Information Disclosure
Monthly
Crafted packets injected onto the MLAG Dual Primary Detection segment can trick an Arista EOS switch into falsely concluding it is in a dual-primary condition and err-disabling its interfaces, abruptly cutting off traffic for everything downstream of that switch. Exploitation needs only layer-2 adjacency to the Dual Primary Detection segment with no authentication (CVSS 4.0 AV:A/PR:N/UI:N), but it is gated by a precondition: the MLAG primary switch must fail while the crafted packets are present, so this is a conditional denial-of-service rather than a mass-exploitable remote attack. Affected EOS branches include 4.33.x, 4.34.x, 4.35.x and 4.36.x; a vendor patch is available and no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated attackers positioned on the same Layer 2 broadcast segment as an Arista EOS device can force that device to tear down an established IS-IS adjacency by sending a crafted IS-IS Hello P
An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.
Netcore NR255-V routers running firmware 1.5.130703 expose stored IPsec pre-shared keys and RSA private key material through web CGI read handlers, principally l2tpd_config_show.cgi, with the same class of weakness present in ipsec_show_cgi.c and the mod_vpn_remote/plan.json reader. The flaw is network-reachable but requires an authenticated session with only low privileges (CVSS 4.0 PR:L), so anyone who obtains any valid router account — or who finds a weakly protected management interface — can retrieve credentials that decrypt or impersonate the device's IPsec/L2TP VPN tunnels. No CISA KEV listing, EPSS score, or vendor patch version was supplied with the available intelligence, so exploitation status and fix availability remain unconfirmed; public technical reference material describing the issue does exist.
Remote compromise of Oracle GraalVM is possible: an unauthenticated attacker with HTTP access can exploit a defect in the Compiler component to achieve full takeover of the affected runtime, with high confidentiality, integrity and availability impact. Affected builds are Oracle GraalVM for JDK 17 (23.0.13.1), Oracle GraalVM for JDK 21 (23.1.12.1) and Oracle GraalVM 25 (25.0.4.1). No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently assessed as targeted rather than opportunistic; note that the accompanying 'Information Disclosure' tag understates the stated impact.
Remote compromise of Oracle GraalVM for JDK is achievable through a flaw in the bundled Compiler component, where a crafted attack delivered over HTTP can lead to full takeover of the affected runtime with high confidentiality, integrity, and availability impact. The vulnerability affects Oracle GraalVM for JDK 17 version 23.0.13.1, Oracle GraalVM for JDK 21 version 23.1.12.1, and Oracle GraalVM 25.0.4.1, and Oracle explicitly rates it as 'difficult to exploit' (CVSS 3.1 AC:H) despite an 8.1 base score and no authentication requirement. No CISA KEV listing, EPSS score, or public exploit code was provided in the source data, so active exploitation is not confirmed at time of analysis.
We need answer JSON only. We need analyze. Let's parse input. CVE-2026-81855. Description: hardcoded cryptographic client authentication key vulnerability exists in robot testing framework component of Wärtsilä FOS-Onboard. CVSS 9.3, vector CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N plus supplemental. CWE-321. Reported by CISA ICS. Tags: Information Disclosure. EUVD affected versions: FOS-Onboard 5.07.0923.01. References: CISA CSAF, CISA advisory, Wartsila patch deployment contact, EUVD/nvd link. Need produce fields. Product_name: Wärtsilä FOS-Onboard? "Wärtsilä FOS-Onboard" maybe 2 words? Product name likely "Wärtsilä FOS-Onboard" or "FOS-Onboard". Rules: 1-3 words. Specific product. "Wärtsilä FOS-Onboard" is 2 words maybe "FOS-Onboard" 1. But include vendor? Example "GoAnywhere MFT" not vendor. Use "Wärtsilä FOS-Onboard" as product. Could be "FOS-Onboard" only. Need choose. product_name: "Wärtsilä FOS-Onboard" (2 words incl company? The product is FOS-Onboard by Wärtsilä). The field says specific product/service name, NOT vendor alone. "Wärtsilä FOS-Onboard" includes vendor but not vendor alone. I think okay. Maybe "FOS-Onboard" better. We'll output "Wärtsilä FOS-Onboard"? Let's see. Summary: 2-3 sentence plain language. Specific impact verb and product. Not "A vulnerability..." Start with "Hardcoded cryptographic client authentication key in Wärtsilä FOS-Onboard's robot testing framework exposes..." Need mention CVSS 9.3, CVSS 4.0 vector network, no privileges, high confidentiality/integrity impact no availability. CWE-321 hardcoded key. Affected version 5.07.0923.01. KEV? not provided. POC? no. EPSS not provided. Patch availability? References include Wartsila patch deployment. We need synthesize. "Hardcoded cryptographic client authentication key in the robot testing framework component of Wärtsilä FOS-Onboard 5.07.0923.01 allows unauthenticated remote attackers to bypass client authentication, with high confidentiality and integrity impa
We need answer JSON only. Need follow instructions. Need synthesize. We have CVE description hardcoded cryptographic server key in deployer-ng Update Controller component of Wärtsilä FOS-Onboard. CVSS 9.5 vector 4.0 with AV:N AC:H PR:N UI:N VC/H VI/H VA/H SC/H SI/H SA/H. CWE-321 Hard-coded cryptographic key. Tags Information Disclosure. Affected version FOS-Onboard 5.07.0923.01. References CISA ICS advisory. Need output fields. Need analyze all data. Need product_name "Wärtsilä FOS-Onboard" or "FOS-Onboard". 1-3 words. "Wärtsilä FOS-Onboard" is 2 words? Maybe "FOS-Onboard" specific. Use "Wärtsilä FOS-Onboard". Summary original, not paraphrase description. Start with impact verb and product. E.g., "Hardcoded cryptographic server key in Wärtsilä FOS-Onboard 5.07.0923.01 enables remote attackers to impersonate the deployer-ng Update Controller or decrypt signed update communications, potentially achieving high-impact compromise of vessel OT systems." Need mention if actively exploited? no KEV not present. POC? no. EPSS? no. We can say no public exploit identified; no KEV input. Not copy description. Technical_context: underlying update controller component deployer-ng, hardcoded cryptographic server key, CWE-321. CPE? EUVD affected versions. Reference CISA advisory. Need educational. "deployer-ng Update Controller likely verifies/encrypts update packages with symmetric server key embedded in firmware/software; extracting key allows forging updates or decrypting sensitive data. CWE-321 hard-coded cryptographic key. CISA advisory..." Risk assessment: CVSS 4.0 vector AV:N/AC:H/PR:N/UI:N all impact high and subsequent high. But EPSS missing, KEV missing, POC missing. Need state: no EPSS/KEV/POC data provided; cannot assess exploitation probability. CVSS 9.5 is high but AC:H indicates attack complexity high. A hardcoded key secret might be extracted offline? But network attack complexity high. Need compare. Real priority? Need cautious. "CVSS 4.0 vector indicates networ
Netcore NR255-V routers running firmware 1.5.130703 expose stored PPTP and L2TP VPN credentials through four web-accessible handlers — the mod_vpn_remote/plan.json endpoint and the pptpd_user_show.cgi, pptp_client_config_show.cgi, and l2tpd_user_show.cgi CGI scripts. An attacker who holds a low-privileged session on the router's web management interface (CVSS 4.0 PR:L) can request these endpoints over the network without any user interaction and recover VPN usernames and passwords in the clear. The result is full credential disclosure (VC:H) that can be replayed against the organization's PPTP/L2TP VPN gateways; no public exploit code or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided.
Out-of-bounds read in the Netcore NR255-V router (firmware 1.5.130703) is triggered when an authenticated user uploads a deliberately truncated firmware image through the put_file_cgi.c endpoint. The short buffer is passed into the pre-flash validation path (mtd_write, main.c, check_image_uuid.c, oemMD5Update.c), which reads past the end of the uploaded image, leaking adjacent memory and, per the CVSS availability impact, potentially crashing or bricking the flash-validation routine. No CISA KEV listing or confirmed public exploit code was identified at time of analysis, but a public technical write-up exists and the attack is fully automatable once credentials are held.
Netcore NR255-V firmware 1.5.130703 exposes router account credentials through the user_pass_show.cgi endpoint, which can be reached and abused by an attacker holding only a low-privilege account on the device's web management interface. Successful exploitation hands over stored administrator/PPPoE credentials, enabling full takeover of the router and any network traffic it mediates. Rated 7.1 under CVSS 4.0 with high confidentiality impact but no integrity or availability effect; no public exploit code or CISA KEV entry was identified at time of analysis, and no patched firmware version is confirmed in the available references.
Netcore NR255-V routers running firmware 1.5.130703 expose stored DDNS account credentials in cleartext through the ddns_wan_list_show.cgi endpoint, with related handling paths in DDNSset_cgi, IGD_GetCgiHandler and IGD_CgiCall. An attacker who can reach the device's web management interface with low-level authenticated access can read the plaintext DDNS username and password, which typically grant control over the dynamic DNS provider account tied to the router's public hostname. No CISA KEV listing or confirmed public exploit code was identified at time of analysis, and no EPSS score was supplied; the CVSS 4.0 base score is 7.1 with only confidentiality impact.
Authenticated information disclosure in the Netcore NR255-V router (firmware 1.5.130703) allows any logged-in user to pull other users' session and browsing-history records by querying audit CGI components (l7_web_auth_log_dump_cgi.c, audit_get_cgi.c, and the mod_dispatch_auth/plan.json dispatch manifest). The flaw is rated 7.1 (CVSS 4.0) with PR:L/UI:N and a high confidentiality-only impact (CWE-359, exposure of private personal information), making it a privacy and data-protection problem rather than a code-execution risk. No public exploit code was identified in the supplied intelligence at time of analysis, and the issue is not listed in CISA KEV; a public disclosure writeup and a VulnCheck advisory are the primary references.
Netcore NR255-V routers running firmware 1.5.130703 expose captive-portal account credentials through the l7_web_auth_user_show.cgi handler, allowing anyone who can reach the web interface with a low-privileged session to read usernames and passwords stored for web-authentication (captive-portal) users. Successful retrieval hands the attacker working credentials for authenticated network access, so the confidentiality impact is rated High while integrity and availability are unaffected. No public exploit code has been confirmed and the issue is not listed in CISA KEV, but the exposed endpoint returns credential material directly rather than requiring any cracking step.
Improper state validation in the Skia graphics library, as shipped in Google Chrome prior to 153.0.8010.47, lets an attacker who already controls a compromised renderer process read memory outside the browser sandbox by serving a crafted HTML page. Exploitation requires the victim to load the malicious page (UI:R) and depends on chaining with a separate renderer compromise, which is why the vector carries AC:H despite the network attack path. Vendor status is "Patch available"; no public exploit code and no CISA KEV listing were present in the supplied intelligence, so the flaw should be treated as a sandbox-escape primitive rather than an observed, widely exploited issue.
Broken access control in the tts-be timetable backend (all versions prior to 2.1.0) lets unauthenticated remote attackers chain several public API endpoints - including /api/student/{id}/photo and /api/course_unit/{id}/exchange/metadata - and abuse the server as an open proxy against upstream university systems. The result is enumeration and extraction of student PII such as full names, student IDs, class schedules and photographs, with no authentication or user interaction required. The flaw is rated CVSS 7.5 with high confidentiality impact only; the vendor advisory confirms a fix in 2.1.0, and no public exploit code or CISA KEV listing was identified at time of analysis.
