Authentication Bypass
Monthly
Sensitive data exposure in Oracle iSupport (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-adjacent attacker to obtain unauthorized access to all iSupport-accessible data over HTTP. Because the flaw carries a scope change, successful exploitation may also significantly impact other products beyond iSupport itself, though only confidentiality is affected (no integrity or availability impact). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tags it as an authentication-bypass class issue.
Data compromise in Oracle iSupport (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a remote unauthenticated attacker to reach the application over HTTP and gain read and write access to all iSupport-accessible data. The flaw carries a CVSS 3.1 base score of 7.4 with high confidentiality and integrity impact but no availability impact, and Oracle rates it difficult to exploit (AC:H). No public exploit has been identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was supplied.
Broken access control in the Shopping Cart component of Oracle iStore (part of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, modify, or delete all data accessible to the iStore application over HTTP. Tagged as an authentication-bypass class issue, it carries a CVSS 3.1 base score of 8.1 driven by high confidentiality and integrity impact with no availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle iStore (the Oracle E-Business Suite customer-facing web storefront) is possible via its Shopping Cart component in releases 12.2.3 through 12.2.15, where a high-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability. Oracle rates this CVSS 3.1 7.2 and shipped a fix in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Supply Chain Trading Connector (Collaboration History component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows remote attackers to read all data accessible to the product over HTTP and make limited unauthorized modifications. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 8.2, the flaw is tagged as an authentication bypass and requires no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network exposure make it a strong patching priority for EBS operators.
Account/component takeover in Oracle Bills of Material (component: Internal Operations) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged, authenticated attacker with network HTTP access fully compromise the module when a legitimate user is lured into interacting with attacker-supplied content. Per the CVSS vector (PR:L/UI:R), exploitation requires an existing low-level account plus victim interaction, but a successful attack yields high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.0). No public exploit identified at time of analysis; disclosed via Oracle's July 2026 Critical Patch Update.
Takeover of Oracle Cost Management, the costing module of Oracle E-Business Suite (component: Costing Transaction Errors), is achievable by a low-privileged attacker with HTTP network access. Successful exploitation yields full confidentiality, integrity, and availability compromise of the module across EBS releases 12.2.3 through 12.2.15. Rated CVSS 3.1 7.5 but explicitly difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not on the CISA KEV list.
Sensitive data exposure in Oracle Compensation Workbench (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read all data accessible to the component and perform limited unauthorized inserts, updates, or deletes over HTTP. Rated CVSS 7.1 (C:H/I:L/A:N), it was disclosed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not on CISA KEV, though EBS is a high-value target and Oracle CPU flaws have historically drawn attacker interest.
Unauthorized data access in Oracle E-Business Suite's Compensation Workbench component (versions 12.2.3 through 12.2.15) allows a low-privileged, authenticated attacker with HTTP network access to read all data accessible to the module and to modify some of it. Oracle rates this CVSS 7.1 (C:H/I:L). No public exploit is identified at time of analysis and it is not listed in CISA KEV, though it was disclosed in Oracle's July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle TeleSales (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all TeleSales-accessible data. The flaw is rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and is tagged as an authentication-bypass-class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Sales Offline (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible for an already high-privileged attacker who reaches the Internal Operations component over HTTP, and because the flaw carries a scope change (S:C) a successful attack can significantly impact additional products beyond Sales Offline itself. The issue is rated CVSS 3.1 8.0 but Oracle characterizes it as difficult to exploit (AC:H) and requiring elevated privileges (PR:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle Sales Offline, a module of Oracle E-Business Suite (Internal Operations component) versions 12.2.3 through 12.2.15, lets a low-privileged authenticated attacker with HTTP network access fully compromise the product. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, describing it as 'easily exploitable' and resulting in complete takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV, but its inclusion in Oracle's July 2026 Critical Patch Update warrants prompt patching.
Broad data compromise in Oracle Sales Offline (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read, create, delete, or modify all data the application can access and cause a partial denial of service over HTTP. Oracle rates it CVSS 3.1 8.3 (C:H/I:H/A:L) and describes it as easily exploitable, disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a strong patching priority.
Full compromise of Oracle Receivables (the accounts-receivable module of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible via the Internal Operations component, where an authenticated attacker holding high privileges can send crafted HTTP requests to take over the module. Oracle rates this CVSS 7.2 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' but exploitation is gated behind existing high-privilege access. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Receivables (Oracle E-Business Suite, Internal Operations component) is possible in versions 12.2.3 through 12.2.15, where a high-privileged attacker with network HTTP access can take over the module, impacting confidentiality, integrity, and availability. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable, though it requires existing high privileges (PR:H). No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle iReceivables (a self-service receivables module of Oracle E-Business Suite, AR Web Utilities component) is possible by a remote unauthenticated attacker over HTTP, affecting EBS releases 12.2.3 through 12.2.15. Successful exploitation yields complete takeover with high confidentiality, integrity, and availability impact, though the CVSS vector rates exploitation as high-complexity. Addressed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Trading Community (Oracle E-Business Suite, Party Search UI component) allows a low-privileged attacker with network HTTP access to read and modify all data accessible to the Trading Community module. Fixed in the Oracle Critical Patch Update of July 2026 (CPUJUL2026), the flaw affects EBS releases 12.2.3 through 12.2.15 and carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; the vendor tag 'Authentication Bypass' suggests the Party Search UI may permit access beyond the attacker's intended authorization scope.
Account takeover in Oracle iReceivables (Oracle E-Business Suite, AR Web Utilities component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access fully compromise the module. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning a valid low-privilege EBS account is the only real barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and authenticated-but-low privilege requirement make it a strong patching priority.
Complete takeover of Oracle Workflow (a component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is possible by a remote unauthenticated attacker who reaches the product over SMTP, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 8.1 with high confidentiality, integrity, and availability impact, but carries high attack complexity, meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Payments (Oracle E-Business Suite, File Transmission component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the Payments module over HTTP. Oracle rates it CVSS 8.1 with high confidentiality and integrity impact but no availability impact, and it is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor 'Authentication Bypass' tag and low attack complexity make it an attractive target in EBS-exposed environments.
Unauthorized data access in Oracle Applications Framework (the OAF layer of Oracle E-Business Suite) lets a low-privileged, network-based attacker abuse the Search Bean [Incl. Advanced] component to read all OAF-accessible data and perform limited unauthorized updates, inserts, or deletes. Affected releases span EBS 12.2.3 through 12.2.15, and the flaw is rated CVSS 3.1 7.1 with high confidentiality and low integrity impact. No public exploit has been identified at time of analysis, and it is addressed in Oracle's July 2026 Critical Patch Update.
Privilege escalation and cross-product compromise in Oracle Application Object Library (the core AOL/FND framework of Oracle E-Business Suite versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read and modify all AOL-accessible data and, because of a scope change, significantly impact other Oracle EBS products beyond AOL itself. Rated CVSS 3.1 9.6 (Critical) with confidentiality and integrity impact but no availability effect, it is remotely exploitable over HTTPS with low attack complexity. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Data tampering in Oracle E-Business Suite's Financials Common Modules (Common Components) lets a low-privileged, network-authenticated attacker perform unauthorized creation, deletion, and modification of critical financial data across all module-accessible records, plus read access to a subset of that data. Affected releases span 12.2.3 through 12.2.15, remediated in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though the tag 'Authentication Bypass' warrants scrutiny given the authenticated CVSS profile.
