack complexity and the scope change rather than by unauthenticated access.
Unauthorized data compromise in Oracle PeopleSoft Enterprise SCM Manufacturing 9.2 (Security component) lets a remote, unauthenticated attacker read, create, modify, or delete all data accessible to the application over HTTPS. Rated CVSS 3.1 7.4 with high confidentiality and integrity impact but no availability impact, and flagged by Oracle with an Authentication Bypass characteristic. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation is rated high-complexity by Oracle.
Unauthorized data compromise in Oracle PeopleSoft Enterprise SCM eProcurement 9.2 (Manage Requisition Status component) lets a remote, unauthenticated attacker read all module-accessible data and perform limited updates over HTTP, with a scope change that can significantly impact additional connected products. Rated CVSS 3.1 9.3 (Critical) and tagged as an authentication bypass, the flaw is easily exploitable without user interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data modification in Oracle PeopleSoft Enterprise SCM Purchasing 9.2 (Purchasing component) allows a remote, unauthenticated attacker with HTTP network access to create, delete, or modify critical Purchasing data and read a subset of accessible data. Oracle rates it CVSS 3.1 8.2 and describes it as easily exploitable with no privileges or user interaction, and its own tagging characterizes the flaw as an authentication bypass. No public exploit code has been identified and it is not listed in CISA KEV at time of analysis, so risk is currently driven by exposure rather than confirmed active exploitation.
Remote unauthenticated compromise of Oracle PeopleSoft Enterprise FIN Expenses 9.2 (Expenses component) allows attackers with only HTTP network access to read, create, delete or modify all Expenses-accessible data and to cause a partial denial of service. Rated CVSS 3.1 9.4 and flagged by Oracle as easily exploitable, meaning no authentication or user interaction is required. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the low-complexity unauthenticated profile makes it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Local privilege-boundary compromise in Oracle Solaris 11.3 and 11.4 (Utility component) allows a low-privileged attacker with a local logon to gain unauthorized read and write access to critical Solaris data, with a scope change that can significantly impact additional products beyond Solaris itself. The flaw carries a CVSS 3.1 base score of 7.5 despite requiring high attack complexity, reflecting the high confidentiality and integrity impact combined with scope change. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Identity Manager (OIM Legacy UI component) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 allows attackers with only network/HTTP access to read, create, delete, or modify any data the identity platform can reach. Tagged by the reporter as an authentication bypass, this flaw carries a CVSS 9.1 rating driven by high confidentiality and integrity impact, and because OIM governs enterprise identity and account provisioning, a successful attack effectively hands over control of user identity data. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Complete takeover of Oracle Identity Manager is possible through its OIM Legacy UI component, allowing a remote unauthenticated attacker with only HTTP network access to fully compromise the confidentiality, integrity, and availability of the identity governance platform. Affected releases are the Fusion Middleware bundles 12.2.1.4.0 and 14.1.2.1.0. Oracle rates this CVSS 9.8 and addressed it in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Unauthenticated remote compromise of Oracle Agile Engineering Data Management 6.2.1 (Install component) lets attackers with only HTTP network access modify or destroy critical PLM data, read a subset of accessible data, and trigger a complete denial of service. Oracle rates it CVSS 9.4 and describes it as easily exploitable, but it is not in CISA KEV and no public exploit has been identified. The combination of no authentication requirement with high integrity and availability impact makes it a serious exposure for any network-reachable deployment.
Unauthorized data disclosure in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Installation component) allows an unauthenticated attacker on the adjacent network segment to compromise confidentiality and, due to a scope change, impact additional connected products. The flaw is rated CVSS 3.1 7.4 with confidentiality-only impact and no integrity or availability effect. There is no public exploit identified at time of analysis, and it was disclosed by Oracle in the July 2026 Critical Patch Update.
Unauthenticated remote compromise of Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) lets network attackers read, create, modify, or delete all data accessible to the application over HTTP. Oracle rates it 'easily exploitable' with a CVSS 3.1 base score of 9.1 driven by full confidentiality and integrity impact, and community tagging labels it an authentication bypass. No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided.
Complete takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible when a remote, unauthenticated attacker reaches the Reporting component over HTTP, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (C:H/I:H/A:H) reflects that a successful attack yields full confidentiality, integrity, and availability compromise of the product. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication, low-complexity profile makes it a high patch priority.
Sensitive data compromise in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) lets a low-privileged, network-authenticated attacker read all application-accessible data and make limited unauthorized modifications, with a scope change that can significantly impact additional products. Oracle rates it easily exploitable but it requires tricking a separate user into interaction (UI:R), yielding a CVSS 3.1 base score of 7.6. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw resides in the product's Installation component and yields full compromise of confidentiality, integrity, and availability (CVSS 3.1 9.8). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthorized critical-data access and partial denial of service in Oracle Product Lifecycle Analytics 3.6.1 (Supply Chain suite, Installation Issues component) allows a remote, unauthenticated attacker over HTTP to fully read all data the application can access and partially disrupt service. The flaw carries a scope change, so successful attacks may significantly impact adjacent Oracle products beyond the analytics component itself. Rated CVSS 3.1 9.3 (Critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege-to-scope-change compromise in Oracle Product Lifecycle Analytics 3.6.1 (Oracle Supply Chain, Installation Issues component) lets an attacker with logon access to the host where the software runs take over the application without application-level credentials. Successful exploitation yields full read and write access to all data accessible to Oracle Product Lifecycle Analytics and, because of a CVSS scope change, may significantly impact other products on the same infrastructure. No public exploit identified at time of analysis; the flaw was reported by Oracle and fixed in the July 2026 Critical Patch Update.
Unauthorized data access and manipulation in Oracle Agile PLM 9.3.6 (Security component) allows a remote unauthenticated attacker with HTTP access to read, create, delete, or modify all Agile PLM-accessible data. The high attack complexity (AC:H) means exploitation requires specific conditions the attacker cannot fully control, which lowers real-world exploitability despite the network-facing, no-authentication vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'Authentication Bypass' tag and full confidentiality/integrity impact make this a meaningful patch priority for exposed deployments.
Unauthorized data disclosure in Oracle Agile PLM 9.3.6 (Security component) lets a remote, unauthenticated attacker reach critical business data over HTTP without any user interaction. The Oracle CPU (July 2026) and EUVD tagging characterize this as an authentication-bypass-class weakness yielding full read access to all Agile PLM-accessible data. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Agile PLM 9.3.6 (Security component) allows a remote attacker with only HTTP network access to read, create, delete, or modify all data accessible to the application. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 9.1; no public exploit identified at time of analysis, and it is not listed in CISA KEV. It was reported by Oracle's own security team and addressed in the Oracle July 2026 Critical Patch Update.