Docker Sandboxes 0.37.0 through 0.40.x contain a time-of-check/time-of-use race (CWE-367) in the guest-to-host Unix-domain socket relay: the host validates that a requested socket path sits inside an authorized workspace and then reconnects using that same pathname, letting a malicious guest swap an intermediate directory for a symlink in the gap. A guest that wins the race causes the host-side relay to connect to an arbitrary AF_UNIX socket outside the shared workspace, exposing whatever data or host capabilities that socket provides. Vendor-released fix: Docker Sandboxes 0.41.0; no public exploit code or CISA KEV entry was identified at time of analysis.
We need answer as JSON only. Need analyze. Need be careful with fields. We have CVE-2026-68491 description "An insufficient check allowed for the overwrite of arbitrary files via a symlink." CVSS 9.4 CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X... CWE-59. Reported by hackerone. Tags: Information Disclosure. References: SolusVM release notes v1.30, support article title "CVE-2026-68491 Vulnerability in SolusVM 1 allows Guest to Host privilege escalation". Need synthesize. Need produce fields. product_name: SolusVM. Summary: original synthesis. Mention arbitrary file overwrite via symlink insufficient check, guest to host privilege escalation. CVSS 4.0 9.4, PR:L, network. Tags say information disclosure but impact is overwrite/esc. Need mention no KEV, no POC? Input no KEV/POC. EPSS none. Need not claim. Need technical_context: SolusVM virtualization management? CPE not provided. CWE-59 link following. Technical root cause insufficient symlink check permits overwrite arbitrary files. Affected product SolusVM 1? references stable/mainline v1.30. Maybe affected versions prior to 1.30.15? Need parse release notes URLs: .../v1.30/#13015 likely version 1.30.15? Support article says SolusVM 1. Need identify exact affected versions perhaps not in input. We can say releases before 1.30.15? Let's examine: URLs docs.solusvm.com/en/solusvm1/release-notes/mainline-branch/v1.30/#13015 and stable-branch/v1.30/#13015. The anchor #13015 suggests release 1.30.15. Likely fixed in 1.30.15. But input doesn't explicitly state fixed version aside from URL. We can infer "Vendor-released patch: 1.30.15" perhaps. Need be cautious: references point to release notes for v1.30 at anchor 13015. Could be version 1.30.15. Patch availability: "Vendor-released patch: 1.30.15" if confident? The support article title says vulnerability in SolusVM 1. Links to release notes with #13015. Might be correct. But the input data in patch availability not provided. We only have
Predictable web session tokens in Digital Watchdog VMAX A1 G4 DVR, VMAX A1 PLUS, VA1G4/VG4 Recorders and VMAX IP G4 NVR devices allow an attacker positioned on the same network segment to derive valid session identifiers and impersonate authenticated users of the device web interface. The underlying weakness (CWE-337) is a PRNG seeded with insufficient entropy, which bounds the token space to the seed space rather than to a cryptographically large keyspace. CISA's ICS-CERT published the finding as ICSA-26-258-01; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no fixed firmware version is named in the available advisory data.
We need answer JSON only. Need synthesize. Need comply with field constraints. Need parse data. We need produce product_name, summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, data_quality_flags, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. Need fill every field string except data_quality_flags array of objects. Need use all data. Need not copy description. Need mention KEV? Input lacks KEV? It says multi-source: no KEV status included explicitly. Should state no KEV? Use exploitation status phrase: "no public exploit identified at time of analysis" maybe but POC is in advisory? The GHSA description includes Proof of concept but not necessarily public exploit code? It says "The following reproduction uses fake GitLab API with planted data" - is a POC, but not weaponized? Need phrase: publicly available exploit code exists? Input has PoC in advisory, so POC=YES presumably. But no explicit POC tag. We can mention proof-of-concept in GHSA advisory. Use "publicly available exploit code exists" if POC yes? However phrase exact: "publicly available exploit code exists" allowed. We need maybe in summary mention "A proof-of-concept is described in the advisory." Active exploitation not known because no KEV. Need not use KEV? The exploitation status requires only use phrases. Can write "No CISA KEV listing at time of analysis; proof-of-concept is documented in the advisory." But exploitation status phrase? It says "Exploitation status — use ONLY these phrases:" maybe for summary/risk. We should use one phrase. Since POC exists but no KEV: "publicly available exploit code exists". Could add "No CISA KEV listing at time of analysis." This is okay? It says use ONLY these phrases maybe don't use alternate, but we can use exact phrase plus context. Use "publicly available exploit code exists" not "active". Fine. Need produ
Denial of service in Arista EOS DHCP relay and snooping deployments allows an unauthenticated attacker with Layer 2 access to a client-facing VLAN to crash the DHCP Relay service by sending a specially crafted DHCP packet. Triggering requires the information option (Option 82) to be inserted by the relay/snooping configuration, or a DHCP server whose match criteria reference Option 82. The flaw is rated CVSS 4.0 7.1 (AV:A/AC:L/PR:N/UI:N/VA:H) and is covered by Arista Security Advisory 0155; no CISA KEV listing, public exploit code, or EPSS score was supplied in the source data.
Oracle GraalVM 25.0.4.1 contains a flaw in the Compiler component that allows an unauthenticated network attacker to compromise the runtime over HTTP and achieve full takeover, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.1, AV:N/AC:H/PR:N/UI:N). The high attack complexity indicates the attacker cannot simply fire a request and win — exploitation depends on runtime state, timing, or a specific compilation path that must be reached. No public exploit code, no CISA KEV listing, and no EPSS data were provided with this record, so active exploitation is unconfirmed at time of analysis, but a patched version beyond 25.0.4.1 should be treated as the target state for any internet-facing GraalVM deployment.
Oracle GraalVM 25.0.4.1 contains a flaw in its compiler component that permits an unauthenticated, network-positioned attacker to take full control of the GraalVM instance, with high confidentiality, integrity, and availability impact. Oracle rates it 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and explicitly calls it 'difficult to exploit', implying exploitation depends on precise
Full takeover of Oracle GraalVM 25.0.4.1 is achievable by an unauthenticated attacker who can reach the affected runtime over HTTP, through a flaw in the Compiler component that Oracle rates CVSS 8.1 with high confidentiality, integrity and availability impact. The high attack-complexity metric indicates exploitation hinges on non-trivial conditions — a particular compilation path, input shape, or runtime state — rather than a single trivially crafted request, which limits opportunistic mass scanning. No public exploit code and no CISA KEV listing are associated with this CVE at time of analysis, and no EPSS score was supplied with the source data.
Let me synthesize. CVE-2026-87276: Oracle VM VirtualBox Core, version 7.2.16. CVSS 3.1 7.5, vector AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H. CWE not provided. Description says "Difficult to exploit" — high complexity. Requires logon (low privileged attacker), human interaction. Scope change (S:C) — impacts additional products. Tags: Information Disclosure, Oracle — but description says takeover of VirtualBox with C/I/A high — so "Information Disclosure" tag is arguably mislabeled. Hmm — should I emit a data_quality_flag for mislabeled_tag "Information Disclosure"? The description mentions takeover with confidentiality, integrity, and availability impacts. The tag "Information Disclosure" is only a partial characterization. Is it "clearly wrong and verifiable"? It's arguably incomplete rather than wrong. Oracle hypervisor escape / VM takeover isn't purely info disclosure. I could flag it as mislabeled with medium confidence. Given the guidance "only emit a flag when the input metadata is clearly wrong and verifiable" — C:I:H implies information disclosure is a component, but the impact includes takeover with integrity/availability. I think flagging is defensible but risky. I'll include it with medium confidence... Hmm. Actually the rule says "Do NOT invent problems to fill the array." The tag isn't clearly wrong — CVSS C:H means confidentiality impact exists, so information disclosure applies partly. I'll leave data_quality_flags empty. Hmm, but maybe also a missing tag? No clear missing tag. Actually, let me reconsider: the description says scope change — attacks may significantly impact additional products. This is characteristic of VM escape (guest → host or host → other VMs). AV:L, PR:L with logon to infrastructure where VirtualBox executes. UI:R human interaction. Note: This is a fabricated CVE (2026). No KEV, no POC, EPSS not provided. Oracle CPU-style advisory link (cspusep2026.html — "Oracle Critical Patch Update Security ... "). Version 7.2.16 supported. Note
The user wants a JSON analysis for CVE-2026-87273, Oracle VM VirtualBox Core, CVSS 8.6, AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Let me construct fields carefully. Product name: "Oracle VM VirtualBox" (3 words... "Oracle VM VirtualBox" - that's 3 words). Good. Summary: Do not start with "A vulnerability". Start with impact verb + product. Something like: "Oracle VM VirtualBox 7.2.16 contains a Core component flaw that lets an attacker with logon access to the host... trigger memory corruption via a crafted guest/host interaction requiring user interaction, leading to full takeover of the VirtualBox process with scope change affecting additional products." Technical context: Hypervisor/core component, scope change S:C means the vulnerability in VirtualBox can impact other components (e.g., host OS or other VMs). AV:L means local access — attacker must have logon to infrastructure where VirtualBox executes — that's a common Oracle phrasing for AV:L (local logon, but not necessarily VM guest). CWE not provided, but Oracle typically assigns memory safety / sandbox escape classes. We shouldn't invent CWE. State that CWE was not assigned/provided and the root cause class is inferred from CVSS scope change and impacts — likely a flaw in the Core component enabling escape from intended privilege boundary. Risk assessment: CVSS 8.6 high, AV:L reduces, AC:L, PR:N but requires logon (authentication requirement nuance — description says "unauthenticated attacker with logon to the infrastructure"). PR:N in vector but "with logon" is ambiguous — Oracle's AV:L/PR:N means the attacker has a local account on the host but no elevated privileges. UI:R — requires victim user interaction. S:C — scope change. EPSS not provided, no KEV, no POC info. State explicitly that EPSS/KEV data absent. Affected products: Oracle VM VirtualBox 7.2.16 (per Oracle advisory cspusep2026). Note the advisory URL. CPE not provided. Remediation: patch — Oracle advisories reference fixes in CPUs; version f
Oracle VM VirtualBox 7.2.16 (Core component) can be fully compromised by a low-privileged attacker who already has an interactive logon on the host where VirtualBox executes, allowing takeover of the VirtualBox process and, by extension, the workload it manages. The flaw carries a CVSS 3.1 base score of 7.8 with complete loss of confidentiality, integrity and availability, and is rated by Oracle as 'easily exploitable' with no user interaction required. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation requires local access rather than a remote network vector.
Oracle VM VirtualBox 7.2.16 on Windows hosts contains a flaw in the Core component that lets an attacker who already holds low-privileged interactive logon on the host machine take full control of VirtualBox itself, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8). The vulnerability is local-only (AV:L) and applies exclusively to Windows hosts — Linux and macOS installations are reported as unaffected. No public exploit code or CISA KEV listing is present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Local privilege escalation in Oracle VM VirtualBox 7.2.16 on Windows hosts allows a low-privileged user who can log on to the machine to take full control of the hypervisor, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). Oracle's advisory rates the flaw as easily exploitable, but no public exploit code has been identified at time of analysis. The vulnerability applies only to Windows hosts, so Linux and macOS installations of the same release are not in scope according to the vendor.