Data compromise in Oracle Complex Maintenance, Repair and Overhaul (cMRO), a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows a low-privileged authenticated attacker with HTTP network access to read and modify critical application data. The flaw affects the Internal Operations component and yields high confidentiality and integrity impact (CVSS 8.1) with no availability effect. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a fix ships in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle Application Object Library (the core framework component of Oracle E-Business Suite) is possible in versions 12.2.3 through 12.2.15, where a low-privileged attacker with HTTP network access can escalate to complete takeover of the component. Oracle rates this CVSS 3.1 7.5 with full confidentiality, integrity, and availability impact, though the attack is flagged as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the shared-infrastructure nature of AOL makes successful exploitation high-consequence.
Data compromise in Oracle Applications Framework (12.2.3 through 12.2.15), a core component of Oracle E-Business Suite, allows a low-privileged authenticated attacker with HTTP network access to read, create, modify, or delete all data accessible to the framework via the Graph/Charting component. The Oracle-assigned CVSS 3.1 base score is 8.1 (C:H/I:H) with no availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor-supplied 'Authentication Bypass' tag suggests low authentication barriers relative to the damage achievable.
Data compromise in Oracle Financials Common Modules (Common Components) within Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. Oracle rates it CVSS 3.1 8.1 (high confidentiality and integrity impact, no availability impact) and tags it as an authentication-bypass-class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Applications Manager (a management console within Oracle E-Business Suite) is possible through the Command Line - RapidClone component in EBS versions 12.2.3 through 12.2.15. An attacker who already has logon access to the host infrastructure where the component runs can compromise it without any application-level authentication, gaining full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; it was disclosed by Oracle in the July 2026 Critical Patch Update.
Complete takeover of Oracle EDI Gateway (a component of Oracle E-Business Suite) is possible by an unauthenticated remote attacker over HTTP, affecting supported versions 12.2.3 through 12.2.15 per Oracle's July 2026 Critical Patch Update. Despite full confidentiality, integrity, and availability impact (CVSS 8.1), the CVSS vector rates attack complexity as high (AC:H), indicating exploitation is not trivial. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Full compromise of Oracle Assets (part of Oracle E-Business Suite, Internal Operations component) is achievable by a high-privileged, network-adjacent attacker over HTTP, per the Oracle July 2026 Critical Patch Update. With a CVSS 3.1 base score of 7.2 (C:H/I:H/A:H) and no user interaction required, successful exploitation results in complete takeover of Oracle Assets across supported releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-scope confidentiality compromise in Oracle Payroll (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read all Oracle Payroll-accessible data and, because of a scope change, impact additional connected products. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication-bypass class issue, it carries a CVSS 3.1 base score of 7.7 driven entirely by high confidentiality impact with a changed scope. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and single-privilege requirement make it a credible internal-abuse risk.
Data compromise in Oracle Assets (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all Oracle Assets-accessible data. The CVSS 3.1 base score is 8.1 with high confidentiality and integrity impact but no availability impact, reflecting a data-integrity and disclosure risk rather than a service outage. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Compromise of Oracle Cost Management (Internal Operations component) in Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the module, resulting in high confidentiality and integrity impact but no availability impact. The flaw is rated easily exploitable (CVSS 3.1 8.1, PR:L) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Cash Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, it was reported by Oracle and disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though low attack complexity and network reachability make it a notable patch priority for EBS operators.
Unauthorized data access in Oracle Field Service (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, remotely authenticated attacker to read all Field Service-accessible data and make limited unauthorized modifications over HTTP. Rated CVSS 3.1 7.1 (high) with high confidentiality and low integrity impact, the flaw is described by Oracle as easily exploitable and is tagged as an authentication bypass. There is no public exploit identified at time of analysis, it is not on CISA KEV, and no EPSS score was supplied.
Takeover of the Oracle Installed Base component in Oracle E-Business Suite (Create Item Instance function) is possible by a low-privileged, remote attacker over HTTP against versions 12.2.3 through 12.2.15. Oracle's July 2026 Critical Patch Update rates this at CVSS 8.8 with full confidentiality, integrity, and availability impact, meaning any authenticated EBS user account can fully compromise the Installed Base module. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle E-Business Intelligence (Definition component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the product. The CVSS 3.1 vector (8.1) reflects High confidentiality and integrity impact with no availability effect, meaning an authenticated user can escalate their reach to critical business intelligence data without needing elevated roles. No public exploit identified at time of analysis, and the flaw is addressed in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Sales Offline (a module of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis; not listed in CISA KEV.
Full takeover of the Oracle Trading Community module in Oracle E-Business Suite (versions 12.2.3 through 12.2.12) is achievable by a high-privileged, authenticated attacker sending crafted HTTP requests to the Party Search UI component. Because the CVSS vector reports high impact to confidentiality, integrity, and availability (C:H/I:H/A:H), a successful attack yields complete compromise of the Trading Community application rather than mere data leakage. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Unauthorized data compromise in Oracle iReceivables (Oracle E-Business Suite, AR Web Utilities component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all iReceivables-accessible data. Oracle rates it CVSS 3.1 8.1 (High) with High confidentiality and integrity impact but no availability impact, and the vendor/community has tagged it as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector make it a strong patching priority for exposed EBS deployments.
Data compromise in Oracle MySQL Router 8.4.0-8.4.10 and 9.7.0-9.7.1 allows a network attacker to gain unauthorized read and write access to all data reachable through the Router component. The flaw is reachable unauthenticated over HTTP (PR:N) but is rated hard to exploit (AC:H), and there is no public exploit identified at time of analysis. Oracle's tagging references an authentication-bypass class of issue, consistent with the unauthenticated network vector.
Privilege-escalation and data-compromise flaw in Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 (Market Place component) lets a low-privileged user who can log on to the host running ODI read, create, delete, or modify all ODI-accessible data. Because the flaw carries a scope change, successful attacks can significantly impact other products beyond ODI itself, driving the CVSS 3.1 base score to 8.4. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' for an authenticated local user.
Privilege escalation and full data compromise in Oracle BI Publisher (versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0) allows a low-privileged, network-authenticated attacker to abuse the Web Service API and read, create, delete, or modify all BI Publisher-accessible data, with a scope change that lets attacks significantly impact additional products. Rated CVSS 3.1 9.9 (Critical), it is easily exploitable over HTTP with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Price Protection (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with network HTTP access to read, create, delete, or modify all Price Protection-accessible data. The flaw carries a CVSS 3.1 base score of 8.1 (C:H/I:H) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) allows a low-privileged, network-based attacker to compromise the product via HTTP through the Siebel Cloud Manager component. Because the flaw carries a scope change, successful exploitation can pivot beyond Siebel to significantly impact additional connected products, driving the rare CVSS 9.9 rating. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a high-priority patch item.
Data compromise in Oracle EDI Gateway (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read, create, delete, or modify all EDI Gateway-accessible data, including critical data. Rated CVSS 8.1, the flaw is disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication-bypass-class issue; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Process Manufacturing Financials (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the application over HTTP. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle flags it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in the Oracle Process Manufacturing (OPM) Inventory module of Oracle E-Business Suite 12.2.3-12.2.15 lets a low-privileged, authenticated network attacker read and modify all OPM Inventory-accessible data over HTTP. Rated CVSS 3.1 8.1 (High) for combined Confidentiality and Integrity impact with no availability effect, it was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis, and it is not on CISA KEV.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets an unauthenticated remote attacker over HTTP read all Siebel-accessible data, tamper with some records, and cause a partial denial of service. Oracle rates it CVSS 7.0 but flags it as difficult to exploit (AC:H), and no public exploit identified at time of analysis. Disclosed via the Oracle July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets a remote unauthenticated attacker reach sensitive data over HTTP. The flaw is tagged as an authentication bypass and, per Oracle's own scoring, is 'easily exploitable' with a high confidentiality impact but no integrity or availability effect (CVSS 3.1 base 7.5). No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided in the source data.