Full product takeover of Oracle Agile PLM 9.3.6 (Product Lifecycle Management) is possible by an unauthenticated remote attacker over HTTP against the Security component, per Oracle Critical Patch Update July 2026. The CVSS 3.1 base score is 8.1 with high attack complexity, meaning exploitation is difficult and likely requires specific conditions or timing to succeed, but a successful attack yields complete compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was supplied.
Full compromise of Oracle Agile PLM 9.3.6 (Security component) allows an unauthenticated remote attacker to take over the application over HTTP with no user interaction. Rated CVSS 9.8 with high impact to confidentiality, integrity, and availability, this flaw is disclosed via Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch for internet- or intranet-exposed instances.
Full application takeover in Oracle Agile PLM 9.3.6 (Product Lifecycle Management) is possible via the User and User Group component, where a low-privileged authenticated user with HTTP network access can escalate to complete compromise of confidentiality, integrity, and availability. Rated CVSS 3.1 8.8 (High) and disclosed in Oracle's Critical Patch Update of July 2026, exploitation requires only valid low-level credentials and low attack complexity, making it attractive for insider or credential-theft abuse. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker reach the Content Acquisition System over HTTPS and read, create, modify, or delete all data accessible to the product. The 'Authentication Bypass' tagging combined with PR:N in the CVSS vector indicates the flaw defeats access controls without credentials, though the high attack complexity (AC:H) means exploitation is non-trivial. No public exploit identified at time of analysis and the issue is not in CISA KEV; it was disclosed by Oracle in the July 2026 Critical Patch Update.
Full product takeover in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Forge component) lets an unauthenticated remote attacker compromise confidentiality, integrity and availability over HTTP, per Oracle's CVSS 3.1 8.1 rating. Exploitation is rated high-complexity (AC:H), so it requires specific conditions or timing rather than a trivial single request. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Application Controller) allows a low-privileged local attacker with logon access to read, create, modify, or delete all data accessible to the product. The flaw carries a CVSS 3.1 base score of 7.1 (C:H/I:H, no availability impact) and is described by Oracle as 'easily exploitable.' No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; it was disclosed in the Oracle Critical Patch Update of July 2026.
Complete takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via the Endeca Application Controller, which an unauthenticated attacker can reach over HTTP to fully compromise the product. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and is described by Oracle as easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV, but its network-facing, no-authentication profile makes it a high-priority patch item.
Sensitive data disclosure and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) let a low-privileged, network-based attacker read all data accessible to the application and hang or repeatedly crash the service over HTTP. Rated CVSS 3.1 8.1 (High) with confidentiality and availability impact but no integrity impact. Disclosed in the Oracle July 2026 Critical Patch Update; no public exploit identified at time of analysis and not listed in CISA KEV.
Unauthorized data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 lets a remote, unauthenticated attacker read all data accessible to the Experience Manager component over HTTP. Oracle rates it CVSS 7.5 with high confidentiality impact and no integrity or availability effect, and the reporter tags it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-facing, no-privilege profile makes it a straightforward information-disclosure risk.
Unauthorized data disclosure in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker abuse the exposed RMI interface of the Experience Manager component to read critical or all Guided Search accessible data. Scored CVSS 3.1 7.5 with confidentiality-only impact and rated 'easily exploitable' by Oracle, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Disclosed in Oracle's July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker reach sensitive data over HTTP, with Oracle and the EUVD entry tagging the flaw as an authentication bypass. The CVSS 3.1 base score of 7.5 reflects a high-confidentiality, no-integrity, no-availability impact, and Oracle labels it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a credible target once patch details are reverse-engineered.
Unauthenticated data compromise in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) allows remote attackers over HTTPS to read, create, modify, or delete all data accessible to the service without any credentials. Oracle rates this CVSS 9.1 with high confidentiality and integrity impact and characterizes it as 'easily exploitable,' and the intelligence tags flag an authentication-bypass class issue. No public exploit code has been identified and it is not listed in CISA KEV at time of analysis.
Unauthenticated data compromise and denial of service in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) lets a remote attacker send crafted HTTP requests to read all data accessible to the service and to crash or hang it completely. Rated CVSS 3.1 9.1 (Critical) with high confidentiality and availability impact and no integrity impact; disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, but the combination of network reachability, no authentication, and low complexity makes it an urgent patch priority.
Authentication bypass in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a remote, unauthenticated attacker to read and modify all data accessible to the application over HTTP. The flaw carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact) and is easily exploitable per Oracle. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-privileges vector makes it a high-priority patch.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a low-privileged, network-based attacker over HTTP to gain complete read access to all accessible data plus limited update, insert, and delete capability. Rated CVSS 7.1 and tagged as an authentication bypass, it was disclosed by Oracle in the July 2026 Critical Patch Update and requires only low-level credentials with no user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all data accessible to the application. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact) and tagged as an authentication-bypass-class issue by the reporter. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix ships in Oracle's July 2026 Critical Patch Update.
Privilege escalation to full takeover in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a low-privileged attacker with HTTP network access compromise the Experience Manager component, yielding high confidentiality, integrity, and availability impact. Rated CVSS 3.1 8.8 and reported through Oracle's coordinated disclosure (July 2026 CPU), with no public exploit identified at time of analysis and no CISA KEV listing. Any authenticated user of the affected component can potentially seize control of the entire product instance.
Remote takeover in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Content Acquisition System component) allows an unauthenticated attacker with HTTP network access to fully compromise the product. Oracle rates it CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning no authentication or user interaction is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-facing, unauthenticated 'takeover' profile makes it a top-tier patching priority.
Unauthorized disclosure of critical data in Oracle Payroll (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read all Payroll-accessible data. Because the flaw carries a scope change, successful attacks can significantly impact additional Oracle products beyond Payroll itself, raising the effective blast radius. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle rates it CVSS 3.1 7.7 with confidentiality-only impact.
Remote takeover in Oracle WebCenter Sites 14.1.2.0.0 allows an unauthenticated attacker with only HTTP network access to fully compromise the product, yielding complete confidentiality, integrity, and availability loss (CVSS 3.1 9.8). Disclosed in the Oracle Critical Patch Update of July 2026 and reported by Oracle's own security alert team, it is rated easily exploitable but has no public exploit identified at time of analysis. WebCenter Sites is Oracle's enterprise web experience/content management platform, so a compromise means attacker control over the delivery of managed web content.
Unauthorized data disclosure in Oracle Complex Maintenance, Repair and Overhaul (CMRO), a module of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a remote unauthenticated attacker abuse the Internal Operations component over HTTP to read critical CMRO data and make limited unauthorized modifications. Because the flaw carries a scope change, a successful attack can significantly impact products beyond CMRO itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity, so exploitation is rated difficult.