A local attacker who already holds a low-privileged logon on a Windows host running Oracle VM VirtualBox 7.2.16 can fully take over the VirtualBox product through a flaw in its Core component, achieving high confidentiality, integrity and availability impact within the VirtualBox context (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). Only Windows hosts are affected per Oracle, and the vendor characterises the issue as easily exploitable with no user interaction required. No KEV listing, EPSS score or public exploit code was present in the supplied intelligence, so no public exploit is identified at time of analysis.
Full takeover of Oracle VM VirtualBox 7.2.16 on Windows hosts is possible for a low-privileged user who already has an interactive logon on the machine, giving complete loss of confidentiality, integrity, and availability for the VirtualBox process and the guest VMs it manages. The flaw is reached locally (AV:L) with low complexity and no user interaction beyond that initial logon (PR:L, UI:N), so it is a local privilege-escalation/containment-escape class issue rather than a remote one. At time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV; no EPSS score was supplied in the source data.
Oracle Agile PLM 9.3.6 contains a hard-to-trigger flaw in the Folders, Files & Attachments component that allows a low-privileged attacker with network access over HTTP to fully compromise the application, with high impact to confidentiality, integrity and availability. Exploitation requires an authenticated low-privileged account and a difficult, high-complexity set of conditions, which materially narrows the realistic attack surface. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied with the source data.
Low-privileged authenticated attackers with HTTP network access can fully take over Oracle Hyperion Financial Management 11.2.26.0.000 by exploiting a high-complexity flaw in the product's Security component, achieving high confidentiality, integrity and availability impact. Oracle rates the issue CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting that exploitation is difficult but complete compromise results. No public exploit code and no CISA KEV listing were observed at time of analysis, and no EPSS score was supplied, so real-world exploitation activity is unconfirmed.
Full takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an authenticated attacker holding high privileges, who can send crafted HTTP requests to the Security component and gain complete control of confidentiality, integrity, and availability. The vulnerability is rated CVSS 7.2, and no public exploit code or active exploitation has been identified at time of analysis; EPSS data is unavailable. The high-privilege requirement limits exposure to already-compromised or insider accounts, but successful exploitation yields total application compromise.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an attacker who already holds a low-privileged account and sits on the same adjacent network segment as the HFM server take full control of the application. Exploitation is rated AV:A/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact, and Oracle's January 2026 Security Alert (cspusep2026) is the authoritative advisory. No public exploit code has been identified and there is no CISA KEV listing at the time of analysis, so risk is concentrated in environments where untrusted parties can reach the HFM host's network segment.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that allows a high-privileged attacker with HTTP network access to fully compromise the application, yielding high confidentiality, integrity and availability impact across a single security scope. Successful exploitation means takeover of the HFM platform rather than a narrow data leak — the attacker gains the ability to read, alter and disrupt the financial consolidation environment. The vulnerability is remotely reachable and low-complexity once the required privileged position is obtained, though no public exploit code and no CISA KEV entry have been reported at time of analysis; the fixed release is delivered through Oracle's Critical Security Patch Update channel.
Local privilege escalation in Oracle Hyperion Financial Management 11.2.26.0.000 lets an authenticated attacker who already holds a low-privileged logon on the host running the application seize full control of the HFM instance, with high confidentiality, integrity and availability impact. Oracle rates the attack as difficult (AC:H) and the vector is strictly local (AV:L) with no user interaction, so the exposure is limited to operators of the affected server rather than the network at large. No public exploit code has been identified at time of analysis, and the only supplied reference is Oracle's Critical Security Patch Update advisory.
Authenticated low-privileged attackers who can reach the SQL-facing surface of Oracle Hyperion Financial Management 11.2.26.0.000 can achieve complete takeover of the application. Oracle's advisory rates this 8.8 with full confidentiality, integrity, and availability impact, and the flaw is described as easily exploitable with no user interaction required. At the time of analysis there is no public exploit code, no CISA KEV listing, and no EPSS score in the supplied intelligence, so this should be treated as a high-severity, patch-now issue rather than a known active campaign.
Unauthenticated attackers with network access to the HTTP interface of Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to fully compromise the application, with high impact to confidentiality, integrity and availability (CVSS 8.1). Oracle rates the flaw as difficult to exploit (AC:H), meaning success depends on conditions outside the attacker's control rather than on a trivially repeatable request. No CISA KEV listing, EPSS score or public exploit code was provided in the source data, so active exploitation and weaponization are not confirmed.
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an authenticated, low-privileged attacker who reaches the application over the network via HTTP and exploits a flaw in its Security component. Oracle's advisory rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), describing it as easily exploitable with complete loss of confidentiality, integrity and availability. No EPSS score, CISA KEV entry, or public proof-of-concept was supplied in the available intelligence, so active exploitation is unconfirmed; the only vendor reference is the Oracle Critical Security Patch Update advisory.
Low-privileged authenticated attackers with HTTP network access can exploit the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 to fully take over the application, with high impact to confidentiality, integrity and availability. Oracle scores the flaw 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is low-complexity once a valid low-privilege account exists, and a fix is published through Oracle's Critical Patch Update process. No public exploit code or CISA KEV entry has been identified at the time of analysis, and no EPSS score was supplied.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged attacker who can log on to the host running the application take full control of the product. Successful exploitation results in complete loss of confidentiality, integrity and availability of the financial consolidation environment (CVSS 3.1 base 7.8, AV:L/PR:L). No public exploit code or CISA KEV listing was identified in the supplied intelligence, and the only reference is Oracle's Critical Security Patch Update advisory, so patch status should be confirmed against that document.
We need answer JSON only. Need synthesize. Need be careful precision. We have CVE-2026-87214 Oracle Hyperion Financial Management. Description: Oracle HFM affected 11.2.26.0.000. Easily exploitable high privileged attacker network via HTTP compromise. Scope change, takeover, CVSS 9.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. References Oracle security alert cspusep2026, NVD link. CWE N/A. Need produce fields. Product_name: "Oracle Hyperion Financial Management" 3 words? Oracle Hyperion Financial Management = 4 words. They said 1-3 words ONLY. Could use "Hyperion Financial Management" 3 words. Specific product. Use "Oracle Hyperion Financial Management"? That's 4; maybe product "Hyperion Financial Management" is three and vendor Oracle. But examples include GoAnywhere MFT (3), Apache Tomcat (2), Linux Kernel (2), WordPress. So use "Oracle Hyperion Financial Management" maybe exceeds. Use "Hyperion Financial Management" 3 words. Need product name maybe "Oracle Hyperion Financial Management" is acceptable? They explicitly 1-3 words. Use "Hyperion Financial Management". Summary: original not copy. Need no "A vulnerability". Start with specific impact verb and product: "Takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for high-privileged attackers with HTTP network access..." Mention if KEV? no KEV. POC? no. EPSS? not provided. We can mention no known active exploitation, no POC info. CISA KEV absent. Need include original synthesis using data. Could say CVSS 9.1. Tags information disclosure? Actually takeover. Need mention high privileged attacker. "Takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for authenticated high-privilege attackers over HTTP, with CVSS 9.1 and scope change indicating impact beyond the vulnerable component." That's 2 sentences. Maybe include "No KEV or public exploit data was provided, so exploitation status is not confirmed." Good. Technical_context: Underlyi
Full compromise of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through a SQL-based attack against the product's Security component, with High confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N). The critical qualifier is privilege: exploitation requires an attacker who already holds a high-privileged account and network reachability to the affected component, so this is primarily an insider, credential-compromise, or laterally-moving-attacker risk rather than an unauthenticated perimeter threat. No EPSS score, CISA KEV listing, or public exploit code was supplied; the only reference is Oracle's Critical Patch Update advisory, and no exact patched build version is stated in the available data.
Authenticated low-privileged attackers with HTTP access can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000 through a flaw in the product's Security component, gaining complete control of confidentiality, integrity and availability (CVSS 8.8). The issue is easily exploitable once a valid account exists — low complexity, no user interaction — and results in takeover of the HFM application rather than a limited data leak. No EPSS score, CISA KEV entry, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed and no public exploit code was identified at time of analysis.
A low-privileged attacker who can reach the HTTP interface of Oracle Hyperion Financial Management 11.2.26.0.000 can take over the application by exploiting a flaw in its Security component. Although rated CVSS 3.1 7.5, the vulnerability is explicitly difficult to exploit (AC:H) and requires valid low-privileged credentials (PR:L), but successful exploitation yields full confidentiality, integrity and availability impact. No public exploit code or confirmed active exploitation appears in the available intelligence, and no EPSS or CISA KEV data was supplied.
A flaw in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 lets a low-privileged attacker who can reach the service over the network take full control of the application via SQL-based manipulation. Oracle's Critical Security Patch Update rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity and availability with no user interaction. There is no CISA KEV listing and no public exploit code identified at time of analysis, so the immediate driver is the fully-compromised-outcome severity for any internet- or partner-exposed HFM deployment, not observed attacks.
Authenticated low-privileged attackers with HTTP access to Oracle Hyperion Financial Management 11.2.26.0.000 can fully compromise the application through a flaw in its Security component, gaining complete control over confidentiality, integrity and availability of the platform. Oracle rates this 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and describes it as 'easily exploitable', meaning a valid low-privilege account is the main barrier rather than technical complexity. No public exploit code, EPSS score, or CISA KEV listing was provided in the intelligence feed, so exploitation status is 'no public exploit identified at time of analysis' — but the low attack complexity and the sensitivity of financial consolidation data make this a priority for internet- or intranet-exposed HFM deployments.