Data compromise in Oracle Interaction Blending (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with local logon access to the hosting infrastructure to read, create, delete, or modify all data accessible to the product. The flaw carries a CVSS 3.1 base score of 7.1 with high confidentiality and integrity impact but no availability impact, and no public exploit has been identified at time of analysis. It was disclosed by Oracle in the July 2026 Critical Patch Update.
Data compromise in Oracle Universal Work Queue (Oracle E-Business Suite component UWQ Server Issues), versions 12.2.3 through 12.2.15, lets a remote unauthenticated attacker read and modify all UWQ-accessible data (C:H/I:H) by luring an authenticated user into interacting with attacker-supplied content over HTTP. The CVSS 3.1 base score is 8.1, driven by high confidentiality and integrity impact with no availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.
Takeover of Oracle Enterprise Asset Management (the eAM module of Oracle E-Business Suite, Internal Operations component) is possible by a low-privileged, authenticated network attacker sending crafted HTTP requests. Oracle rates this CVSS 3.1 8.8 with full confidentiality, integrity, and availability impact against supported versions 12.2.3 through 12.2.15, and describes exploitation as easy. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.
Data compromise in Oracle Content Manager (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, modify, or delete all Content Manager-accessible data. The CVSS 3.1 base score is 8.1 (C:H/I:H, no availability impact), reflecting high confidentiality and integrity damage without service disruption. No public exploit identified at time of analysis and it is not listed in CISA KEV; the Oracle-supplied 'Authentication Bypass' tag conflicts with the PR:L vector and should be treated cautiously.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) allows a low-privileged attacker with network HTTP access to read all data accessible to the application. Oracle rates it CVSS 3.1 7.7 with a scope change, and the ENISA EUVD flags an authentication-bypass characteristic, meaning a minimally-authenticated actor can escalate to broad confidentiality compromise that spills into additional connected products. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) lets a remote, unauthenticated attacker reach and read critical application data over HTTP. Oracle rates this CVSS 3.1 7.5 with confidentiality-only impact, and the intelligence tags flag it as an authentication-bypass class issue, so attackers can obtain complete access to all data accessible to the affected applications without credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Data compromise in Oracle U.S. Federal Financials (a module of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets an authenticated low-privileged attacker reach the Internal Operations component over HTTP and read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impact but no availability impact; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Disclosed via Oracle's July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Process Manufacturing (OPM) Regulatory Management, a component of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read critical application data. The flaw carries a scope change (S:C), so successful attacks can significantly impact additional products beyond OPM Regulatory Management itself. It is confidentiality-only (CVSS 3.1 7.7) and tagged as an authentication bypass; no public exploit identified at time of analysis.
Full compromise of Oracle Process Manufacturing (OPM) Regulatory Management, a component of Oracle E-Business Suite, is possible by a low-privileged remote attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting EBS versions 12.2.3 through 12.2.15, the flaw is rated CVSS 8.8 and yields complete takeover of the OPM Regulatory Management module (high confidentiality, integrity, and availability impact). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a high-priority patching target.
Data compromise and cross-product impact in Oracle E-Business Suite (Oracle Common Application Components, versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify critical application data and cause a partial denial of service. Because the flaw carries a scope change (S:C), a successful attack can significantly affect additional Oracle products beyond the vulnerable component. Oracle rates it CVSS 3.1 8.4 but flags it as difficult to exploit (AC:H); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle Applications Framework (Search Bean component) affects Oracle E-Business Suite versions 12.2.3 through 12.2.15, allowing a low-privileged, authenticated attacker with HTTP network access to fully compromise the Applications Framework. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as easily exploitable and results in complete takeover of the component. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, though its inclusion in Oracle's July 2026 Critical Patch Update signals vendor-confirmed severity.
Account or application takeover of Oracle Applications Framework - the presentation-layer component of Oracle E-Business Suite - is possible when a low-privileged, authenticated attacker reaches the vulnerable Search Bean over HTTP. Affected releases span 12.2.3 through 12.2.15, and a successful attack yields full confidentiality, integrity, and availability compromise of the framework (CVSS 3.1 8.8). This was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0) lets a remote attacker reach the BI Platform Security component over HTTP and read all BI-accessible data plus perform limited unauthorized writes. Oracle rates it CVSS 3.1 8.2 and the reporter tags it an authentication bypass, meaning no credentials are needed against affected default deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and no-privilege requirement make it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Denial-of-service and limited data tampering in Oracle Business Intelligence Enterprise Edition (BI Platform Security component, versions 8.2.0.0.0 and 26.01.0.0.0) lets an unauthenticated remote attacker over HTTP hang or repeatedly crash the server (complete DOS) and perform limited unauthorized read, insert, update, or delete of accessible data. Oracle rates it CVSS 3.1 8.6 and describes it as easily exploitable with no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of the Oracle Applications Technology Stack is possible in Oracle E-Business Suite 12.2.3 through 12.2.15 via the Client System Analyzer component, which is reachable over HTTP by unauthenticated network attackers. Exploitation is rated difficult (high attack complexity) but a successful attack yields complete confidentiality, integrity, and availability compromise. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 (French Public Sector Specific component) lets a remote, unauthenticated attacker read all HR-accessible data and modify a subset of it over HTTP. Oracle's July 2026 CPU rates it easily exploitable with high confidentiality and low integrity impact (CVSS 3.1 base 8.2), and third-party intel tags it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Integrity and availability compromise in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 (Core component) allows a network-based, unauthenticated attacker to create, delete or modify critical data and to trigger a complete, repeatable denial of service. The flaw is rated CVSS 7.4 and is fixed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis, and confidentiality is not impacted. Despite requiring no authentication, the CVSS vector flags high attack complexity (AC:H), which meaningfully raises the bar for reliable exploitation.
Cross-privilege data compromise in Oracle PeopleSoft Enterprise HCM Global Payroll for Switzerland 9.2 lets a low-privileged, network-based attacker read, alter, or delete critical payroll data and, because of a scope change, impact other integrated PeopleSoft products beyond the vulnerable module. The flaw is rated CVSS 3.1 8.2 (high) with confidentiality and integrity impact but no availability impact, and it is difficult to exploit (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV; the fix is delivered through the Oracle July 2026 Critical Patch Update.
Local privilege-abuse in the Filesystems component of Oracle Solaris 11.4 allows a low-privileged user with logon access to the host to corrupt or destroy critical operating-system data and to trigger a complete, repeatable denial of service (hang or crash) of the OS. Disclosed in Oracle's July 2026 Critical Patch Update and rated CVSS 3.1 7.1 with high Integrity and Availability impact but no confidentiality loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-context data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-reachable attacker read and alter critical data after tricking a legitimate user into interacting with malicious content. Because the flaw crosses a security scope boundary (S:C), successful attacks can significantly impact products beyond WebCenter Content itself. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.7; no public exploit identified at time of analysis.