Full takeover of Oracle Commerce Platform 11.4.0 is possible by a remote unauthenticated attacker who reaches the Dynamo Application Framework component over HTTP, per Oracle's July 2026 Critical Patch Update. Successful exploitation compromises confidentiality, integrity, and availability of the platform (CVSS 3.1 8.1), though Oracle rates it difficult to exploit (AC:H). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated data tampering and partial denial of service in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework) allows a remote attacker to reach the platform over HTTP and, without any credentials, perform unauthorized insert/update/delete on some accessible data, read a subset of accessible data, and partially disrupt availability. Oracle rates it easily exploitable with a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.
Data compromise in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) lets a remote, unauthenticated attacker read, create, modify, or delete all data accessible to the platform over HTTP. The flaw carries a CVSS 3.1 score of 7.4 with high confidentiality and integrity impact but no availability impact, and Oracle flags it as difficult to exploit (AC:H). Disclosed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle Commerce Platform 11.4.0 lets a remote, unauthenticated attacker reaching the Dynamo Application Framework's LDAP integration read critical application data, potentially all data accessible to the platform. Oracle rates this CVSS 3.1 7.5 with confidentiality-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score in the provided data, so this is a serious-but-not-yet-weaponized disclosure flaw disclosed in the July 2026 Oracle Critical Patch Update.
Cross-context data compromise in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework/ATG) lets a low-privileged, authenticated network attacker who lures a victim into interacting with crafted HTTP content read all platform-accessible data and make limited unauthorized modifications, with impact crossing into additional products via a scope change. The CVSS:3.1 score is 7.6 (C:H/I:L, scope-changed), and the UI:R plus scope-change profile is characteristic of a stored/reflected web-injection class flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with HTTP network access to fully compromise the product, yielding high confidentiality, integrity, and availability impact per the CVSS:3.1 9.8 (Critical) rating. Oracle describes the flaw as easily exploitable, though it publishes no technical root-cause detail beyond the CPU advisory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated network reach and complete system takeover makes this a top-tier patch priority.
Remote unauthenticated compromise of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) lets a network attacker reach sensitive data and knock the service offline over HTTP. With no authentication or user interaction required and a CVSS 3.1 base of 9.1, a successful attack yields access to all Commerce Platform-accessible data plus a complete, repeatable denial of service. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full system takeover of Oracle Commerce Platform 11.4.0 is possible when a remote, unauthenticated attacker reaches the ATG Portals component over HTTP. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as easily exploitable and yields complete compromise of the platform. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthorized data disclosure in Oracle Configure to Order (Supply to Order Workbench component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read all data accessible to the application and, because of a scope change, to impact additional Oracle products beyond Configure to Order. Oracle rates it CVSS 3.1 7.7 with confidentiality-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it was reported through Oracle's own security alert channel for the July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll (Oracle E-Business Suite 12.2.9 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, delete, or modify all HRMS (UK)-accessible data over HTTP. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impacts and no availability impact, Oracle describes it as easily exploitable and tags it as an authentication-bypass class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Data tampering and partial denial of service in Oracle HRMS (UK) - the UK Payroll component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 - lets a low-privileged, authenticated attacker with HTTP network access create, modify or delete critical HRMS data and partially degrade the service. Oracle rates it CVSS 3.1 7.1 and describes it as 'easily exploitable' (AC:L), meaning any account holder on the EBS instance can abuse it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical rather than observed.
Unauthorized data disclosure in Oracle Application Object Library (a core component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a remote, unauthenticated attacker to compromise confidentiality over HTTP, resulting in unauthorized access to critical data or complete access to all data accessible to Oracle Application Object Library. Fixed in Oracle's July 2026 Critical Patch Update, the flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 7.5 driven entirely by confidentiality impact (C:H, I:N, A:N). There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Full compromise of Oracle Order Management (part of Oracle E-Business Suite) is possible via the Product Diagnostic Tools component in supported releases 12.2.3 through 12.2.15, where an authenticated high-privileged user with HTTP network access can achieve a complete takeover of the module with confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix is delivered in the Oracle Critical Patch Update of July 2026.
Remote data compromise in Oracle Application Object Library (the shared framework layer of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows an unauthenticated network attacker to read, create, delete, or modify all data accessible to the component over HTTP. The high attack complexity (AC:H) makes reliable exploitation non-trivial, but success yields full confidentiality and integrity impact against a core ERP platform. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor tags associate it with an authentication bypass pattern.
Full compromise of Oracle GoldenGate 23.4 through 23.26.2 is possible via the Config Service Executable, where an unauthenticated remote attacker sending crafted HTTP traffic can achieve complete takeover with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 8.1 but explicitly flags it as difficult to exploit (AC:H), and there is no public exploit identified at time of analysis and no CISA KEV listing. Despite Oracle's own tag of 'Information Disclosure,' the described outcome is a broader system takeover, not merely data leakage.
Data compromise in Oracle Banking Trade Finance 14.6.0 through 14.8.0 (Infrastructure component) allows a low-privileged, network-authenticated attacker to read, create, modify, or delete all data accessible to the application over HTTP. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact), this is an easily exploitable flaw requiring no user interaction, disclosed in the Oracle July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Banking Trade Finance versions 14.6.0 through 14.8.0 (Infrastructure component) allows a low-privileged, network-based attacker to read, create, modify, or delete all data accessible to the application over HTTP. Oracle rates this 8.1 (CVSS 3.1) with high confidentiality and integrity impact but no availability impact, and no user interaction required. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; the vendor's own 'Authentication Bypass' tag suggests weak access-control enforcement despite a nominal low-privilege requirement.
Cross-site-scripting-style compromise in Oracle MES for Process Manufacturing (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a remote unauthenticated attacker steal or fully read Oracle MES-accessible data and make limited unauthorized changes by luring a legitimate user into interacting with a crafted HTTP request. The scope-changing nature (S:C) means a successful attack can significantly impact products beyond MES itself, typically the victim's authenticated session context. No public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle rates it CVSS 8.2.
Complete takeover of Oracle WebCenter Enterprise Capture is possible by remote unauthenticated attackers reaching the Client Bundle component over HTTP, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the trivial exploitability and network-facing nature make it a high-priority patch.
Cross-context web attack against Oracle Banking Trade Finance Process Management (OBTFPM) 14.6.0 through 14.8.0 lets an unauthenticated network attacker who lures an authenticated user into interacting with crafted content act in the victim's session, reading, creating, deleting or modifying all OBTFPM-accessible data and causing a partial denial of service. Oracle rates it CVSS 3.1 9.6 with a scope change (S:C), meaning impact can spill into other connected products beyond OBTFPM itself. No public exploit is identified at time of analysis and it is not in CISA KEV; the Critical rating is driven by the scope change plus full confidentiality/integrity impact rather than by observed exploitation.