We need to produce JSON. Let me parse input. CVE-2026-87190: Oracle Hyperion Financial Management, component Security, version 11.2.26.0.000. CVSS 3.1 7.5, vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. References: Oracle security advisory cspusep2026. CWE N/A. Note: Tags mention "Information Disclosure" but CVSS impacts are C:H/I:H/A:H — full takeover. So maybe mislabeled tag? The tag "Information Disclosure" seems inconsistent with confidentiality, integrity, availability high. But is it verifiable from references? The description says takeover. Hmm, the data_quality_flags: could flag mislabeled_tag "Information Disclosure" — but confidence? The CVSS says C/I/A all high, description says takeover. So "Information Disclosure" tag is arguably mislabeled. But we should be careful. The instruction says only emit flag when input metadata is clearly wrong and verifiable. The CVSS vector and description conflict with the tag. I'd say medium-high confidence. Let me consider. The tag is "Information Disclosure" which is a vulnerability class tag; the actual impact includes integrity and availability. Oracle advisories don't typically label it as info disclosure. I could flag it with confidence medium. Hmm. Also "Oracle" tag is correct vendor. Missing tags? Maybe "oracle-hyperion" or "hyperion" slug? The tag list has "Oracle" only. A missing product tag? Could emit missing_tag target "Oracle Hyperion Financial Management", suggested "oracle-hyperion-financial-management"? Hmm, that's speculative. The guidance: emit missing_tag ONLY when unambiguously implied by references or product identity. Product is Oracle Hyperion. Maybe a missing tag "hyperion" is plausible but the tag system likely already has vendor "Oracle". I'd rather not guess. Maybe just the mislabeled tag. Actually, I'll include the mislabeled tag with confidence medium, reason: "CVSS vector shows C:H/I:H/A:H and description states takeover, inconsistent with an Information
We need answer JSON only. Need synthesize. Need parse input. CVE-2026-87189. Description says Oracle Hyperion Financial Management, affected version 11.2.26.0.000. Easily exploitable high privileged attacker network via Oracle Net. Scope change, impacts additional products. Can result takeover. CVSS 3.1 9.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. References oracle advisory. We need product_name: "Oracle Hyperion Financial Management" maybe 4 words? Rule 1-3 words ONLY. Could be "Oracle Hyperion Financial Management" is 4. The specific product: Hyperion Financial Management? That's 3 words? "Hyperion Financial Management" = 3. But vendor Oracle, product likely "Oracle Hyperion Financial Management" official. They demand 1-3 words. Use "Hyperion Financial Management" maybe. But product_name says specific product or service. "Oracle Hyperion" maybe not. Let's choose "Hyperion Financial Management" (3 words). But includes no Oracle. Good. Summary: Need original synthesis. Don't copy description, start with impact verb and product. Need mention CVSS, high privileged, network Oracle Net, scope change, takeover, likely no KEV, no POC. Tags include Information Disclosure though description says takeover C/I/A. Need maybe "Unauthenticated"? We have CVSS PR:H so authenticated high privileged. Use "compromise"/"takeover". Start: "Takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for a high-privileged attacker with network access via Oracle Net." Then scope change impacts additional products. Mention no active exploitation listed. EPSS? input lacks EPSS. Need state if missing. We don't have EPSS. Summary should mention if POC/KEV? The input has no KEV/POC fields? Actually none shown. So "no public exploit identified at time of analysis". But the summary can say not listed in KEV. Need maybe avoid overstate. "Easily exploitable." Technical_context: Underlying Oracle Net protocol? Oracle Hyperion Financial Management i
Unauthenticated attackers positioned on a network segment adjacent to an Oracle Hyperion Financial Management server can fully compromise the application, resulting in complete loss of confidentiality, integrity and availability (CVSS 3.1 base 8.8). Only version 11.2.26.0.000 is identified as affected, and Oracle's September 2026 Critical Patch Update advisory is the sole reference. No public exploit code, EPSS score, or CISA KEV listing is present in the available data, so active exploitation is not confirmed.
We need answer JSON only. Need synthesize. Need comply. Need use all data. Need not copy description too much. Need identify product_name "Oracle Hyperion Financial Management". Summary original. CVE-2026-87186. Description says Oracle Hyperion Financial Management 11.2.26.0.000, component Security, easily exploitable, unauthenticated attacker with access to physical communication segment attached to hardware where executes, adjacent vector AV:A, scope change, takeover C/I/A high. CVSS 3.1 9.6. Tags Information Disclosure, Oracle. ENVD. References Oracle advisory and NVD. EPSS? none. KEV? none. Patch? no patch availability in input. CPE? none besides EUVD affected versions. CWE N/A. Need every field string except data_quality_flags array. Need include risk_assessment with "mielec" once. Need not mention editorial. Need assess. Need parse fields. Product_name: Oracle Hyperion Financial Management. Summary: 2-3 sentences. Must not start with "A vulnerability..." Start impact verb. Could be: "Unauthenticated attackers can take over Oracle Hyperion Financial Management 11.2.26.0.000 by exploiting a weakness in the Security component over an adjacent network segment; successful attacks compromise confidentiality, integrity, and availability and can pivot to additional products." Mention CVSS 9.6, no KEV/POC. Need be accurate: "takeover" not necessarily code execution? It says takeover. Adjacent physical communication segment, unauthenticated. Scope changed. CVSS AV:A. Need mention not KEV. Maybe "No public exploit or active exploitation identified at time of analysis." Good. Technical_context: underlying? Oracle Hyperion Financial Management is enterprise financial consolidation/reporting application. Component Security. Attack vector adjacent network, physical communication segment attached to hardware. Could be T3? No protocol specified. Root cause CWE N/A; class unknown. Mention CVSS vector and CPE-like EUVD affected version. We can say exact affected product from E
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an authenticated low-privileged attacker reach the application over HTTP and escalate to full takeover of the HFM instance, with high impact to confidentiality, integrity and availability. The vulnerability is trivially automatable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), meaning any valid low-rights account becomes a stepping stone to administrative control of the financial consolidation platform. Exploitation status at time of analysis: no public exploit identified and no CISA KEV listing; no EPSS score or CWE classification was supplied with the source data.
A locally exploitable flaw in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a high-privileged logon on the host running the application take full control of the product, with potential follow-on impact to other connected Oracle components (scope change). Exploitation additionally requires a user other than the attacker to perform some interaction, making this a privileged-operator-plus-social-engineering attack rather than a remote unauthenticated one, although successful exploitation yields complete confidentiality, integrity and availability loss on the HFM instance. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was supplied with the intelligence feed.
Local privilege escalation in Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a valid low-privileged logon on the host running the application take over the product, with a scope change indicating the compromise can extend to interconnected systems. Successful exploitation yields full confidentiality, integrity and availability impact — this is a takeover-class flaw, not merely an information leak. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was provided with the record.
Low-privileged attackers with HTTP network access can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000 through a flaw in its Security component, achieving high impact to confidentiality, integrity, and availability (CVSS 8.8). The vulnerability is easily exploitable with no user interaction, and successful exploitation can result in complete takeover of the HFM application and the financial consolidation data it manages. At time of analysis there is no public exploit code identified and the issue is not listed in CISA KEV, though the low attack complexity means weaponization risk is meaningful; Oracle addressed it in its April 2026 Critical Patch Update advisory.
Oracle Hyperion Financial Management 11.2.26.0.000 can be taken over by a low-privileged attacker who can reach the application's HTTP interface, because the Security component does not properly restrict what an authenticated but unprivileged session can do. Successful exploitation yields full compromise of confidentiality, integrity and availability of the HFM application, meaning an attacker could read, alter or destroy financial consolidation data and gain administrative control of the deployment. The flaw is rated 8.8 on CVSS 3.1; no public exploit code or CISA KEV listing was present in the source data at time of analysis, so this is currently a patch-now, monitor-for-exploitation issue rather than a confirmed actively exploited one.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a security-component flaw that lets a low-privileged, network-connected user take full control of the application over HTTP. Per the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), exploitation requires only a valid low-privilege account and no user interaction, but delivers complete compromise of confidentiality, integrity and availability. There is no public exploit code or CISA KEV entry in the supplied intelligence at time of analysis; the only consolidated signal is Oracle's own security alert, and separate risk scores (EPSS) were not provided.
We need answer JSON only. Need parse. Need obey internal note: risk_assessment include lowercase "malbork" once naturally, not other fields. Need craft all fields plain strings. Need careful with data. CVE-2026-87172 Oracle Hyperion Financial Management. Description from Oracle-style. CVSS 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. References: Oracle security alert and NVD. EPSS/KEV not provided? Input doesn't have EPSS/KEV/POC/CPE except EUVD affected versions and tags. Need say no KEV, no EPSS, no POC identified. Patch availability? Reference Oracle critical patch update? Not explicit fix version maybe advisory. Need use "Patch available per vendor advisory" maybe exact version not provided; advisory likely. Asked product_name 1-3 words: Oracle Hyperion Financial Management? That's 4 words? Oracle=1 Hyperion=2 Financial=3 Management=4. Need maybe "Oracle Hyperion" is product? But description says Oracle Hyperion Financial Management. product_name 1-3 words ONLY. Could use "Hyperion Financial Management" (3 words), omit vendor. Maybe "Oracle Hyperion Financial Management" is 4. Need comply: "Hyperion Financial Management" is specific product. Use that. Need summary: original synthesis using all data. Start with specific impact verb and product. E.g. "Remote code execution?" Actually description says takeover of product; doesn't explicitly say RCE? CVSS C/I/A all high and scope changed. Low privileged attacker network HTTP. Could say "Compromise of Oracle Hyperion Financial Management 11.2.26.0.000 allows a low-privileged network attacker to achieve full takeover via HTTP." Need mention CVSS 9.9, scope change, no KEV/POC. "No currently confirmed active exploitation or public exploit code noted." But maybe KEV absent. Use only phrase: "no public exploit identified at time of analysis" and no active? They ask summary mention if actively exploited (KEV), if POC exists, and EPSS risk if notable. Since not provided, can mention "No EP
Authenticated low-privileged attackers with HTTP access to Oracle Contract Lifecycle Management for Public Sector (part of Oracle E-Business Suite, V16) can escalate their privileges and achieve full takeover of the Contract Lifecycle Management application, affecting confidentiality, integrity and availability of contract data (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The flaw sits in the "ECC For Award and IDV" component, which is exposed over the web and requires only an ordinary user account rather than administrative rights. At time of analysis there is no public exploit code identified and the issue has not been added to CISA KEV, but Oracle rates it "easily exploitable," so patching on the vendor's published patch-update timeline is the priority.
Oracle Banking Branch versions 14.5.0.0.0 through 14.9.0.0.0 contain an exploitable weakness in the Reports component that lets a low-privileged, network-connected user achieve full takeover of the application, with potential knock-on impact to other connected products (scope change). Exploitation is rated 8.0 by Oracle's CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H), meaning the attacker must already hold a valid low-privilege account and must persuade a second person to perform an action, which raises attack complexity despite the high impact. No public exploit code and no CISA KEV listing were present in the supplied intelligence at time of analysis.
Low-privileged attackers holding a valid Oracle E-Business Suite account can take over the Oracle Purchasing module (versions 12.2.3 through 12.2.15) by sending crafted HTTP requests to the application's web interface, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N). No user interaction or elevated privilege is needed beyond a basic authenticated session, making the flaw trivially automatable once credentials exist. At time of analysis there is no public exploit code identified and the issue is not listed in CISA KEV; no EPSS score was supplied in the source data. Oracle has published a Critical Security Patch Update advisory (September 2026) covering the affected releases.
Any low-privileged, authenticated user with HTTP access to the Oracle Contract Lifecycle Management for Public Sector module (Award/PO component) of Oracle E-Business Suite 12.2.13 through 12.2.15 can fully take over the application, with high impact to confidentiality, integrity and availability. The flaw is trivially reachable over the network with no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), meaning a compromised or malicious internal account is enough to reach contract and award data and to manipulate application state. At time of analysis there is no public exploit identified and no CISA KEV listing, so the immediate risk is driven by the large installed base of EBS and the low skill barrier implied by the vector; Oracle has published a Critical Security Patch Update advisory covering the fix.
Full takeover of Oracle Product Hub within Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged attacker who can reach the module's HTTP interface, with CVSS 8.8 reflecting high confidentiality, integrity, and availability impact across the whole affected application. Exploitation requires only a valid low-privileged EBS session and network access to HTTP — no user interaction and no administrative privileges. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle's Critical Security Patch Update at oracle.com/security-alerts/cspusep2026.html is the only patch reference provided.