Full compromise of Oracle WebCenter Content is possible in versions 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component of Oracle Fusion Middleware), where a low-privileged, network-adjacent attacker sending crafted HTTP requests can escalate to complete takeover of the product with high confidentiality, integrity, and availability impact. Oracle rates this 8.8 (CVSS 3.1) and describes it as 'easily exploitable,' meaning any authenticated user with minimal privileges can seize the system. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'takeover' outcome make it a priority patch.
Privilege-based full compromise of Oracle WebCenter Content (Web Content Management component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-authenticated attacker take over the entire product over HTTP. Oracle rates it CVSS 3.1 8.8 with High confidentiality, integrity, and availability impact, and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and 'takeover' outcome make it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Unauthorized data compromise in Oracle WebCenter Content (Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to read, create, modify, or delete all content-server-accessible data. Oracle rates this 8.1 (High) with confidentiality and integrity fully impacted but no availability effect, and the intelligence tags flag an authentication-bypass angle. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the July 2026 Oracle Critical Patch Update.
Account and system takeover in Oracle WebCenter Content (Fusion Middleware Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-based attacker to fully compromise the product when a legitimate user is tricked into interacting with attacker-supplied content. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 8.0 and full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' framing make it a high-priority patch item.
Full takeover of Oracle WebCenter Content (Web Content Management component) is possible when a remote, unauthenticated attacker lures a victim into interacting with malicious content over HTTP. Affecting supported versions 12.2.1.4.0 and 14.1.2.0.0, successful exploitation yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Oracle's own Critical Patch Update process (July 2026).
Unauthenticated data compromise in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware Web Content Management component) lets a remote attacker read, create, delete, or modify all data accessible to the product over HTTP with no credentials or user interaction. Oracle rates it CVSS 9.1 (C:H/I:H) and vendor tags describe it as an authentication bypass, making it a high-priority patch from the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sensitive data disclosure in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component) lets a low-privileged, network-based attacker read or fully access all data the application can reach and cause a partial denial of service over HTTP. Oracle rates it CVSS 3.1 7.1 and describes it as easily exploitable, though it requires an existing low-level account (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content (Fusion Middleware, Web Content Management component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged attacker with HTTP network access can escalate to complete takeover of the product with confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable, though it requires existing high privileges. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a fix ships in the Oracle Critical Patch Update of July 2026.
Full takeover of Oracle WebCenter Content (Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0) is achievable by an unauthenticated remote attacker over HTTP, requiring no user interaction. The scope-changing flaw (CVSS 3.1 base 10.0) lets attackers compromise the Web Content Management component and pivot to impact adjacent Oracle products. No public exploit identified at time of analysis, but the maximum severity and trivial exploitability make this a top-priority patch from the July 2026 Oracle Critical Patch Update.
Unauthorized data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to gain access to critical data and cause limited data tampering and partial denial of service, provided a legitimate user is tricked into interacting with the attack. The flaw carries a CVSS 3.1 score of 7.6 and was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access and partial denial of service in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker compromise the platform after tricking a legitimate user into interacting with attacker-controlled content. Per Oracle's July 2026 Critical Patch Update, successful exploitation yields high confidentiality impact (complete read access to WebCenter Content data) plus limited integrity and availability damage. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, though Oracle rates it easily exploitable.
Scope-changing information disclosure and data tampering in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets an unauthenticated network attacker who lures a victim into a single interaction read or alter all data the product can access. Rated CVSS 3.1 9.3 (C:H/I:H, scope change), the flaw is dangerous because compromise can spill into other integrated Oracle Fusion Middleware products, though availability is unaffected. No public exploit identified at time of analysis and it is not on CISA KEV, so exploitation is currently theoretical but the criticality warrants prompt patching.
Cross-scope compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker read and tamper with all Content Server data and pivot into other connected products. Exploitation is network-based over HTTP and requires luring a victim to trigger the attack (UI:R), with a resulting CVSS 3.1 score of 9.3 driven by a scope change and High confidentiality/integrity impact. No public exploit identified at time of analysis; this entry is disclosed via Oracle's July 2026 Critical Patch Update and is not listed in CISA KEV.
Unauthorized critical-data access in Oracle JDeveloper (Fusion Middleware, Data Visualization Tools component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote unauthenticated attacker read all JDeveloper-accessible data and modify some of it over HTTP, with a scope change that can significantly impact adjacent Oracle products. Oracle rates it CVSS 3.1 7.5 but flags it as difficult to exploit (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently theoretical but non-trivial given the unauthenticated network vector.
Full takeover of Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 is possible when a low-privileged attacker with HTTP network access exploits a flaw in the Installation Security component. Because the CVSS scope is changed (S:C), a successful attack does not stay contained to EnterpriseOne Tools but can significantly impact additional connected products, yielding full confidentiality, integrity, and availability loss (CVSS 9.9). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle MySQL Connector/J (MySQL Connectors 9.7.0 through 9.7.1) allows a low-privileged attacker with network access over multiple protocols to read, create, delete, or modify all data accessible to the connector and to cause a partial denial of service. Oracle rates this CVSS 3.1 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L), reflecting high difficulty of exploitation but broad confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Unauthorized information disclosure in Oracle JDeveloper (Fusion Middleware Security Framework) versions 12.2.1.4.0 and 14.1.2.0.0 lets a network attacker read critical data without credentials. Remote unauthenticated attackers reaching the product over HTTP can obtain complete access to all JDeveloper-accessible data, with a CVSS 3.1 base score of 7.5 driven entirely by confidentiality impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tag 'Authentication Bypass' suggests the flaw stems from a missing or broken authentication check.
Full system takeover in Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 is possible when an unauthenticated remote attacker reaches the Web Runtime Security component over HTTP, per Oracle's July 2026 Critical Patch Update. Despite requiring no credentials, the attack is rated hard to execute (CVSS 3.1 8.1, AC:H), and success yields complete confidentiality, integrity, and availability compromise of the Tools layer. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Full compromise of Oracle JD Edwards EnterpriseOne Procurement and Subcontract Management (version 9.2) is achievable by a low-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 score of 8.8 and Oracle explicitly characterizes it as 'easily exploitable,' with successful attacks resulting in complete takeover of the Procurement component (confidentiality, integrity, and availability all high). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the authenticated-yet-low-barrier profile makes it a strong patch priority for JD Edwards operators.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Security component) lets remote attackers reach the application over HTTP and read all data the module can access, with limited unauthorized insert/update/delete on some data. Vendor and community tags flag this as an authentication bypass, aligning with the PR:N (no privileges) CVSS vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' with a CVSS 3.1 base score of 8.2.
Sensitive data exposure in Oracle iSupport (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-adjacent attacker to obtain unauthorized access to all iSupport-accessible data over HTTP. Because the flaw carries a scope change, successful exploitation may also significantly impact other products beyond iSupport itself, though only confidentiality is affected (no integrity or availability impact). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tags it as an authentication-bypass class issue.
Data compromise in Oracle iSupport (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a remote unauthenticated attacker to reach the application over HTTP and gain read and write access to all iSupport-accessible data. The flaw carries a CVSS 3.1 base score of 7.4 with high confidentiality and integrity impact but no availability impact, and Oracle rates it difficult to exploit (AC:H). No public exploit has been identified at time of analysis, it is not listed in CISA KEV, and no EPSS score was supplied.