Unauthorized data access in Oracle Communications Unified Inventory Management (versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1) allows a low-privileged attacker with HTTP network access to compromise the Security component, gaining read access to all UIM-accessible data plus limited update, insert, or delete capability. Rated CVSS 3.1 7.1 (C:H/I:L) and flagged by Oracle as easily exploitable, though no public exploit has been identified and it is not listed in CISA KEV. The vendor 'Authentication Bypass' tag suggests the flaw undermines authorization controls despite requiring only low privileges to begin.
Full takeover of Oracle WebCenter Enterprise Capture is possible via HTTP against the Client Bundle component in supported versions 12.2.1.4.0 and 14.1.2.0.0, addressed in Oracle's July 2026 Critical Patch Update. An unauthenticated remote attacker who can reach the service over the network can compromise confidentiality, integrity, and availability, though the CVSS vector rates the attack as high-complexity (AC:H), meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, so risk is currently theoretical but high-impact.
Unauthorized data manipulation in Oracle Advanced Benefits 12.2.15 (Oracle E-Business Suite, Internal Operations component) lets a low-privileged attacker with HTTP network access create, delete, or modify critical data. Because the CVSS vector carries a scope change (S:C), successful attacks can significantly impact additional products beyond Advanced Benefits itself. The flaw is rated CVSS 3.1 7.7 with integrity-only impact (I:H, C:N, A:N); no public exploit is identified at time of analysis, and it was disclosed via Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle EDI Gateway (a module of Oracle E-Business Suite) is possible where a high-privileged, authenticated attacker with HTTP network access can achieve complete takeover of the component, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 7.2 with high confidentiality, integrity, and availability impact, affecting EBS versions 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Full compromise of Oracle Product Hub (Internal Operations component) in Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated, low-privileged attacker with HTTP network access to take over the product and, because of a scope change, significantly impact additional connected products. The flaw was disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 score of 8.5, though the vector rates it as difficult to exploit (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-based takeover of Oracle Product Hub (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to fully compromise the product via HTTP. Affected releases span EBS 12.2.3 through 12.2.15, and the CVSS 3.1 vector (8.8) reflects high confidentiality, integrity, and availability impact with low attack complexity. No public exploit identified at time of analysis; disclosed through Oracle's July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Product Hub (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the Product Hub application. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle tags it as an Authentication Bypass. There is no public exploit identified at time of analysis and no CISA KEV listing, but it is addressed in Oracle's July 2026 Critical Patch Update.
Unauthorized data disclosure in the Oracle In-Memory Cost Management for Discrete Industries component (Internal Operations) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows an unauthenticated, network-based attacker over HTTP to read critical or all data accessible to the product. The flaw is rated CVSS 3.1 7.5 with a pure confidentiality impact (C:H/I:N/A:N) and was disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, though the 'Authentication Bypass' tag and low attack complexity make it an attractive target for internet-exposed EBS instances.
Data compromise in Oracle Process Manufacturing Financials (Internal Operations component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged, network-adjacent attacker to read, create, modify, or delete all data accessible to the module over HTTP. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impact but no availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle EBS is a recurring target for post-authentication attacks.
Information disclosure and limited data tampering in Oracle E-Business Suite's Process Manufacturing Logistics module (Internal Operations component) lets a low-privileged, network-based attacker reach critical application data over HTTP. Affecting supported EBS releases 12.2.3 through 12.2.15, a successful attack yields full read access to all Process Manufacturing Logistics data plus partial write (insert/update/delete) capability. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS was not provided.
Broad data compromise in Oracle Customers Online (part of Oracle E-Business Suite, component: Internal Operations) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High), it carries full confidentiality and integrity impact with no availability impact, and Oracle tags it as an authentication-bypass-class weakness. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and modest privilege requirement make it a high-priority fix.
Takeover of Oracle Process Manufacturing (OPM) Product Development is possible in Oracle E-Business Suite 12.2.15 via its Quality Management Specs component, where a low-privileged attacker with HTTP network access can fully compromise the module. Oracle rates this 8.8 (High) with full confidentiality, integrity, and availability impact, and flags it as easily exploitable, meaning a valid but low-privilege application account is the only barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Process Manufacturing Systems (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with network HTTP access read, create, modify, or delete all data accessible to the Process Manufacturing module. Oracle rates it 8.1 (High) with confidentiality and integrity impact but no availability impact, and describes it as 'easily exploitable.' No public exploit identified at time of analysis; the fix ships in the Oracle Critical Patch Update of July 2026.
Full compromise of the Oracle Process Manufacturing Systems module in Oracle E-Business Suite 12.2.11 through 12.2.15 is achievable by a high-privileged, authenticated attacker sending crafted HTTP requests to the Internal Operations component. Successful exploitation yields complete takeover of the Process Manufacturing Systems application with high confidentiality, integrity, and availability impact (CVSS 7.2). No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access and partial denial of service in Oracle E-Business Suite's Document Management and Collaboration module (Attachments component) allows a remote unauthenticated attacker to read, insert, update, or delete a subset of application data over HTTP. Affecting supported EBS releases 12.2.3 through 12.2.15, the flaw is rated CVSS 7.3 and is described by Oracle as easily exploitable, requiring no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, unauthenticated network vector makes it a meaningful patching priority in a product family that has been a repeated target of mass-exploitation campaigns.
Full takeover of Oracle PeopleSoft Enterprise FIN Manufacturing Brazil 9.1 is possible when an unauthenticated remote attacker reaches the vulnerable Integration component over HTTPS. Oracle rates this 9.8 (CVSS 3.1) with high confidentiality, integrity, and availability impact and describes it as easily exploitable, meaning no authentication, privileges, or user interaction are required. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low-complexity unauthenticated profile makes it a priority patch in the Oracle July 2026 Critical Patch Update.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise FIN Manufacturing Argentina 9.1 (Manufacturing component) lets a remote attacker read, create, modify, or delete all data accessible to the module over HTTP with no credentials. Oracle rates it CVSS 3.1 9.1 (Confidentiality and Integrity High, Availability None); it was disclosed in the Oracle Critical Patch Update of July 2026 and carries an 'Authentication Bypass' tag. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Staffing component) lets a low-privileged, authenticated attacker send crafted HTTP requests to fully compromise the module and, due to a scope change, impact adjacent PeopleSoft products and data. Rated CVSS 9.9 with full confidentiality, integrity, and availability loss, this is disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eSettlements component) lets an unauthenticated attacker on the adjacent network segment read confidential PeopleSoft data and make limited unauthorized modifications. The flaw carries a scope change, so a successful attack can significantly impact products beyond the vulnerable module. No public exploit identified at time of analysis, and no EPSS or KEV signal is provided; the 8.2 CVSS score is driven by high confidentiality impact plus scope change rather than remote internet exploitability.