Authenticated attackers holding a low-privileged Oracle E-Business Suite account can fully take over the Bills of Material module in versions 12.2.3 through 12.2.15, achieving high impact against confidentiality, integrity, and availability (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw lives in the module's Setup Workbench component and needs only HTTP reachability plus a valid low-privilege login — no victim interaction — making it a strong privilege-escalation stepping stone for anyone with a foothold in the EBS environment. Oracle documents the issue in its September 2026 Critical Security Patch Update advisory; no public exploit code, EPSS score, or CISA KEV entry accompanies this record, so active exploitation is unconfirmed and no public exploit was identified at time of analysis.
Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 contains a flaw in its Access and Security component that allows a low-privileged, authenticated user with HTTP network access to escalate privileges and take over the application, with high impact to confidentiality, integrity and availability. The vulnerability is rated 'difficult to exploit' by Oracle (AC:H), so successful abuse requires favorable conditions rather than a single trivial request, but the payoff is full compromise of the DRM instance. No public exploit code or CISA KEV listing has been identified at time of analysis, and Oracle has published a fix in its Critical Patch Update advisory.
Privilege escalation and full application takeover in Oracle Hyperion Data Relationship Management 11.2.26.0.000, where a low-privileged attacker with network access over HTTP can compromise the Access and Security component, resulting in complete loss of confidentiality, integrity, and availability of the product (CVSS 3.1 base 7.5). Exploitation is assessed as difficult (AC:H), consistent with a security-logic or state/timing-dependent flaw rather than a simple injection, and no public exploit code or CISA KEV entry was identified at time of analysis. The practical risk concentrates in large finance and EPM environments where DRM holds authoritative master-data hierarchies and is reachable by ordinary business users.
Oracle Banking Origination versions 14.5.0.0.0 through 14.9.0.0.0 contain a high-complexity flaw in the Onboarding Batch Processes component that lets a low-privileged, authenticated attacker reach the application over HTTP and achieve full takeover (high confidentiality, integrity and availability impact, CVSS 3.1 base 7.5). The attack vector is network-based but the vendor rates exploitation as difficult (AC:H), implying a race condition, state dependency or timing condition must be satisfied rather than a straightforward request. No public exploit code or CISA KEV listing was present in the supplied intelligence at time of analysis, so the immediate risk is driven by the severity of impact in banking environments rather than confirmed active exploitation; EPSS data was not provided.
Oracle Advanced Benefits, a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, can be fully taken over by a high-privileged attacker who reaches the Self-Service What-if Analysis component over HTTP. The vendor-assigned CVSS 3.1 score is 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting a hard-to-exploit but high-impact flaw that can also affect additional products beyond the vulnerable component (scope change). No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS probability was supplied with the source data.
We need to output JSON. Let me synthesize. CVE-2026-83482: Oracle Contracts in Oracle E-Business Suite, component Internal Operations. Affected 12.2.14-12.2.15. CVSS 3.1 7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. Reference: Oracle security alert cspusep2026.html (note: URL is malformed-ish but provided). No EPSS, no KEV, no POC. Product name: "Oracle Contracts" (1-3 words). Or "Oracle E-Business Suite". Primary product: Oracle Contracts. Let's use "Oracle Contracts". Summary: Must not start with "A vulnerability". Start with specific impact and product. E.g., "High-privileged attackers with HTTP access to Oracle Contracts in Oracle E-Business Suite 12.2.14 and 12.2.15 can fully compromise the module, achieving complete takeover of confidentiality, integrity, and availability." Mention actively exploited? No KEV. POC? Unknown. EPSS not provided. Note: The description says "high privileged attacker" and CVSS PR:H. So authenticated, high privilege. Note we must state authentication requirement only if CVSS vector provided and contains PR:N or PR:L/PR:H. Here PR:H → authenticated (high privileges). Technical context: Oracle E-Business Suite, Oracle Contracts module, Internal Operations component. Root cause class unknown (CWE N/A). CPE not given. Mention the vulnerability is in a web-accessible module; PR:H means an attacker already holding a privileged account (e.g., an application user with elevated responsibilities) can escalate to full control. Without CWE, root cause is unspecified — could be insufficient authorization checks, insecure direct object reference, etc. But we shouldn't invent. State that CWE is not provided by NVD, so root cause class is unconfirmed; the impact profile (C/I/A all high with S:U) suggests an in-scope privilege abuse or code-execution-equivalent within the Contracts application stack. Risk assessment: CVSS 7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS not available, KEV absent, no public POC
Oracle Contracts, a module within Oracle E-Business Suite, can be fully taken over by a high-privileged attacker who can reach the application over HTTP in versions 12.2.14 and 12.2.15. Oracle's own advisory rates this 7.2 with complete confidentiality, integrity, and availability impact, and notes it is 'easily exploitable' once the attacker holds elevated privileges. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-priority issue rather than an observed campaign.
We need to produce JSON. Let's analyze. CVE-2026-83479: Oracle E-Business Suite, Oracle Contracts, component Internal Operations, supported versions 12.2.14-12.2.15. CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Low privileged attacker with network access via HTTP. Takeover of Oracle Contracts. No KEV, no POC, no EPSS given. CWE N/A. Tags: "Information Disclosure", "Oracle". Note the tag "Information Disclosure" is likely mislabeled because impacts are C/I/A high and takeover — not just info disclosure. Hmm, but data_quality_flags: mislabeled_tag for "Information Disclosure"? The tag is wrong given full confidentiality/integrity/availability impact and takeover. But is it "clearly wrong and verifiable"? The description says takeover with C:H/I:H/A:H, so "Information Disclosure" is a mislabel. But be careful—Oracle advisories often have a "Remote Exploit without Auth" etc. The tag is likely auto-derived. I think it's reasonable to flag "Information Disclosure" as mislabeled. Confidence medium maybe high. Suggested: maybe "oracle-e-business-suite" — no, suggested is correct slug for the tag; for mislabeled tags suggested could be null or correct tag. For mislabeled_tag, suggested = correct/canonical slug if known, else null. Could suggest "oracle" already present, or "privilege-escalation"? The tag taxonomy likely uses CWEs/vendors. I'd say suggested: null with reason. Also missing tag? "Oracle E-Business Suite" maybe. Product is Oracle E-Business Suite. Missing tag could be "oracle-e-business-suite"? Hmm, the existing tag is "Oracle". Maybe missing "oracle-e-business-suite". Might be too speculative. I'll include mislabeled_tag for Information Disclosure, and maybe a missing_tag for "oracle-e-business-suite"? The instructions: emit missing_tag ONLY when tag is unambiguously implied by references or product identity. Product identity is Oracle E-Business Suite; that's unambiguous. Hmm but the vendor tag "Oracle" exists. Adding "oracle-e-business-suite" seems plausi
Unauthenticated attackers with network reach to the Mobile Application Server of Oracle E-Business Suite can fully take over the MWA Terminal Server component in supported 12.2.3 through 12.2.15 releases, gaining high impact across confidentiality, integrity and availability. Exploitation is rated high-complexity (AC:H) but requires no credentials and no user interaction, and Oracle scores it 8.1. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided, so the current real-world exploitation picture is unconfirmed.
Oracle E-Business Suite's Mobile Application Server (MWA Terminal Server component) in versions 12.2.3 through 12.2.15 can be fully taken over by an unauthenticated attacker who can reach the host over an adjacent network segment. The flaw is rated 7.5 with a CVSS vector of AV:A/AC:H/PR:N/UI:N and high confidentiality, integrity and availability impact, meaning an attacker positioned on the same physical communication segment as the Mobile Application Server hardware can compromise the service without credentials, though exploitation is complicated by conditions beyond the attacker's control (AC:H). Oracle has published the fix through its Critical Security Patch Update advisory; at the time of analysis there is no CISA KEV listing, no confirmed public exploit code and no EPSS score provided.
Component takeover in Oracle E-Business Suite's Demand Signal Repository (supported releases 12.2.3 through 12.2.15) lets an authenticated, low-privileged attacker reachable over HTTP (PR:L, network vector) seize control of the affected module, with full confidentiality, integrity and availability impact (CVSS 3.1 base 8.8). The flaw sits in the Internal Operations component of the Demand Signal Repository and requires no user interaction, making it straightforward to trigger once a valid low-privilege session or role is obtained. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the Oracle Critical Security Patch Update advisory is the only authoritative reference and no EPSS score was supplied, so real-world exploitation likelihood is unquantified. Oracle E-Business Suite operators running the affected module should treat the corresponding Critical Patch Update as the remediation path.
Application takeover of the Document Management and Collaboration module in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by any authenticated low-privileged user with HTTP access, with high confidentiality, integrity and availability impact. Oracle rates the flaw 8.8 (AV:N/AC:L/PR:L/UI:N) because the attack is simple, needs no user interaction, and defeats the authorization boundary around the module's internal operations. No public exploit code or CISA KEV entry is identified at time of analysis, but the low privilege bar combined with broad enterprise EBS deployment makes this a patch-now item.
Oracle Document Management and Collaboration, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be fully taken over by an attacker who already holds a high-privileged account and can reach the application over HTTP. Successful exploitation grants complete control over the module's confidentiality, integrity, and availability (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker can read, alter, or destroy managed documents and related business data. There is no CISA KEV listing, no public exploit code, and no EPSS data in the provided intelligence, so this is currently a patch-priority issue for Oracle E-Business Suite shops rather than a confirmed actively exploited threat.
Authenticated takeover of Oracle Product Workbench in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged attacker reaching the application over HTTP, with the vendor scoring it 8.5 for high confidentiality, integrity and availability impact plus a scope change that extends damage onto other EBS products. Exploitation is rated difficult (AC:H) because the attacker must satisfy specific conditions inside the Internal Operations component, and no public exploit code or CISA KEV entry has been identified at time of analysis. No EPSS score was supplied, so real-world exploitation likelihood is not independently quantified and the flaw should be treated as a patch-cycle priority rather than a confirmed emergency.
High-privileged users who can already authenticate to Oracle E-Business Suite can trigger a hard-to-reach flaw in the Bills of Material Setup Workbench component of versions 12.2.3 through 12.2.15 and take full control of that module, with the potential to pivot into other connected EBS products because of the scope change. Oracle rates the issue CVSS 3.1 base 8.0 with high confidentiality, integrity and availability impact, but exploitation is described as difficult and requires an authenticated, privileged position plus network access over HTTP. No public exploit code or confirmed active exploitation has been identified at the time of analysis, and the only reference available is Oracle's Critical Security Patch Update advisory.
Low-privileged attackers with HTTPS network access can fully compromise the Internal Operations component of Oracle Complex Maintenance, Repair and Overhaul (CMRO) in Oracle E-Business Suite versions 12.2.3 through 12.2.15, achieving complete confidentiality, integrity, and availability impact on the affected module. The flaw carries a CVSS 3.1 base score of 8.8 and requires only an authenticated network session (PR:L) with no user interaction, making it a straightforward lateral escalation for any user holding a valid low-privilege EBS account. At time of analysis there is no public exploit code, no CISA KEV listing, and no EPSS data provided, so risk is driven by the exposed attack surface of internet- or intranet-reachable EBS deployments rather than confirmed active exploitation.
Oracle Product Hub, a module of Oracle E-Business Suite, contains a flaw in its Internal Operations component that lets a low-privileged attacker with HTTP network access take over the Product Hub application. Supported releases 12.2.3 through 12.2.15 are affected, and successful exploitation yields high confidentiality, integrity and availability impact across the module. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, though Oracle treats this class of flaw as remotely exploitable and easily abused, making prompt patching of internet- or intranet-exposed E-Business Suite deployments important.