Broken access control in the Shopping Cart component of Oracle iStore (part of Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read, create, modify, or delete all data accessible to the iStore application over HTTP. Tagged as an authentication-bypass class issue, it carries a CVSS 3.1 base score of 8.1 driven by high confidentiality and integrity impact with no availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Full takeover of Oracle iStore (the Oracle E-Business Suite customer-facing web storefront) is possible via its Shopping Cart component in releases 12.2.3 through 12.2.15, where a high-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability. Oracle rates this CVSS 3.1 7.2 and shipped a fix in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Supply Chain Trading Connector (Collaboration History component) of Oracle E-Business Suite 12.2.3 through 12.2.15 allows remote attackers to read all data accessible to the product over HTTP and make limited unauthorized modifications. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 8.2, the flaw is tagged as an authentication bypass and requires no privileges or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network exposure make it a strong patching priority for EBS operators.
Account/component takeover in Oracle Bills of Material (component: Internal Operations) within Oracle E-Business Suite 12.2.3 through 12.2.15 lets a low-privileged, authenticated attacker with network HTTP access fully compromise the module when a legitimate user is lured into interacting with attacker-supplied content. Per the CVSS vector (PR:L/UI:R), exploitation requires an existing low-level account plus victim interaction, but a successful attack yields high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.0). No public exploit identified at time of analysis; disclosed via Oracle's July 2026 Critical Patch Update.
Takeover of Oracle Cost Management, the costing module of Oracle E-Business Suite (component: Costing Transaction Errors), is achievable by a low-privileged attacker with HTTP network access. Successful exploitation yields full confidentiality, integrity, and availability compromise of the module across EBS releases 12.2.3 through 12.2.15. Rated CVSS 3.1 7.5 but explicitly difficult to exploit (AC:H); no public exploit identified at time of analysis and it is not on the CISA KEV list.
Sensitive data exposure in Oracle Compensation Workbench (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read all data accessible to the component and perform limited unauthorized inserts, updates, or deletes over HTTP. Rated CVSS 7.1 (C:H/I:L/A:N), it was disclosed in the Oracle July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not on CISA KEV, though EBS is a high-value target and Oracle CPU flaws have historically drawn attacker interest.
Unauthorized data access in Oracle E-Business Suite's Compensation Workbench component (versions 12.2.3 through 12.2.15) allows a low-privileged, authenticated attacker with HTTP network access to read all data accessible to the module and to modify some of it. Oracle rates this CVSS 7.1 (C:H/I:L). No public exploit is identified at time of analysis and it is not listed in CISA KEV, though it was disclosed in Oracle's July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle TeleSales (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all TeleSales-accessible data. The flaw is rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and is tagged as an authentication-bypass-class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Sales Offline (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible for an already high-privileged attacker who reaches the Internal Operations component over HTTP, and because the flaw carries a scope change (S:C) a successful attack can significantly impact additional products beyond Sales Offline itself. The issue is rated CVSS 3.1 8.0 but Oracle characterizes it as difficult to exploit (AC:H) and requiring elevated privileges (PR:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle Sales Offline, a module of Oracle E-Business Suite (Internal Operations component) versions 12.2.3 through 12.2.15, lets a low-privileged authenticated attacker with HTTP network access fully compromise the product. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, describing it as 'easily exploitable' and resulting in complete takeover. No public exploit identified at time of analysis and it is not listed in CISA KEV, but its inclusion in Oracle's July 2026 Critical Patch Update warrants prompt patching.
Broad data compromise in Oracle Sales Offline (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged, network-authenticated attacker read, create, delete, or modify all data the application can access and cause a partial denial of service over HTTP. Oracle rates it CVSS 3.1 8.3 (C:H/I:H/A:L) and describes it as easily exploitable, disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a strong patching priority.
Full compromise of Oracle Receivables (the accounts-receivable module of Oracle E-Business Suite 12.2.3 through 12.2.15) is possible via the Internal Operations component, where an authenticated attacker holding high privileges can send crafted HTTP requests to take over the module. Oracle rates this CVSS 7.2 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' but exploitation is gated behind existing high-privilege access. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle Receivables (Oracle E-Business Suite, Internal Operations component) is possible in versions 12.2.3 through 12.2.15, where a high-privileged attacker with network HTTP access can take over the module, impacting confidentiality, integrity, and availability. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable, though it requires existing high privileges (PR:H). No public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle iReceivables (a self-service receivables module of Oracle E-Business Suite, AR Web Utilities component) is possible by a remote unauthenticated attacker over HTTP, affecting EBS releases 12.2.3 through 12.2.15. Successful exploitation yields complete takeover with high confidentiality, integrity, and availability impact, though the CVSS vector rates exploitation as high-complexity. Addressed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Trading Community (Oracle E-Business Suite, Party Search UI component) allows a low-privileged attacker with network HTTP access to read and modify all data accessible to the Trading Community module. Fixed in the Oracle Critical Patch Update of July 2026 (CPUJUL2026), the flaw affects EBS releases 12.2.3 through 12.2.15 and carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; the vendor tag 'Authentication Bypass' suggests the Party Search UI may permit access beyond the attacker's intended authorization scope.
Account takeover in Oracle iReceivables (Oracle E-Business Suite, AR Web Utilities component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access fully compromise the module. Oracle rates it CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning a valid low-privilege EBS account is the only real barrier. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and authenticated-but-low privilege requirement make it a strong patching priority.
Complete takeover of Oracle Workflow (a component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) is possible by a remote unauthenticated attacker who reaches the product over SMTP, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 8.1 with high confidentiality, integrity, and availability impact, but carries high attack complexity, meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Payments (Oracle E-Business Suite, File Transmission component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the Payments module over HTTP. Oracle rates it CVSS 8.1 with high confidentiality and integrity impact but no availability impact, and it is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor 'Authentication Bypass' tag and low attack complexity make it an attractive target in EBS-exposed environments.
Unauthorized data access in Oracle Applications Framework (the OAF layer of Oracle E-Business Suite) lets a low-privileged, network-based attacker abuse the Search Bean [Incl. Advanced] component to read all OAF-accessible data and perform limited unauthorized updates, inserts, or deletes. Affected releases span EBS 12.2.3 through 12.2.15, and the flaw is rated CVSS 3.1 7.1 with high confidentiality and low integrity impact. No public exploit has been identified at time of analysis, and it is addressed in Oracle's July 2026 Critical Patch Update.
Privilege escalation and cross-product compromise in Oracle Application Object Library (the core AOL/FND framework of Oracle E-Business Suite versions 12.2.3 through 12.2.15) lets a low-privileged, network-authenticated attacker read and modify all AOL-accessible data and, because of a scope change, significantly impact other Oracle EBS products beyond AOL itself. Rated CVSS 3.1 9.6 (Critical) with confidentiality and integrity impact but no availability effect, it is remotely exploitable over HTTPS with low attack complexity. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Data tampering in Oracle E-Business Suite's Financials Common Modules (Common Components) lets a low-privileged, network-authenticated attacker perform unauthorized creation, deletion, and modification of critical financial data across all module-accessible records, plus read access to a subset of that data. Affected releases span 12.2.3 through 12.2.15, remediated in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though the tag 'Authentication Bypass' warrants scrutiny given the authenticated CVSS profile.
Data compromise in Oracle Complex Maintenance, Repair and Overhaul (cMRO), a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows a low-privileged authenticated attacker with HTTP network access to read and modify critical application data. The flaw affects the Internal Operations component and yields high confidentiality and integrity impact (CVSS 8.1) with no availability effect. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a fix ships in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle Application Object Library (the core framework component of Oracle E-Business Suite) is possible in versions 12.2.3 through 12.2.15, where a low-privileged attacker with HTTP network access can escalate to complete takeover of the component. Oracle rates this CVSS 3.1 7.5 with full confidentiality, integrity, and availability impact, though the attack is flagged as difficult to exploit (AC:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the shared-infrastructure nature of AOL makes successful exploitation high-consequence.