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement component) allows a remote, unauthenticated attacker to reach the module over HTTP and achieve high-impact modification of critical data, limited data disclosure, and a partial denial of service. Because Oracle assigns a scope change (S:C), a successful attack can reach beyond the vulnerable module and significantly impact additional PeopleSoft products, which drives the 9.9 CVSS score. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (eProcurement component) allows a remote, unauthenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. The CVSS 3.1 base score is 9.1 (C:H/I:H, no availability impact) and the flaw is described by Oracle as easily exploitable, with an "Authentication Bypass" tag reinforcing the PR:N vector. No public exploit is identified at time of analysis and it is not listed in CISA KEV; a fix ships in the Oracle Critical Patch Update of July 2026.
Unauthenticated remote compromise of Oracle PeopleSoft Enterprise FIN Common Objects Argentina 9.1 (Integration component) allows a network attacker to reach critical data and, because of a scope change, to impact additional PeopleSoft products beyond the vulnerable module. The flaw is rated CVSS 3.1 9.9 and is trivially exploitable over HTTP with no authentication or user interaction, yielding full read of accessible data plus partial write and partial denial-of-service. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the near-maximal score and unauthenticated network vector make it a high-priority patching candidate.
Unauthenticated information disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Staffing component) lets a remote attacker send crafted HTTP requests to read critical data, potentially achieving complete access to all data accessible to the affected module. Oracle rates it easily exploitable with a CVSS 3.1 base score of 7.5, but the impact is confined to confidentiality (no integrity or availability effect). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle PeopleSoft Enterprise HCM Global Payroll Switzerland 9.2 is possible via network-facing HTTP by an attacker who already holds high application privileges, per Oracle's July 2026 Critical Patch Update. Because the flaw carries a scope change, successful attacks can reach beyond the Global Payroll Switzerland component into additional PeopleSoft products, yielding full confidentiality, integrity, and availability loss. No public exploit identified at time of analysis, but the low attack complexity (CVSS 9.1) makes it a priority patch for organizations running this payroll module.
Data compromise in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (eProcurement component) lets a remote unauthenticated attacker read, create, modify, or delete all data accessible to the module over HTTP. The flaw is rated CVSS 3.1 7.4 with high confidentiality and integrity impact but no availability impact, and is difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor advisory ties the fix to the Oracle July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle PeopleSoft Enterprise FIN Common Objects Brazil 9.1 (Common Objects component) allows a remote unauthenticated attacker to reach and read critical financial data over HTTP. Oracle rates it easily exploitable with a CVSS 3.1 base of 7.5 and confidentiality-only impact (C:H/I:N/A:N), and it is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Takeover of Oracle Communications Converged Application Server 8.3 is possible via a flaw in its RTP Proxy component, exploitable only by a high-privileged attacker with local logon to the host where the server runs. The CVSS 3.1 vector (AV:L/AC:H/PR:H/S:C) reflects difficult exploitation requiring existing elevated access, but a scope change means a successful attack can impact additional products beyond the server itself, with full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Full compromise (takeover) of Oracle Communications Converged Application Server 8.3 is possible via its Security component, where a high-privileged attacker with TLS network access can achieve confidentiality, integrity, and availability loss that also crosses a trust boundary to affect additional products (scope change). CVSS 3.1 scores this 8.0 despite high attack complexity and a high-privilege prerequisite. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS value was supplied.
Full takeover of Oracle Communications Converged Application Server 8.2 and 8.3 is possible for a remote, unauthenticated attacker over TCP/IP, per Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 9.0 with a scope change (S:C), a successful attack can compromise confidentiality, integrity, and availability of the server and significantly impact additional connected products, though high attack complexity (AC:H) makes exploitation non-trivial. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broad data compromise in Oracle E-Business Suite Secure Enterprise Search (Search Integration Engine) affects EBS versions 12.2.3 through 12.2.15, where a network attacker with only low-level authenticated access over HTTP can read, create, modify, or delete all data accessible to the Secure Enterprise Search component. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N) rates it 8.1 High, reflecting low attack complexity and full confidentiality and integrity impact without availability loss. No public exploit identified at time of analysis, though the vendor's 'Authentication Bypass' tagging suggests weak access-control enforcement in the affected component.
Full takeover of the Oracle Database RDBMS component is possible for a low-privileged attacker who holds the Execute DBMS_CLOUD privilege and can reach the server over Oracle Net, affecting Database 19.3-19.31 and 23.4.0-23.26.2. Because the CVSS vector carries a scope change (S:C), a successful attack can pivot beyond the database to significantly impact additional products, yielding full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; the 9.9 base score is driven by low attack complexity and the scope change rather than by unauthenticated access.
Unauthorized data compromise in Oracle PeopleSoft Enterprise SCM Manufacturing 9.2 (Security component) lets a remote, unauthenticated attacker read, create, modify, or delete all data accessible to the application over HTTPS. Rated CVSS 3.1 7.4 with high confidentiality and integrity impact but no availability impact, and flagged by Oracle with an Authentication Bypass characteristic. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; exploitation is rated high-complexity by Oracle.
Unauthorized data compromise in Oracle PeopleSoft Enterprise SCM eProcurement 9.2 (Manage Requisition Status component) lets a remote, unauthenticated attacker read all module-accessible data and perform limited updates over HTTP, with a scope change that can significantly impact additional connected products. Rated CVSS 3.1 9.3 (Critical) and tagged as an authentication bypass, the flaw is easily exploitable without user interaction. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data modification in Oracle PeopleSoft Enterprise SCM Purchasing 9.2 (Purchasing component) allows a remote, unauthenticated attacker with HTTP network access to create, delete, or modify critical Purchasing data and read a subset of accessible data. Oracle rates it CVSS 3.1 8.2 and describes it as easily exploitable with no privileges or user interaction, and its own tagging characterizes the flaw as an authentication bypass. No public exploit code has been identified and it is not listed in CISA KEV at time of analysis, so risk is currently driven by exposure rather than confirmed active exploitation.