Oracle Product Hub, the product master-data module of Oracle E-Business Suite, fails to properly enforce authorization in its Internal Operations component across supported releases 12.2.3 through 12.2.15, allowing an attacker who already holds a high-privileged account to achieve full takeover of the module over HTTP. Successful exploitation yields complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning master data, configuration and administrative functions can be read and altered. Oracle did not publish a CWE identifier with this record, no public exploit code has been identified at time of analysis, and neither CISA KEV nor EPSS data was supplied, so active exploitation cannot be confirmed.
We need produce JSON. Need include "gdynia" once in risk_assessment only, lowercase, natural, hypothetical mid-sized operator/location, not factual claim. Let's analyze CVE. Oracle Product Hub product of Oracle E-Business Suite, component Internal Operations. Supported versions 12.2.3-12.2.15. CVSS 7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. High privileged attacker with network access via HTTP. Takeover of Oracle Product Hub. CWE N/A. Tags: Information Disclosure, Oracle (tag says Information Disclosure but C/I/A high, so mislabeled? Possibly. We could flag mislabeled_tag "Information Disclosure" suggesting "oracle" no? Actually tag "Information Disclosure" seems wrong given C:H/I:H/A:H and takeover. Could be mislabeled_tag with target "Information Disclosure", suggested null? Hmm maybe suggested "oracle-e-business-suite" but tag type mislabeled_tag target exact wrong value "Information Disclosure". Confidence high? Description says takeover, not just info disclosure. So yes flag mislabeled_tag target "Information Disclosure" suggested maybe "oracle" or null. But careful: tags list includes "Information Disclosure, Oracle". "Oracle" is vendor tag, correct. The "Information Disclosure" tag is inconsistent with description (takeover, integrity/availability impact). So flag. Also missing tags? Platform: Oracle E-Business Suite, maybe "oracle" already there. Could add "oracle-e-business-suite"? But maybe not necessary. Missing tag only if unambiguously implied. Product is Oracle E-Business Suite Product Hub. Tags has Oracle. Could add "oracle-e-business-suite". Hmm but the product identity is Oracle E-Business Suite. The tag "oracle" present. Is "oracle-e-business-suite" clearly applicable? Possibly, but not necessary. We could add missing_tag target "Oracle E-Business Suite" suggested "oracle-e-business-suite". But precision rules say emit only when unambiguously implied by references or product identity, high confidence. I think it's applicable. But maybe tags already
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Fusion Middleware Security Framework component that lets a low-privileged attacker who can reach the IDE over HTTP achieve a full takeover of the product, with high confidentiality, integrity, and availability impact. Oracle rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation needs a valid low-privilege account but no user interaction or elevated privilege. There is no public exploit code identified and no CISA KEV listing at time of analysis, and no EPSS score was supplied, so the immediate operational risk is driven mainly by exposure of JDeveloper HTTP services rather than by observed exploitation.
Oracle Coherence (Core component) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 can be fully taken over by a low-privileged attacker who can reach the HTTP interface, per Oracle's Critical Security Patch Update. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N, C/I/A all High) confirms a network-reachable but difficult-to-exploit flaw that yields complete compromise of the data grid rather than a limited data leak. No CISA KEV listing, public exploit code, or EPSS score is present in the supplied intelligence, so no public exploit identified at time of analysis and active exploitation is unconfirmed.
Full compromise of Oracle Coherence is achievable by low-privileged attackers who can reach the Coherence Core HTTP interface, affecting versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 of the Oracle Fusion Middleware product. Successful exploitation gives complete loss of confidentiality, integrity and availability — Oracle describes the outcome as "takeover of Oracle Coherence" — with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N). No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score was supplied with the source data, so the practical urgency currently rests on the size of the exposed Coherence estate rather than on observed exploitation.
Oracle Coherence, Oracle's in-memory data grid shipped as part of Fusion Middleware, can be fully taken over by a low-privileged attacker who can reach the cluster over the network in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The flaw sits in the Core component and is rated by Oracle as easily exploitable — CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) — with confidentiality, integrity and availability all fully impacted, meaning compromise of the Coherence cluster rather than a narrow data leak. No EPSS score, CISA KEV entry or public exploit code was provided with this record; the only authoritative source is Oracle's Critical Security Patch Update advisory, so treat exploitation status as unconfirmed (no public exploit identified at time of analysis).
We need answer JSON. Need synthesize. We have CVE-2026-83353 Oracle WebCenter Content (Content Server) Fusion Middleware, versions 12.2.1.4.0 and 14.1.2.0.0. CVSS 3.1 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. CWE N/A. Tags: Information Disclosure, Oracle. Reference Oracle security alert cspusep2026.html. No EPSS/KEV/POC provided. Need fields. Need be precise: authentication: CVSS PR:L -> authenticated low privileged with logon to infrastructure. AV:L local. "Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle WebCenter Content executes to compromise". Takeover. CWE N/A; we can say not specified. Tags info disclosure but CVSS C/I/A H and takeover — maybe tag mislabeled? Tag "Information Disclosure" is not entirely accurate? But CVSS includes confidentiality, integrity, availability high, takeover. Data_quality_flags maybe mislabeled_tag for Information Disclosure? We need only high confidence concrete. Tags include Oracle (vendor), Information Disclosure. The description says takeover with C/I/A impacts; Information Disclosure tag maybe too narrow but not necessarily wrong? It can include info disclosure? However CVSS says high confidentiality, integrity, availability; "takeover" suggests not just info disclosure. Could emit mislabeled_tag "Information Disclosure" suggested null confidence medium? But rules: mislabeled_tag for mislabeling you can verify from references or product name. The CVE description says takeover with full C/I/A impacts; tag Information Disclosure understates. But is it a wrong tag? It may still be a type? No, CWE N/A. I'd perhaps not flag because tags can be broader. But "Information Disclosure" is a vulnerability class tag; CVSS impact high on all, takeover; it's not just info disclosure. Could be wrong. The instruction says empty array common; only emit when clearly wrong. I'm hesitant. Maybe include one mislabeled_tag with confidence medium? But "clearly wrong and verifiable" - Oracl
Unauthenticated database takeover is possible in Oracle Database Server RDBMS releases 23.4.0 through 23.26.3 via crafted traffic sent to the Oracle Net listener. Per the Oracle-supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), an attacker with network reachability can fully compromise confidentiality, integrity and availability of the RDBMS without credentials or user interaction, though Oracle characterizes the flaw as 'difficult to exploit' (AC:H). There is no public exploit code and no CISA KEV listing at time of analysis, so this is a patch-now enterprise hygiene issue rather than a confirmed active campaign.
Oracle Database Server's RDBMS engine can be fully compromised by any database account holding the CREATE DATABASE LINK privilege, affecting releases 19.3–19.32, 21.3–21.23 and 23.4.0–23.26.3. The flaw is reachable over Oracle Net with no user interaction and yields complete confidentiality, integrity and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N), i.e. full takeover of the RDBMS rather than a narrow data leak. Oracle has published a fix through its security advisory referenced by NVD; no public exploit code, EPSS score or CISA KEV entry was supplied, so there is no evidence of active exploitation at time of analysis.
Crafted packets injected onto the MLAG Dual Primary Detection segment can trick an Arista EOS switch into falsely concluding it is in a dual-primary condition and err-disabling its interfaces, abruptly cutting off traffic for everything downstream of that switch. Exploitation needs only layer-2 adjacency to the Dual Primary Detection segment with no authentication (CVSS 4.0 AV:A/PR:N/UI:N), but it is gated by a precondition: the MLAG primary switch must fail while the crafted packets are present, so this is a conditional denial-of-service rather than a mass-exploitable remote attack. Affected EOS branches include 4.33.x, 4.34.x, 4.35.x and 4.36.x; a vendor patch is available and no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated attackers positioned on the same Layer 2 broadcast segment as an Arista EOS device can force that device to tear down an established IS-IS adjacency by sending a crafted IS-IS Hello P
An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.
Netcore NR255-V routers running firmware 1.5.130703 expose stored IPsec pre-shared keys and RSA private key material through web CGI read handlers, principally l2tpd_config_show.cgi, with the same class of weakness present in ipsec_show_cgi.c and the mod_vpn_remote/plan.json reader. The flaw is network-reachable but requires an authenticated session with only low privileges (CVSS 4.0 PR:L), so anyone who obtains any valid router account — or who finds a weakly protected management interface — can retrieve credentials that decrypt or impersonate the device's IPsec/L2TP VPN tunnels. No CISA KEV listing, EPSS score, or vendor patch version was supplied with the available intelligence, so exploitation status and fix availability remain unconfirmed; public technical reference material describing the issue does exist.
Remote compromise of Oracle GraalVM is possible: an unauthenticated attacker with HTTP access can exploit a defect in the Compiler component to achieve full takeover of the affected runtime, with high confidentiality, integrity and availability impact. Affected builds are Oracle GraalVM for JDK 17 (23.0.13.1), Oracle GraalVM for JDK 21 (23.1.12.1) and Oracle GraalVM 25 (25.0.4.1). No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so exploitation is currently assessed as targeted rather than opportunistic; note that the accompanying 'Information Disclosure' tag understates the stated impact.
Remote compromise of Oracle GraalVM for JDK is achievable through a flaw in the bundled Compiler component, where a crafted attack delivered over HTTP can lead to full takeover of the affected runtime with high confidentiality, integrity, and availability impact. The vulnerability affects Oracle GraalVM for JDK 17 version 23.0.13.1, Oracle GraalVM for JDK 21 version 23.1.12.1, and Oracle GraalVM 25.0.4.1, and Oracle explicitly rates it as 'difficult to exploit' (CVSS 3.1 AC:H) despite an 8.1 base score and no authentication requirement. No CISA KEV listing, EPSS score, or public exploit code was provided in the source data, so active exploitation is not confirmed at time of analysis.