Data compromise in Oracle Applications Framework (12.2.3 through 12.2.15), a core component of Oracle E-Business Suite, allows a low-privileged authenticated attacker with HTTP network access to read, create, modify, or delete all data accessible to the framework via the Graph/Charting component. The Oracle-assigned CVSS 3.1 base score is 8.1 (C:H/I:H) with no availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor-supplied 'Authentication Bypass' tag suggests low authentication barriers relative to the damage achievable.
Data compromise in Oracle Financials Common Modules (Common Components) within Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. Oracle rates it CVSS 3.1 8.1 (high confidentiality and integrity impact, no availability impact) and tags it as an authentication-bypass-class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Applications Manager (a management console within Oracle E-Business Suite) is possible through the Command Line - RapidClone component in EBS versions 12.2.3 through 12.2.15. An attacker who already has logon access to the host infrastructure where the component runs can compromise it without any application-level authentication, gaining full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; it was disclosed by Oracle in the July 2026 Critical Patch Update.
Complete takeover of Oracle EDI Gateway (a component of Oracle E-Business Suite) is possible by an unauthenticated remote attacker over HTTP, affecting supported versions 12.2.3 through 12.2.15 per Oracle's July 2026 Critical Patch Update. Despite full confidentiality, integrity, and availability impact (CVSS 8.1), the CVSS vector rates attack complexity as high (AC:H), indicating exploitation is not trivial. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Full compromise of Oracle Assets (part of Oracle E-Business Suite, Internal Operations component) is achievable by a high-privileged, network-adjacent attacker over HTTP, per the Oracle July 2026 Critical Patch Update. With a CVSS 3.1 base score of 7.2 (C:H/I:H/A:H) and no user interaction required, successful exploitation results in complete takeover of Oracle Assets across supported releases 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-scope confidentiality compromise in Oracle Payroll (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to read all Oracle Payroll-accessible data and, because of a scope change, impact additional connected products. Disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication-bypass class issue, it carries a CVSS 3.1 base score of 7.7 driven entirely by high confidentiality impact with a changed scope. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and single-privilege requirement make it a credible internal-abuse risk.
Data compromise in Oracle Assets (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all Oracle Assets-accessible data. The CVSS 3.1 base score is 8.1 with high confidentiality and integrity impact but no availability impact, reflecting a data-integrity and disclosure risk rather than a service outage. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Compromise of Oracle Cost Management (Internal Operations component) in Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the module, resulting in high confidentiality and integrity impact but no availability impact. The flaw is rated easily exploitable (CVSS 3.1 8.1, PR:L) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Cash Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, it was reported by Oracle and disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though low attack complexity and network reachability make it a notable patch priority for EBS operators.
Unauthorized data access in Oracle Field Service (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, remotely authenticated attacker to read all Field Service-accessible data and make limited unauthorized modifications over HTTP. Rated CVSS 3.1 7.1 (high) with high confidentiality and low integrity impact, the flaw is described by Oracle as easily exploitable and is tagged as an authentication bypass. There is no public exploit identified at time of analysis, it is not on CISA KEV, and no EPSS score was supplied.
Takeover of the Oracle Installed Base component in Oracle E-Business Suite (Create Item Instance function) is possible by a low-privileged, remote attacker over HTTP against versions 12.2.3 through 12.2.15. Oracle's July 2026 Critical Patch Update rates this at CVSS 8.8 with full confidentiality, integrity, and availability impact, meaning any authenticated EBS user account can fully compromise the Installed Base module. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle E-Business Intelligence (Definition component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the product. The CVSS 3.1 vector (8.1) reflects High confidentiality and integrity impact with no availability effect, meaning an authenticated user can escalate their reach to critical business intelligence data without needing elevated roles. No public exploit identified at time of analysis, and the flaw is addressed in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Sales Offline (a module of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis; not listed in CISA KEV.
Full takeover of the Oracle Trading Community module in Oracle E-Business Suite (versions 12.2.3 through 12.2.12) is achievable by a high-privileged, authenticated attacker sending crafted HTTP requests to the Party Search UI component. Because the CVSS vector reports high impact to confidentiality, integrity, and availability (C:H/I:H/A:H), a successful attack yields complete compromise of the Trading Community application rather than mere data leakage. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Unauthorized data compromise in Oracle iReceivables (Oracle E-Business Suite, AR Web Utilities component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all iReceivables-accessible data. Oracle rates it CVSS 3.1 8.1 (High) with High confidentiality and integrity impact but no availability impact, and the vendor/community has tagged it as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector make it a strong patching priority for exposed EBS deployments.
Data compromise in Oracle MySQL Router 8.4.0-8.4.10 and 9.7.0-9.7.1 allows a network attacker to gain unauthorized read and write access to all data reachable through the Router component. The flaw is reachable unauthenticated over HTTP (PR:N) but is rated hard to exploit (AC:H), and there is no public exploit identified at time of analysis. Oracle's tagging references an authentication-bypass class of issue, consistent with the unauthenticated network vector.
Privilege-escalation and data-compromise flaw in Oracle Data Integrator 12.2.1.4.0 and 14.1.2.0.0 (Market Place component) lets a low-privileged user who can log on to the host running ODI read, create, delete, or modify all ODI-accessible data. Because the flaw carries a scope change, successful attacks can significantly impact other products beyond ODI itself, driving the CVSS 3.1 base score to 8.4. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' for an authenticated local user.
Privilege escalation and full data compromise in Oracle BI Publisher (versions 8.2.0.0.0, 12.2.1.4.0, and 26.01.0.0.0) allows a low-privileged, network-authenticated attacker to abuse the Web Service API and read, create, delete, or modify all BI Publisher-accessible data, with a scope change that lets attacks significantly impact additional products. Rated CVSS 3.1 9.9 (Critical), it is easily exploitable over HTTP with no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Price Protection (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with network HTTP access to read, create, delete, or modify all Price Protection-accessible data. The flaw carries a CVSS 3.1 base score of 8.1 (C:H/I:H) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3 through 26.5) allows a low-privileged, network-based attacker to compromise the product via HTTP through the Siebel Cloud Manager component. Because the flaw carries a scope change, successful exploitation can pivot beyond Siebel to significantly impact additional connected products, driving the rare CVSS 9.9 rating. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a high-priority patch item.
Data compromise in Oracle EDI Gateway (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read, create, delete, or modify all EDI Gateway-accessible data, including critical data. Rated CVSS 8.1, the flaw is disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication-bypass-class issue; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Process Manufacturing Financials (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the application over HTTP. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle flags it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in the Oracle Process Manufacturing (OPM) Inventory module of Oracle E-Business Suite 12.2.3-12.2.15 lets a low-privileged, authenticated network attacker read and modify all OPM Inventory-accessible data over HTTP. Rated CVSS 3.1 8.1 (High) for combined Confidentiality and Integrity impact with no availability effect, it was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis, and it is not on CISA KEV.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets an unauthenticated remote attacker over HTTP read all Siebel-accessible data, tamper with some records, and cause a partial denial of service. Oracle rates it CVSS 7.0 but flags it as difficult to exploit (AC:H), and no public exploit identified at time of analysis. Disclosed via the Oracle July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component), versions 22.3 through 26.5, lets a remote unauthenticated attacker reach sensitive data over HTTP. The flaw is tagged as an authentication bypass and, per Oracle's own scoring, is 'easily exploitable' with a high confidentiality impact but no integrity or availability effect (CVSS 3.1 base 7.5). No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided in the source data.