Remote unauthenticated compromise of Oracle PeopleSoft Enterprise FIN Expenses 9.2 (Expenses component) allows attackers with only HTTP network access to read, create, delete or modify all Expenses-accessible data and to cause a partial denial of service. Rated CVSS 3.1 9.4 and flagged by Oracle as easily exploitable, meaning no authentication or user interaction is required. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the low-complexity unauthenticated profile makes it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Local privilege-boundary compromise in Oracle Solaris 11.3 and 11.4 (Utility component) allows a low-privileged attacker with a local logon to gain unauthorized read and write access to critical Solaris data, with a scope change that can significantly impact additional products beyond Solaris itself. The flaw carries a CVSS 3.1 base score of 7.5 despite requiring high attack complexity, reflecting the high confidentiality and integrity impact combined with scope change. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated remote compromise of Oracle Identity Manager (OIM Legacy UI component) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 allows attackers with only network/HTTP access to read, create, delete, or modify any data the identity platform can reach. Tagged by the reporter as an authentication bypass, this flaw carries a CVSS 9.1 rating driven by high confidentiality and integrity impact, and because OIM governs enterprise identity and account provisioning, a successful attack effectively hands over control of user identity data. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Complete takeover of Oracle Identity Manager is possible through its OIM Legacy UI component, allowing a remote unauthenticated attacker with only HTTP network access to fully compromise the confidentiality, integrity, and availability of the identity governance platform. Affected releases are the Fusion Middleware bundles 12.2.1.4.0 and 14.1.2.1.0. Oracle rates this CVSS 9.8 and addressed it in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Unauthenticated remote compromise of Oracle Agile Engineering Data Management 6.2.1 (Install component) lets attackers with only HTTP network access modify or destroy critical PLM data, read a subset of accessible data, and trigger a complete denial of service. Oracle rates it CVSS 9.4 and describes it as easily exploitable, but it is not in CISA KEV and no public exploit has been identified. The combination of no authentication requirement with high integrity and availability impact makes it a serious exposure for any network-reachable deployment.
Unauthorized data disclosure in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Installation component) allows an unauthenticated attacker on the adjacent network segment to compromise confidentiality and, due to a scope change, impact additional connected products. The flaw is rated CVSS 3.1 7.4 with confidentiality-only impact and no integrity or availability effect. There is no public exploit identified at time of analysis, and it was disclosed by Oracle in the July 2026 Critical Patch Update.
Unauthenticated remote compromise of Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) lets network attackers read, create, modify, or delete all data accessible to the application over HTTP. Oracle rates it 'easily exploitable' with a CVSS 3.1 base score of 9.1 driven by full confidentiality and integrity impact, and community tagging labels it an authentication bypass. No public exploit identified at time of analysis, and it is not listed in CISA KEV; no EPSS score was provided.
Complete takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible when a remote, unauthenticated attacker reaches the Reporting component over HTTP, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (C:H/I:H/A:H) reflects that a successful attack yields full confidentiality, integrity, and availability compromise of the product. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication, low-complexity profile makes it a high patch priority.
Sensitive data compromise in Oracle Agile Product Lifecycle Management for Process 6.2.4 (Product Quality Management component) lets a low-privileged, network-authenticated attacker read all application-accessible data and make limited unauthorized modifications, with a scope change that can significantly impact additional products. Oracle rates it easily exploitable but it requires tricking a separate user into interaction (UI:R), yielding a CVSS 3.1 base score of 7.6. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Agile Product Lifecycle Management for Process 6.2.4 is possible by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw resides in the product's Installation component and yields full compromise of confidentiality, integrity, and availability (CVSS 3.1 9.8). No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthorized critical-data access and partial denial of service in Oracle Product Lifecycle Analytics 3.6.1 (Supply Chain suite, Installation Issues component) allows a remote, unauthenticated attacker over HTTP to fully read all data the application can access and partially disrupt service. The flaw carries a scope change, so successful attacks may significantly impact adjacent Oracle products beyond the analytics component itself. Rated CVSS 3.1 9.3 (Critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege-to-scope-change compromise in Oracle Product Lifecycle Analytics 3.6.1 (Oracle Supply Chain, Installation Issues component) lets an attacker with logon access to the host where the software runs take over the application without application-level credentials. Successful exploitation yields full read and write access to all data accessible to Oracle Product Lifecycle Analytics and, because of a CVSS scope change, may significantly impact other products on the same infrastructure. No public exploit identified at time of analysis; the flaw was reported by Oracle and fixed in the July 2026 Critical Patch Update.
Unauthorized data access and manipulation in Oracle Agile PLM 9.3.6 (Security component) allows a remote unauthenticated attacker with HTTP access to read, create, delete, or modify all Agile PLM-accessible data. The high attack complexity (AC:H) means exploitation requires specific conditions the attacker cannot fully control, which lowers real-world exploitability despite the network-facing, no-authentication vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the 'Authentication Bypass' tag and full confidentiality/integrity impact make this a meaningful patch priority for exposed deployments.
Unauthorized data disclosure in Oracle Agile PLM 9.3.6 (Security component) lets a remote, unauthenticated attacker reach critical business data over HTTP without any user interaction. The Oracle CPU (July 2026) and EUVD tagging characterize this as an authentication-bypass-class weakness yielding full read access to all Agile PLM-accessible data. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Agile PLM 9.3.6 (Security component) allows a remote attacker with only HTTP network access to read, create, delete, or modify all data accessible to the application. The flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 9.1; no public exploit identified at time of analysis, and it is not listed in CISA KEV. It was reported by Oracle's own security team and addressed in the Oracle July 2026 Critical Patch Update.
Full product takeover of Oracle Agile PLM 9.3.6 (Product Lifecycle Management) is possible by an unauthenticated remote attacker over HTTP against the Security component, per Oracle Critical Patch Update July 2026. The CVSS 3.1 base score is 8.1 with high attack complexity, meaning exploitation is difficult and likely requires specific conditions or timing to succeed, but a successful attack yields complete compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was supplied.
Full compromise of Oracle Agile PLM 9.3.6 (Security component) allows an unauthenticated remote attacker to take over the application over HTTP with no user interaction. Rated CVSS 9.8 with high impact to confidentiality, integrity, and availability, this flaw is disclosed via Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch for internet- or intranet-exposed instances.
Full application takeover in Oracle Agile PLM 9.3.6 (Product Lifecycle Management) is possible via the User and User Group component, where a low-privileged authenticated user with HTTP network access can escalate to complete compromise of confidentiality, integrity, and availability. Rated CVSS 3.1 8.8 (High) and disclosed in Oracle's Critical Patch Update of July 2026, exploitation requires only valid low-level credentials and low attack complexity, making it attractive for insider or credential-theft abuse. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker reach the Content Acquisition System over HTTPS and read, create, modify, or delete all data accessible to the product. The 'Authentication Bypass' tagging combined with PR:N in the CVSS vector indicates the flaw defeats access controls without credentials, though the high attack complexity (AC:H) means exploitation is non-trivial. No public exploit identified at time of analysis and the issue is not in CISA KEV; it was disclosed by Oracle in the July 2026 Critical Patch Update.