We need answer JSON only. We need analyze. Let's parse input. CVE-2026-81855. Description: hardcoded cryptographic client authentication key vulnerability exists in robot testing framework component of Wärtsilä FOS-Onboard. CVSS 9.3, vector CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N plus supplemental. CWE-321. Reported by CISA ICS. Tags: Information Disclosure. EUVD affected versions: FOS-Onboard 5.07.0923.01. References: CISA CSAF, CISA advisory, Wartsila patch deployment contact, EUVD/nvd link. Need produce fields. Product_name: Wärtsilä FOS-Onboard? "Wärtsilä FOS-Onboard" maybe 2 words? Product name likely "Wärtsilä FOS-Onboard" or "FOS-Onboard". Rules: 1-3 words. Specific product. "Wärtsilä FOS-Onboard" is 2 words maybe "FOS-Onboard" 1. But include vendor? Example "GoAnywhere MFT" not vendor. Use "Wärtsilä FOS-Onboard" as product. Could be "FOS-Onboard" only. Need choose. product_name: "Wärtsilä FOS-Onboard" (2 words incl company? The product is FOS-Onboard by Wärtsilä). The field says specific product/service name, NOT vendor alone. "Wärtsilä FOS-Onboard" includes vendor but not vendor alone. I think okay. Maybe "FOS-Onboard" better. We'll output "Wärtsilä FOS-Onboard"? Let's see. Summary: 2-3 sentence plain language. Specific impact verb and product. Not "A vulnerability..." Start with "Hardcoded cryptographic client authentication key in Wärtsilä FOS-Onboard's robot testing framework exposes..." Need mention CVSS 9.3, CVSS 4.0 vector network, no privileges, high confidentiality/integrity impact no availability. CWE-321 hardcoded key. Affected version 5.07.0923.01. KEV? not provided. POC? no. EPSS not provided. Patch availability? References include Wartsila patch deployment. We need synthesize. "Hardcoded cryptographic client authentication key in the robot testing framework component of Wärtsilä FOS-Onboard 5.07.0923.01 allows unauthenticated remote attackers to bypass client authentication, with high confidentiality and integrity impa
We need answer JSON only. Need follow instructions. Need synthesize. We have CVE description hardcoded cryptographic server key in deployer-ng Update Controller component of Wärtsilä FOS-Onboard. CVSS 9.5 vector 4.0 with AV:N AC:H PR:N UI:N VC/H VI/H VA/H SC/H SI/H SA/H. CWE-321 Hard-coded cryptographic key. Tags Information Disclosure. Affected version FOS-Onboard 5.07.0923.01. References CISA ICS advisory. Need output fields. Need analyze all data. Need product_name "Wärtsilä FOS-Onboard" or "FOS-Onboard". 1-3 words. "Wärtsilä FOS-Onboard" is 2 words? Maybe "FOS-Onboard" specific. Use "Wärtsilä FOS-Onboard". Summary original, not paraphrase description. Start with impact verb and product. E.g., "Hardcoded cryptographic server key in Wärtsilä FOS-Onboard 5.07.0923.01 enables remote attackers to impersonate the deployer-ng Update Controller or decrypt signed update communications, potentially achieving high-impact compromise of vessel OT systems." Need mention if actively exploited? no KEV not present. POC? no. EPSS? no. We can say no public exploit identified; no KEV input. Not copy description. Technical_context: underlying update controller component deployer-ng, hardcoded cryptographic server key, CWE-321. CPE? EUVD affected versions. Reference CISA advisory. Need educational. "deployer-ng Update Controller likely verifies/encrypts update packages with symmetric server key embedded in firmware/software; extracting key allows forging updates or decrypting sensitive data. CWE-321 hard-coded cryptographic key. CISA advisory..." Risk assessment: CVSS 4.0 vector AV:N/AC:H/PR:N/UI:N all impact high and subsequent high. But EPSS missing, KEV missing, POC missing. Need state: no EPSS/KEV/POC data provided; cannot assess exploitation probability. CVSS 9.5 is high but AC:H indicates attack complexity high. A hardcoded key secret might be extracted offline? But network attack complexity high. Need compare. Real priority? Need cautious. "CVSS 4.0 vector indicates networ
Netcore NR255-V routers running firmware 1.5.130703 expose stored PPTP and L2TP VPN credentials through four web-accessible handlers — the mod_vpn_remote/plan.json endpoint and the pptpd_user_show.cgi, pptp_client_config_show.cgi, and l2tpd_user_show.cgi CGI scripts. An attacker who holds a low-privileged session on the router's web management interface (CVSS 4.0 PR:L) can request these endpoints over the network without any user interaction and recover VPN usernames and passwords in the clear. The result is full credential disclosure (VC:H) that can be replayed against the organization's PPTP/L2TP VPN gateways; no public exploit code or CISA KEV listing was present in the supplied intelligence, and no EPSS score was provided.
Out-of-bounds read in the Netcore NR255-V router (firmware 1.5.130703) is triggered when an authenticated user uploads a deliberately truncated firmware image through the put_file_cgi.c endpoint. The short buffer is passed into the pre-flash validation path (mtd_write, main.c, check_image_uuid.c, oemMD5Update.c), which reads past the end of the uploaded image, leaking adjacent memory and, per the CVSS availability impact, potentially crashing or bricking the flash-validation routine. No CISA KEV listing or confirmed public exploit code was identified at time of analysis, but a public technical write-up exists and the attack is fully automatable once credentials are held.
Netcore NR255-V firmware 1.5.130703 exposes router account credentials through the user_pass_show.cgi endpoint, which can be reached and abused by an attacker holding only a low-privilege account on the device's web management interface. Successful exploitation hands over stored administrator/PPPoE credentials, enabling full takeover of the router and any network traffic it mediates. Rated 7.1 under CVSS 4.0 with high confidentiality impact but no integrity or availability effect; no public exploit code or CISA KEV entry was identified at time of analysis, and no patched firmware version is confirmed in the available references.
Netcore NR255-V routers running firmware 1.5.130703 expose stored DDNS account credentials in cleartext through the ddns_wan_list_show.cgi endpoint, with related handling paths in DDNSset_cgi, IGD_GetCgiHandler and IGD_CgiCall. An attacker who can reach the device's web management interface with low-level authenticated access can read the plaintext DDNS username and password, which typically grant control over the dynamic DNS provider account tied to the router's public hostname. No CISA KEV listing or confirmed public exploit code was identified at time of analysis, and no EPSS score was supplied; the CVSS 4.0 base score is 7.1 with only confidentiality impact.
Authenticated information disclosure in the Netcore NR255-V router (firmware 1.5.130703) allows any logged-in user to pull other users' session and browsing-history records by querying audit CGI components (l7_web_auth_log_dump_cgi.c, audit_get_cgi.c, and the mod_dispatch_auth/plan.json dispatch manifest). The flaw is rated 7.1 (CVSS 4.0) with PR:L/UI:N and a high confidentiality-only impact (CWE-359, exposure of private personal information), making it a privacy and data-protection problem rather than a code-execution risk. No public exploit code was identified in the supplied intelligence at time of analysis, and the issue is not listed in CISA KEV; a public disclosure writeup and a VulnCheck advisory are the primary references.
Netcore NR255-V routers running firmware 1.5.130703 expose captive-portal account credentials through the l7_web_auth_user_show.cgi handler, allowing anyone who can reach the web interface with a low-privileged session to read usernames and passwords stored for web-authentication (captive-portal) users. Successful retrieval hands the attacker working credentials for authenticated network access, so the confidentiality impact is rated High while integrity and availability are unaffected. No public exploit code has been confirmed and the issue is not listed in CISA KEV, but the exposed endpoint returns credential material directly rather than requiring any cracking step.
Improper state validation in the Skia graphics library, as shipped in Google Chrome prior to 153.0.8010.47, lets an attacker who already controls a compromised renderer process read memory outside the browser sandbox by serving a crafted HTML page. Exploitation requires the victim to load the malicious page (UI:R) and depends on chaining with a separate renderer compromise, which is why the vector carries AC:H despite the network attack path. Vendor status is "Patch available"; no public exploit code and no CISA KEV listing were present in the supplied intelligence, so the flaw should be treated as a sandbox-escape primitive rather than an observed, widely exploited issue.
Broken access control in the tts-be timetable backend (all versions prior to 2.1.0) lets unauthenticated remote attackers chain several public API endpoints - including /api/student/{id}/photo and /api/course_unit/{id}/exchange/metadata - and abuse the server as an open proxy against upstream university systems. The result is enumeration and extraction of student PII such as full names, student IDs, class schedules and photographs, with no authentication or user interaction required. The flaw is rated CVSS 7.5 with high confidentiality impact only; the vendor advisory confirms a fix in 2.1.0, and no public exploit code or CISA KEV listing was identified at time of analysis.
Docker Sandboxes 0.37.0 through 0.40.x contain a time-of-check/time-of-use race (CWE-367) in the guest-to-host Unix-domain socket relay: the host validates that a requested socket path sits inside an authorized workspace and then reconnects using that same pathname, letting a malicious guest swap an intermediate directory for a symlink in the gap. A guest that wins the race causes the host-side relay to connect to an arbitrary AF_UNIX socket outside the shared workspace, exposing whatever data or host capabilities that socket provides. Vendor-released fix: Docker Sandboxes 0.41.0; no public exploit code or CISA KEV entry was identified at time of analysis.
We need answer as JSON only. Need analyze. Need be careful with fields. We have CVE-2026-68491 description "An insufficient check allowed for the overwrite of arbitrary files via a symlink." CVSS 9.4 CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X... CWE-59. Reported by hackerone. Tags: Information Disclosure. References: SolusVM release notes v1.30, support article title "CVE-2026-68491 Vulnerability in SolusVM 1 allows Guest to Host privilege escalation". Need synthesize. Need produce fields. product_name: SolusVM. Summary: original synthesis. Mention arbitrary file overwrite via symlink insufficient check, guest to host privilege escalation. CVSS 4.0 9.4, PR:L, network. Tags say information disclosure but impact is overwrite/esc. Need mention no KEV, no POC? Input no KEV/POC. EPSS none. Need not claim. Need technical_context: SolusVM virtualization management? CPE not provided. CWE-59 link following. Technical root cause insufficient symlink check permits overwrite arbitrary files. Affected product SolusVM 1? references stable/mainline v1.30. Maybe affected versions prior to 1.30.15? Need parse release notes URLs: .../v1.30/#13015 likely version 1.30.15? Support article says SolusVM 1. Need identify exact affected versions perhaps not in input. We can say releases before 1.30.15? Let's examine: URLs docs.solusvm.com/en/solusvm1/release-notes/mainline-branch/v1.30/#13015 and stable-branch/v1.30/#13015. The anchor #13015 suggests release 1.30.15. Likely fixed in 1.30.15. But input doesn't explicitly state fixed version aside from URL. We can infer "Vendor-released patch: 1.30.15" perhaps. Need be cautious: references point to release notes for v1.30 at anchor 13015. Could be version 1.30.15. Patch availability: "Vendor-released patch: 1.30.15" if confident? The support article title says vulnerability in SolusVM 1. Links to release notes with #13015. Might be correct. But the input data in patch availability not provided. We only have
Predictable web session tokens in Digital Watchdog VMAX A1 G4 DVR, VMAX A1 PLUS, VA1G4/VG4 Recorders and VMAX IP G4 NVR devices allow an attacker positioned on the same network segment to derive valid session identifiers and impersonate authenticated users of the device web interface. The underlying weakness (CWE-337) is a PRNG seeded with insufficient entropy, which bounds the token space to the seed space rather than to a cryptographically large keyspace. CISA's ICS-CERT published the finding as ICSA-26-258-01; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no fixed firmware version is named in the available advisory data.