Data compromise in Oracle Interaction Blending (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with local logon access to the hosting infrastructure to read, create, delete, or modify all data accessible to the product. The flaw carries a CVSS 3.1 base score of 7.1 with high confidentiality and integrity impact but no availability impact, and no public exploit has been identified at time of analysis. It was disclosed by Oracle in the July 2026 Critical Patch Update.
Data compromise in Oracle Universal Work Queue (Oracle E-Business Suite component UWQ Server Issues), versions 12.2.3 through 12.2.15, lets a remote unauthenticated attacker read and modify all UWQ-accessible data (C:H/I:H) by luring an authenticated user into interacting with attacker-supplied content over HTTP. The CVSS 3.1 base score is 8.1, driven by high confidentiality and integrity impact with no availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.
Takeover of Oracle Enterprise Asset Management (the eAM module of Oracle E-Business Suite, Internal Operations component) is possible by a low-privileged, authenticated network attacker sending crafted HTTP requests. Oracle rates this CVSS 3.1 8.8 with full confidentiality, integrity, and availability impact against supported versions 12.2.3 through 12.2.15, and describes exploitation as easy. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the Oracle Critical Patch Update of July 2026.
Data compromise in Oracle Content Manager (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, modify, or delete all Content Manager-accessible data. The CVSS 3.1 base score is 8.1 (C:H/I:H, no availability impact), reflecting high confidentiality and integrity damage without service disruption. No public exploit identified at time of analysis and it is not listed in CISA KEV; the Oracle-supplied 'Authentication Bypass' tag conflicts with the PR:L vector and should be treated cautiously.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) allows a low-privileged attacker with network HTTP access to read all data accessible to the application. Oracle rates it CVSS 3.1 7.7 with a scope change, and the ENISA EUVD flags an authentication-bypass characteristic, meaning a minimally-authenticated actor can escalate to broad confidentiality compromise that spills into additional connected products. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle Siebel CRM Cloud Applications (Siebel Cloud Manager component, versions 22.3 through 26.5) lets a remote, unauthenticated attacker reach and read critical application data over HTTP. Oracle rates this CVSS 3.1 7.5 with confidentiality-only impact, and the intelligence tags flag it as an authentication-bypass class issue, so attackers can obtain complete access to all data accessible to the affected applications without credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Data compromise in Oracle U.S. Federal Financials (a module of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets an authenticated low-privileged attacker reach the Internal Operations component over HTTP and read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impact but no availability impact; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Disclosed via Oracle's July 2026 Critical Patch Update.
Unauthorized data disclosure in Oracle Process Manufacturing (OPM) Regulatory Management, a component of Oracle E-Business Suite 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read critical application data. The flaw carries a scope change (S:C), so successful attacks can significantly impact additional products beyond OPM Regulatory Management itself. It is confidentiality-only (CVSS 3.1 7.7) and tagged as an authentication bypass; no public exploit identified at time of analysis.
Full compromise of Oracle Process Manufacturing (OPM) Regulatory Management, a component of Oracle E-Business Suite, is possible by a low-privileged remote attacker over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting EBS versions 12.2.3 through 12.2.15, the flaw is rated CVSS 8.8 and yields complete takeover of the OPM Regulatory Management module (high confidentiality, integrity, and availability impact). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and low privilege bar make it a high-priority patching target.
Data compromise and cross-product impact in Oracle E-Business Suite (Oracle Common Application Components, versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker to read, create, delete, or modify critical application data and cause a partial denial of service. Because the flaw carries a scope change (S:C), a successful attack can significantly affect additional Oracle products beyond the vulnerable component. Oracle rates it CVSS 3.1 8.4 but flags it as difficult to exploit (AC:H); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Account takeover in Oracle Applications Framework (Search Bean component) affects Oracle E-Business Suite versions 12.2.3 through 12.2.15, allowing a low-privileged, authenticated attacker with HTTP network access to fully compromise the Applications Framework. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, the flaw is described by Oracle as easily exploitable and results in complete takeover of the component. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, though its inclusion in Oracle's July 2026 Critical Patch Update signals vendor-confirmed severity.
Account or application takeover of Oracle Applications Framework - the presentation-layer component of Oracle E-Business Suite - is possible when a low-privileged, authenticated attacker reaches the vulnerable Search Bean over HTTP. Affected releases span 12.2.3 through 12.2.15, and a successful attack yields full confidentiality, integrity, and availability compromise of the framework (CVSS 3.1 8.8). This was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated data compromise in Oracle Business Intelligence Enterprise Edition (versions 8.2.0.0.0 and 26.01.0.0.0) lets a remote attacker reach the BI Platform Security component over HTTP and read all BI-accessible data plus perform limited unauthorized writes. Oracle rates it CVSS 3.1 8.2 and the reporter tags it an authentication bypass, meaning no credentials are needed against affected default deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and no-privilege requirement make it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Denial-of-service and limited data tampering in Oracle Business Intelligence Enterprise Edition (BI Platform Security component, versions 8.2.0.0.0 and 26.01.0.0.0) lets an unauthenticated remote attacker over HTTP hang or repeatedly crash the server (complete DOS) and perform limited unauthorized read, insert, update, or delete of accessible data. Oracle rates it CVSS 3.1 8.6 and describes it as easily exploitable with no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of the Oracle Applications Technology Stack is possible in Oracle E-Business Suite 12.2.3 through 12.2.15 via the Client System Analyzer component, which is reachable over HTTP by unauthenticated network attackers. Exploitation is rated difficult (high attack complexity) but a successful attack yields complete confidentiality, integrity, and availability compromise. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 (French Public Sector Specific component) lets a remote, unauthenticated attacker read all HR-accessible data and modify a subset of it over HTTP. Oracle's July 2026 CPU rates it easily exploitable with high confidentiality and low integrity impact (CVSS 3.1 base 8.2), and third-party intel tags it as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Integrity and availability compromise in Oracle PeopleSoft Enterprise HCM Human Resources 9.2 (Core component) allows a network-based, unauthenticated attacker to create, delete or modify critical data and to trigger a complete, repeatable denial of service. The flaw is rated CVSS 7.4 and is fixed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis, and confidentiality is not impacted. Despite requiring no authentication, the CVSS vector flags high attack complexity (AC:H), which meaningfully raises the bar for reliable exploitation.
Cross-privilege data compromise in Oracle PeopleSoft Enterprise HCM Global Payroll for Switzerland 9.2 lets a low-privileged, network-based attacker read, alter, or delete critical payroll data and, because of a scope change, impact other integrated PeopleSoft products beyond the vulnerable module. The flaw is rated CVSS 3.1 8.2 (high) with confidentiality and integrity impact but no availability impact, and it is difficult to exploit (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV; the fix is delivered through the Oracle July 2026 Critical Patch Update.
Local privilege-abuse in the Filesystems component of Oracle Solaris 11.4 allows a low-privileged user with logon access to the host to corrupt or destroy critical operating-system data and to trigger a complete, repeatable denial of service (hang or crash) of the OS. Disclosed in Oracle's July 2026 Critical Patch Update and rated CVSS 3.1 7.1 with high Integrity and Availability impact but no confidentiality loss. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-context data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-reachable attacker read and alter critical data after tricking a legitimate user into interacting with malicious content. Because the flaw crosses a security scope boundary (S:C), successful attacks can significantly impact products beyond WebCenter Content itself. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.7; no public exploit identified at time of analysis.