Full product takeover in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Forge component) lets an unauthenticated remote attacker compromise confidentiality, integrity and availability over HTTP, per Oracle's CVSS 3.1 8.1 rating. Exploitation is rated high-complexity (AC:H), so it requires specific conditions or timing rather than a trivial single request. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Endeca Application Controller) allows a low-privileged local attacker with logon access to read, create, modify, or delete all data accessible to the product. The flaw carries a CVSS 3.1 base score of 7.1 (C:H/I:H, no availability impact) and is described by Oracle as 'easily exploitable.' No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; it was disclosed in the Oracle Critical Patch Update of July 2026.
Complete takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible via the Endeca Application Controller, which an unauthenticated attacker can reach over HTTP to fully compromise the product. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact, and is described by Oracle as easily exploitable. No public exploit identified at time of analysis and it is not listed in CISA KEV, but its network-facing, no-authentication profile makes it a high-priority patch item.
Sensitive data disclosure and denial of service in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) let a low-privileged, network-based attacker read all data accessible to the application and hang or repeatedly crash the service over HTTP. Rated CVSS 3.1 8.1 (High) with confidentiality and availability impact but no integrity impact. Disclosed in the Oracle July 2026 Critical Patch Update; no public exploit identified at time of analysis and not listed in CISA KEV.
Unauthorized data disclosure in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 lets a remote, unauthenticated attacker read all data accessible to the Experience Manager component over HTTP. Oracle rates it CVSS 7.5 with high confidentiality impact and no integrity or availability effect, and the reporter tags it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-facing, no-privilege profile makes it a straightforward information-disclosure risk.
Unauthorized data disclosure in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker abuse the exposed RMI interface of the Experience Manager component to read critical or all Guided Search accessible data. Scored CVSS 3.1 7.5 with confidentiality-only impact and rated 'easily exploitable' by Oracle, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Disclosed in Oracle's July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a remote unauthenticated attacker reach sensitive data over HTTP, with Oracle and the EUVD entry tagging the flaw as an authentication bypass. The CVSS 3.1 base score of 7.5 reflects a high-confidentiality, no-integrity, no-availability impact, and Oracle labels it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector makes it a credible target once patch details are reverse-engineered.
Unauthenticated data compromise in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) allows remote attackers over HTTPS to read, create, modify, or delete all data accessible to the service without any credentials. Oracle rates this CVSS 9.1 with high confidentiality and integrity impact and characterizes it as 'easily exploitable,' and the intelligence tags flag an authentication-bypass class issue. No public exploit code has been identified and it is not listed in CISA KEV at time of analysis.
Unauthenticated data compromise and denial of service in Oracle Commerce Guided Search Platform Services 11.4.0 (Forge component) lets a remote attacker send crafted HTTP requests to read all data accessible to the service and to crash or hang it completely. Rated CVSS 3.1 9.1 (Critical) with high confidentiality and availability impact and no integrity impact; disclosed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, but the combination of network reachability, no authentication, and low complexity makes it an urgent patch priority.
Authentication bypass in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a remote, unauthenticated attacker to read and modify all data accessible to the application over HTTP. The flaw carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact) and is easily exploitable per Oracle. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-privileges vector makes it a high-priority patch.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a low-privileged, network-based attacker over HTTP to gain complete read access to all accessible data plus limited update, insert, and delete capability. Rated CVSS 7.1 and tagged as an authentication bypass, it was disclosed by Oracle in the July 2026 Critical Patch Update and requires only low-level credentials with no user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all data accessible to the application. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact) and tagged as an authentication-bypass-class issue by the reporter. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix ships in Oracle's July 2026 Critical Patch Update.
Privilege escalation to full takeover in Oracle Commerce Guided Search / Experience Manager 11.4.0 lets a low-privileged attacker with HTTP network access compromise the Experience Manager component, yielding high confidentiality, integrity, and availability impact. Rated CVSS 3.1 8.8 and reported through Oracle's coordinated disclosure (July 2026 CPU), with no public exploit identified at time of analysis and no CISA KEV listing. Any authenticated user of the affected component can potentially seize control of the entire product instance.
Remote takeover in Oracle Commerce Guided Search / Oracle Commerce Experience Manager 11.4.0 (Content Acquisition System component) allows an unauthenticated attacker with HTTP network access to fully compromise the product. Oracle rates it CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning no authentication or user interaction is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-facing, unauthenticated 'takeover' profile makes it a top-tier patching priority.
Unauthorized disclosure of critical data in Oracle Payroll (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read all Payroll-accessible data. Because the flaw carries a scope change, successful attacks can significantly impact additional Oracle products beyond Payroll itself, raising the effective blast radius. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle rates it CVSS 3.1 7.7 with confidentiality-only impact.
Remote takeover in Oracle WebCenter Sites 14.1.2.0.0 allows an unauthenticated attacker with only HTTP network access to fully compromise the product, yielding complete confidentiality, integrity, and availability loss (CVSS 3.1 9.8). Disclosed in the Oracle Critical Patch Update of July 2026 and reported by Oracle's own security alert team, it is rated easily exploitable but has no public exploit identified at time of analysis. WebCenter Sites is Oracle's enterprise web experience/content management platform, so a compromise means attacker control over the delivery of managed web content.
Unauthorized data disclosure in Oracle Complex Maintenance, Repair and Overhaul (CMRO), a module of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a remote unauthenticated attacker abuse the Internal Operations component over HTTP to read critical CMRO data and make limited unauthorized modifications. Because the flaw carries a scope change, a successful attack can significantly impact products beyond CMRO itself. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity, so exploitation is rated difficult.
Full takeover of Oracle Commerce Platform 11.4.0 is possible by a remote unauthenticated attacker who reaches the Dynamo Application Framework component over HTTP, per Oracle's July 2026 Critical Patch Update. Successful exploitation compromises confidentiality, integrity, and availability of the platform (CVSS 3.1 8.1), though Oracle rates it difficult to exploit (AC:H). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthenticated data tampering and partial denial of service in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework) allows a remote attacker to reach the platform over HTTP and, without any credentials, perform unauthorized insert/update/delete on some accessible data, read a subset of accessible data, and partially disrupt availability. Oracle rates it easily exploitable with a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.
Data compromise in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) lets a remote, unauthenticated attacker read, create, modify, or delete all data accessible to the platform over HTTP. The flaw carries a CVSS 3.1 score of 7.4 with high confidentiality and integrity impact but no availability impact, and Oracle flags it as difficult to exploit (AC:H). Disclosed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data disclosure in Oracle Commerce Platform 11.4.0 lets a remote, unauthenticated attacker reaching the Dynamo Application Framework's LDAP integration read critical application data, potentially all data accessible to the platform. Oracle rates this CVSS 3.1 7.5 with confidentiality-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score in the provided data, so this is a serious-but-not-yet-weaponized disclosure flaw disclosed in the July 2026 Oracle Critical Patch Update.