Full compromise of Oracle WebCenter Content is possible in versions 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component of Oracle Fusion Middleware), where a low-privileged, network-adjacent attacker sending crafted HTTP requests can escalate to complete takeover of the product with high confidentiality, integrity, and availability impact. Oracle rates this 8.8 (CVSS 3.1) and describes it as 'easily exploitable,' meaning any authenticated user with minimal privileges can seize the system. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and 'takeover' outcome make it a priority patch.
Privilege-based full compromise of Oracle WebCenter Content (Web Content Management component) in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged, network-authenticated attacker take over the entire product over HTTP. Oracle rates it CVSS 3.1 8.8 with High confidentiality, integrity, and availability impact, and describes it as 'easily exploitable.' There is no public exploit identified at time of analysis and it is not on CISA KEV, but the low attack complexity and 'takeover' outcome make it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Unauthorized data compromise in Oracle WebCenter Content (Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to read, create, modify, or delete all content-server-accessible data. Oracle rates this 8.1 (High) with confidentiality and integrity fully impacted but no availability effect, and the intelligence tags flag an authentication-bypass angle. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the July 2026 Oracle Critical Patch Update.
Account and system takeover in Oracle WebCenter Content (Fusion Middleware Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-based attacker to fully compromise the product when a legitimate user is tricked into interacting with attacker-supplied content. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 8.0 and full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and 'easily exploitable' framing make it a high-priority patch item.
Full takeover of Oracle WebCenter Content (Web Content Management component) is possible when a remote, unauthenticated attacker lures a victim into interacting with malicious content over HTTP. Affecting supported versions 12.2.1.4.0 and 14.1.2.0.0, successful exploitation yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was reported through Oracle's own Critical Patch Update process (July 2026).
Unauthenticated data compromise in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware Web Content Management component) lets a remote attacker read, create, delete, or modify all data accessible to the product over HTTP with no credentials or user interaction. Oracle rates it CVSS 9.1 (C:H/I:H) and vendor tags describe it as an authentication bypass, making it a high-priority patch from the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sensitive data disclosure in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 (Web Content Management component) lets a low-privileged, network-based attacker read or fully access all data the application can reach and cause a partial denial of service over HTTP. Oracle rates it CVSS 3.1 7.1 and describes it as easily exploitable, though it requires an existing low-level account (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content (Fusion Middleware, Web Content Management component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where a high-privileged attacker with HTTP network access can escalate to complete takeover of the product with confidentiality, integrity, and availability impact. Oracle rates this CVSS 3.1 7.2 and describes it as easily exploitable, though it requires existing high privileges. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a fix ships in the Oracle Critical Patch Update of July 2026.
Full takeover of Oracle WebCenter Content (Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0) is achievable by an unauthenticated remote attacker over HTTP, requiring no user interaction. The scope-changing flaw (CVSS 3.1 base 10.0) lets attackers compromise the Web Content Management component and pivot to impact adjacent Oracle products. No public exploit identified at time of analysis, but the maximum severity and trivial exploitability make this a top-priority patch from the July 2026 Oracle Critical Patch Update.
Unauthorized data compromise in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a remote unauthenticated attacker to gain access to critical data and cause limited data tampering and partial denial of service, provided a legitimate user is tricked into interacting with the attack. The flaw carries a CVSS 3.1 score of 7.6 and was disclosed in Oracle's July 2026 Critical Patch Update; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data access and partial denial of service in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker compromise the platform after tricking a legitimate user into interacting with attacker-controlled content. Per Oracle's July 2026 Critical Patch Update, successful exploitation yields high confidentiality impact (complete read access to WebCenter Content data) plus limited integrity and availability damage. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, though Oracle rates it easily exploitable.
Scope-changing information disclosure and data tampering in Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 lets an unauthenticated network attacker who lures a victim into a single interaction read or alter all data the product can access. Rated CVSS 3.1 9.3 (C:H/I:H, scope change), the flaw is dangerous because compromise can spill into other integrated Oracle Fusion Middleware products, though availability is unaffected. No public exploit identified at time of analysis and it is not on CISA KEV, so exploitation is currently theoretical but the criticality warrants prompt patching.
Cross-scope compromise of Oracle WebCenter Content (Content Server component) in Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0 lets a remote, unauthenticated attacker read and tamper with all Content Server data and pivot into other connected products. Exploitation is network-based over HTTP and requires luring a victim to trigger the attack (UI:R), with a resulting CVSS 3.1 score of 9.3 driven by a scope change and High confidentiality/integrity impact. No public exploit identified at time of analysis; this entry is disclosed via Oracle's July 2026 Critical Patch Update and is not listed in CISA KEV.
Unauthorized critical-data access in Oracle JDeveloper (Fusion Middleware, Data Visualization Tools component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a remote unauthenticated attacker read all JDeveloper-accessible data and modify some of it over HTTP, with a scope change that can significantly impact adjacent Oracle products. Oracle rates it CVSS 3.1 7.5 but flags it as difficult to exploit (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently theoretical but non-trivial given the unauthenticated network vector.
Full takeover of Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 is possible when a low-privileged attacker with HTTP network access exploits a flaw in the Installation Security component. Because the CVSS scope is changed (S:C), a successful attack does not stay contained to EnterpriseOne Tools but can significantly impact additional connected products, yielding full confidentiality, integrity, and availability loss (CVSS 9.9). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle MySQL Connector/J (MySQL Connectors 9.7.0 through 9.7.1) allows a low-privileged attacker with network access over multiple protocols to read, create, delete, or modify all data accessible to the connector and to cause a partial denial of service. Oracle rates this CVSS 3.1 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L), reflecting high difficulty of exploitation but broad confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix ships in Oracle's July 2026 Critical Patch Update.
Unauthorized information disclosure in Oracle JDeveloper (Fusion Middleware Security Framework) versions 12.2.1.4.0 and 14.1.2.0.0 lets a network attacker read critical data without credentials. Remote unauthenticated attackers reaching the product over HTTP can obtain complete access to all JDeveloper-accessible data, with a CVSS 3.1 base score of 7.5 driven entirely by confidentiality impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the vendor tag 'Authentication Bypass' suggests the flaw stems from a missing or broken authentication check.
Full system takeover in Oracle JD Edwards EnterpriseOne Tools 9.2.26.3 is possible when an unauthenticated remote attacker reaches the Web Runtime Security component over HTTP, per Oracle's July 2026 Critical Patch Update. Despite requiring no credentials, the attack is rated hard to execute (CVSS 3.1 8.1, AC:H), and success yields complete confidentiality, integrity, and availability compromise of the Tools layer. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Full compromise of Oracle JD Edwards EnterpriseOne Procurement and Subcontract Management (version 9.2) is achievable by a low-privileged attacker with HTTP network access, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 score of 8.8 and Oracle explicitly characterizes it as 'easily exploitable,' with successful attacks resulting in complete takeover of the Procurement component (confidentiality, integrity, and availability all high). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the authenticated-yet-low-barrier profile makes it a strong patch priority for JD Edwards operators.
Unauthenticated data compromise in Oracle PeopleSoft Enterprise CS Campus Community 9.2.38 (Security component) lets remote attackers reach the application over HTTP and read all data the module can access, with limited unauthorized insert/update/delete on some data. Vendor and community tags flag this as an authentication bypass, aligning with the PR:N (no privileges) CVSS vector. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle rates it 'easily exploitable' with a CVSS 3.1 base score of 8.2.