Cross-context data compromise in Oracle Commerce Platform 11.4.0 (Dynamo Application Framework/ATG) lets a low-privileged, authenticated network attacker who lures a victim into interacting with crafted HTTP content read all platform-accessible data and make limited unauthorized modifications, with impact crossing into additional products via a scope change. The CVSS:3.1 score is 7.6 (C:H/I:L, scope-changed), and the UI:R plus scope-change profile is characteristic of a stored/reflected web-injection class flaw. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote takeover of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) allows an unauthenticated attacker with HTTP network access to fully compromise the product, yielding high confidentiality, integrity, and availability impact per the CVSS:3.1 9.8 (Critical) rating. Oracle describes the flaw as easily exploitable, though it publishes no technical root-cause detail beyond the CPU advisory. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated network reach and complete system takeover makes this a top-tier patch priority.
Remote unauthenticated compromise of Oracle Commerce Platform 11.4.0 (Dynamo Application Framework component) lets a network attacker reach sensitive data and knock the service offline over HTTP. With no authentication or user interaction required and a CVSS 3.1 base of 9.1, a successful attack yields access to all Commerce Platform-accessible data plus a complete, repeatable denial of service. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full system takeover of Oracle Commerce Platform 11.4.0 is possible when a remote, unauthenticated attacker reaches the ATG Portals component over HTTP. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as easily exploitable and yields complete compromise of the platform. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Unauthorized data disclosure in Oracle Configure to Order (Supply to Order Workbench component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read all data accessible to the application and, because of a scope change, to impact additional Oracle products beyond Configure to Order. Oracle rates it CVSS 3.1 7.7 with confidentiality-only impact and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though it was reported through Oracle's own security alert channel for the July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle HRMS (UK) UK Payroll (Oracle E-Business Suite 12.2.9 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, delete, or modify all HRMS (UK)-accessible data over HTTP. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impacts and no availability impact, Oracle describes it as easily exploitable and tags it as an authentication-bypass class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Data tampering and partial denial of service in Oracle HRMS (UK) - the UK Payroll component of Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 - lets a low-privileged, authenticated attacker with HTTP network access create, modify or delete critical HRMS data and partially degrade the service. Oracle rates it CVSS 3.1 7.1 and describes it as 'easily exploitable' (AC:L), meaning any account holder on the EBS instance can abuse it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical rather than observed.
Unauthorized data disclosure in Oracle Application Object Library (a core component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a remote, unauthenticated attacker to compromise confidentiality over HTTP, resulting in unauthorized access to critical data or complete access to all data accessible to Oracle Application Object Library. Fixed in Oracle's July 2026 Critical Patch Update, the flaw is tagged as an authentication bypass and carries a CVSS 3.1 base score of 7.5 driven entirely by confidentiality impact (C:H, I:N, A:N). There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Full compromise of Oracle Order Management (part of Oracle E-Business Suite) is possible via the Product Diagnostic Tools component in supported releases 12.2.3 through 12.2.15, where an authenticated high-privileged user with HTTP network access can achieve a complete takeover of the module with confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix is delivered in the Oracle Critical Patch Update of July 2026.
Remote data compromise in Oracle Application Object Library (the shared framework layer of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows an unauthenticated network attacker to read, create, delete, or modify all data accessible to the component over HTTP. The high attack complexity (AC:H) makes reliable exploitation non-trivial, but success yields full confidentiality and integrity impact against a core ERP platform. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the vendor tags associate it with an authentication bypass pattern.
Full compromise of Oracle GoldenGate 23.4 through 23.26.2 is possible via the Config Service Executable, where an unauthenticated remote attacker sending crafted HTTP traffic can achieve complete takeover with high confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 8.1 but explicitly flags it as difficult to exploit (AC:H), and there is no public exploit identified at time of analysis and no CISA KEV listing. Despite Oracle's own tag of 'Information Disclosure,' the described outcome is a broader system takeover, not merely data leakage.
Data compromise in Oracle Banking Trade Finance 14.6.0 through 14.8.0 (Infrastructure component) allows a low-privileged, network-authenticated attacker to read, create, modify, or delete all data accessible to the application over HTTP. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact), this is an easily exploitable flaw requiring no user interaction, disclosed in the Oracle July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Banking Trade Finance versions 14.6.0 through 14.8.0 (Infrastructure component) allows a low-privileged, network-based attacker to read, create, modify, or delete all data accessible to the application over HTTP. Oracle rates this 8.1 (CVSS 3.1) with high confidentiality and integrity impact but no availability impact, and no user interaction required. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; the vendor's own 'Authentication Bypass' tag suggests weak access-control enforcement despite a nominal low-privilege requirement.
Cross-site-scripting-style compromise in Oracle MES for Process Manufacturing (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a remote unauthenticated attacker steal or fully read Oracle MES-accessible data and make limited unauthorized changes by luring a legitimate user into interacting with a crafted HTTP request. The scope-changing nature (S:C) means a successful attack can significantly impact products beyond MES itself, typically the victim's authenticated session context. No public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle rates it CVSS 8.2.
Complete takeover of Oracle WebCenter Enterprise Capture is possible by remote unauthenticated attackers reaching the Client Bundle component over HTTP, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the trivial exploitability and network-facing nature make it a high-priority patch.
Cross-context web attack against Oracle Banking Trade Finance Process Management (OBTFPM) 14.6.0 through 14.8.0 lets an unauthenticated network attacker who lures an authenticated user into interacting with crafted content act in the victim's session, reading, creating, deleting or modifying all OBTFPM-accessible data and causing a partial denial of service. Oracle rates it CVSS 3.1 9.6 with a scope change (S:C), meaning impact can spill into other connected products beyond OBTFPM itself. No public exploit is identified at time of analysis and it is not in CISA KEV; the Critical rating is driven by the scope change plus full confidentiality/integrity impact rather than by observed exploitation.
Unauthorized data access in Oracle Communications Unified Inventory Management (versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1) allows a low-privileged attacker with HTTP network access to compromise the Security component, gaining read access to all UIM-accessible data plus limited update, insert, or delete capability. Rated CVSS 3.1 7.1 (C:H/I:L) and flagged by Oracle as easily exploitable, though no public exploit has been identified and it is not listed in CISA KEV. The vendor 'Authentication Bypass' tag suggests the flaw undermines authorization controls despite requiring only low privileges to begin.
Full takeover of Oracle WebCenter Enterprise Capture is possible via HTTP against the Client Bundle component in supported versions 12.2.1.4.0 and 14.1.2.0.0, addressed in Oracle's July 2026 Critical Patch Update. An unauthenticated remote attacker who can reach the service over the network can compromise confidentiality, integrity, and availability, though the CVSS vector rates the attack as high-complexity (AC:H), meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, so risk is currently theoretical but high-impact.