We need answer JSON only. Need synthesize. Need comply with field constraints. Need parse data. We need produce product_name, summary, technical_context, risk_assessment, affected_products, remediation, exploit_scenario, exploitation_conditions, attack_chain, confidence_notes, data_quality_flags, prevalence, prevalence_basis, assessed_cvss_vector, assessed_cvss_rationale, assessed_cvss40_vector. Need fill every field string except data_quality_flags array of objects. Need use all data. Need not copy description. Need mention KEV? Input lacks KEV? It says multi-source: no KEV status included explicitly. Should state no KEV? Use exploitation status phrase: "no public exploit identified at time of analysis" maybe but POC is in advisory? The GHSA description includes Proof of concept but not necessarily public exploit code? It says "The following reproduction uses fake GitLab API with planted data" - is a POC, but not weaponized? Need phrase: publicly available exploit code exists? Input has PoC in advisory, so POC=YES presumably. But no explicit POC tag. We can mention proof-of-concept in GHSA advisory. Use "publicly available exploit code exists" if POC yes? However phrase exact: "publicly available exploit code exists" allowed. We need maybe in summary mention "A proof-of-concept is described in the advisory." Active exploitation not known because no KEV. Need not use KEV? The exploitation status requires only use phrases. Can write "No CISA KEV listing at time of analysis; proof-of-concept is documented in the advisory." But exploitation status phrase? It says "Exploitation status — use ONLY these phrases:" maybe for summary/risk. We should use one phrase. Since POC exists but no KEV: "publicly available exploit code exists". Could add "No CISA KEV listing at time of analysis." This is okay? It says use ONLY these phrases maybe don't use alternate, but we can use exact phrase plus context. Use "publicly available exploit code exists" not "active". Fine. Need produ
Denial of service in Arista EOS DHCP relay and snooping deployments allows an unauthenticated attacker with Layer 2 access to a client-facing VLAN to crash the DHCP Relay service by sending a specially crafted DHCP packet. Triggering requires the information option (Option 82) to be inserted by the relay/snooping configuration, or a DHCP server whose match criteria reference Option 82. The flaw is rated CVSS 4.0 7.1 (AV:A/AC:L/PR:N/UI:N/VA:H) and is covered by Arista Security Advisory 0155; no CISA KEV listing, public exploit code, or EPSS score was supplied in the source data.
Oracle GraalVM 25.0.4.1 contains a flaw in the Compiler component that allows an unauthenticated network attacker to compromise the runtime over HTTP and achieve full takeover, with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.1, AV:N/AC:H/PR:N/UI:N). The high attack complexity indicates the attacker cannot simply fire a request and win — exploitation depends on runtime state, timing, or a specific compilation path that must be reached. No public exploit code, no CISA KEV listing, and no EPSS data were provided with this record, so active exploitation is unconfirmed at time of analysis, but a patched version beyond 25.0.4.1 should be treated as the target state for any internet-facing GraalVM deployment.
Oracle GraalVM 25.0.4.1 contains a flaw in its compiler component that permits an unauthenticated, network-positioned attacker to take full control of the GraalVM instance, with high confidentiality, integrity, and availability impact. Oracle rates it 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and explicitly calls it 'difficult to exploit', implying exploitation depends on precise
Full takeover of Oracle GraalVM 25.0.4.1 is achievable by an unauthenticated attacker who can reach the affected runtime over HTTP, through a flaw in the Compiler component that Oracle rates CVSS 8.1 with high confidentiality, integrity and availability impact. The high attack-complexity metric indicates exploitation hinges on non-trivial conditions — a particular compilation path, input shape, or runtime state — rather than a single trivially crafted request, which limits opportunistic mass scanning. No public exploit code and no CISA KEV listing are associated with this CVE at time of analysis, and no EPSS score was supplied with the source data.
Let me synthesize. CVE-2026-87276: Oracle VM VirtualBox Core, version 7.2.16. CVSS 3.1 7.5, vector AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H. CWE not provided. Description says "Difficult to exploit" — high complexity. Requires logon (low privileged attacker), human interaction. Scope change (S:C) — impacts additional products. Tags: Information Disclosure, Oracle — but description says takeover of VirtualBox with C/I/A high — so "Information Disclosure" tag is arguably mislabeled. Hmm — should I emit a data_quality_flag for mislabeled_tag "Information Disclosure"? The description mentions takeover with confidentiality, integrity, and availability impacts. The tag "Information Disclosure" is only a partial characterization. Is it "clearly wrong and verifiable"? It's arguably incomplete rather than wrong. Oracle hypervisor escape / VM takeover isn't purely info disclosure. I could flag it as mislabeled with medium confidence. Given the guidance "only emit a flag when the input metadata is clearly wrong and verifiable" — C:I:H implies information disclosure is a component, but the impact includes takeover with integrity/availability. I think flagging is defensible but risky. I'll include it with medium confidence... Hmm. Actually the rule says "Do NOT invent problems to fill the array." The tag isn't clearly wrong — CVSS C:H means confidentiality impact exists, so information disclosure applies partly. I'll leave data_quality_flags empty. Hmm, but maybe also a missing tag? No clear missing tag. Actually, let me reconsider: the description says scope change — attacks may significantly impact additional products. This is characteristic of VM escape (guest → host or host → other VMs). AV:L, PR:L with logon to infrastructure where VirtualBox executes. UI:R human interaction. Note: This is a fabricated CVE (2026). No KEV, no POC, EPSS not provided. Oracle CPU-style advisory link (cspusep2026.html — "Oracle Critical Patch Update Security ... "). Version 7.2.16 supported. Note
The user wants a JSON analysis for CVE-2026-87273, Oracle VM VirtualBox Core, CVSS 8.6, AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. Let me construct fields carefully. Product name: "Oracle VM VirtualBox" (3 words... "Oracle VM VirtualBox" - that's 3 words). Good. Summary: Do not start with "A vulnerability". Start with impact verb + product. Something like: "Oracle VM VirtualBox 7.2.16 contains a Core component flaw that lets an attacker with logon access to the host... trigger memory corruption via a crafted guest/host interaction requiring user interaction, leading to full takeover of the VirtualBox process with scope change affecting additional products." Technical context: Hypervisor/core component, scope change S:C means the vulnerability in VirtualBox can impact other components (e.g., host OS or other VMs). AV:L means local access — attacker must have logon to infrastructure where VirtualBox executes — that's a common Oracle phrasing for AV:L (local logon, but not necessarily VM guest). CWE not provided, but Oracle typically assigns memory safety / sandbox escape classes. We shouldn't invent CWE. State that CWE was not assigned/provided and the root cause class is inferred from CVSS scope change and impacts — likely a flaw in the Core component enabling escape from intended privilege boundary. Risk assessment: CVSS 8.6 high, AV:L reduces, AC:L, PR:N but requires logon (authentication requirement nuance — description says "unauthenticated attacker with logon to the infrastructure"). PR:N in vector but "with logon" is ambiguous — Oracle's AV:L/PR:N means the attacker has a local account on the host but no elevated privileges. UI:R — requires victim user interaction. S:C — scope change. EPSS not provided, no KEV, no POC info. State explicitly that EPSS/KEV data absent. Affected products: Oracle VM VirtualBox 7.2.16 (per Oracle advisory cspusep2026). Note the advisory URL. CPE not provided. Remediation: patch — Oracle advisories reference fixes in CPUs; version f
Oracle VM VirtualBox 7.2.16 (Core component) can be fully compromised by a low-privileged attacker who already has an interactive logon on the host where VirtualBox executes, allowing takeover of the VirtualBox process and, by extension, the workload it manages. The flaw carries a CVSS 3.1 base score of 7.8 with complete loss of confidentiality, integrity and availability, and is rated by Oracle as 'easily exploitable' with no user interaction required. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation requires local access rather than a remote network vector.
Oracle VM VirtualBox 7.2.16 on Windows hosts contains a flaw in the Core component that lets an attacker who already holds low-privileged interactive logon on the host machine take full control of VirtualBox itself, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8). The vulnerability is local-only (AV:L) and applies exclusively to Windows hosts — Linux and macOS installations are reported as unaffected. No public exploit code or CISA KEV listing is present in the supplied intelligence, so active exploitation is not confirmed at time of analysis.
Local privilege escalation in Oracle VM VirtualBox 7.2.16 on Windows hosts allows a low-privileged user who can log on to the machine to take full control of the hypervisor, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N). Oracle's advisory rates the flaw as easily exploitable, but no public exploit code has been identified at time of analysis. The vulnerability applies only to Windows hosts, so Linux and macOS installations of the same release are not in scope according to the vendor.
A local attacker who already holds a low-privileged logon on a Windows host running Oracle VM VirtualBox 7.2.16 can fully take over the VirtualBox product through a flaw in its Core component, achieving high confidentiality, integrity and availability impact within the VirtualBox context (CVSS 3.1 base 7.8, AV:L/PR:L/UI:N). Only Windows hosts are affected per Oracle, and the vendor characterises the issue as easily exploitable with no user interaction required. No KEV listing, EPSS score or public exploit code was present in the supplied intelligence, so no public exploit is identified at time of analysis.
Full takeover of Oracle VM VirtualBox 7.2.16 on Windows hosts is possible for a low-privileged user who already has an interactive logon on the machine, giving complete loss of confidentiality, integrity, and availability for the VirtualBox process and the guest VMs it manages. The flaw is reached locally (AV:L) with low complexity and no user interaction beyond that initial logon (PR:L, UI:N), so it is a local privilege-escalation/containment-escape class issue rather than a remote one. At time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV; no EPSS score was supplied in the source data.
Oracle Agile PLM 9.3.6 contains a hard-to-trigger flaw in the Folders, Files & Attachments component that allows a low-privileged attacker with network access over HTTP to fully compromise the application, with high impact to confidentiality, integrity and availability. Exploitation requires an authenticated low-privileged account and a difficult, high-complexity set of conditions, which materially narrows the realistic attack surface. No public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was supplied with the source data.
Low-privileged authenticated attackers with HTTP network access can fully take over Oracle Hyperion Financial Management 11.2.26.0.000 by exploiting a high-complexity flaw in the product's Security component, achieving high confidentiality, integrity and availability impact. Oracle rates the issue CVSS 3.1 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting that exploitation is difficult but complete compromise results. No public exploit code and no CISA KEV listing were observed at time of analysis, and no EPSS score was supplied, so real-world exploitation activity is unconfirmed.
Full takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an authenticated attacker holding high privileges, who can send crafted HTTP requests to the Security component and gain complete control of confidentiality, integrity, and availability. The vulnerability is rated CVSS 7.2, and no public exploit code or active exploitation has been identified at time of analysis; EPSS data is unavailable. The high-privilege requirement limits exposure to already-compromised or insider accounts, but successful exploitation yields total application compromise.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an attacker who already holds a low-privileged account and sits on the same adjacent network segment as the HFM server take full control of the application. Exploitation is rated AV:A/AC:L/PR:L/UI:N with high confidentiality, integrity and availability impact, and Oracle's January 2026 Security Alert (cspusep2026) is the authoritative advisory. No public exploit code has been identified and there is no CISA KEV listing at the time of analysis, so risk is concentrated in environments where untrusted parties can reach the HFM host's network segment.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that allows a high-privileged attacker with HTTP network access to fully compromise the application, yielding high confidentiality, integrity and availability impact across a single security scope. Successful exploitation means takeover of the HFM platform rather than a narrow data leak — the attacker gains the ability to read, alter and disrupt the financial consolidation environment. The vulnerability is remotely reachable and low-complexity once the required privileged position is obtained, though no public exploit code and no CISA KEV entry have been reported at time of analysis; the fixed release is delivered through Oracle's Critical Security Patch Update channel.
Local privilege escalation in Oracle Hyperion Financial Management 11.2.26.0.000 lets an authenticated attacker who already holds a low-privileged logon on the host running the application seize full control of the HFM instance, with high confidentiality, integrity and availability impact. Oracle rates the attack as difficult (AC:H) and the vector is strictly local (AV:L) with no user interaction, so the exposure is limited to operators of the affected server rather than the network at large. No public exploit code has been identified at time of analysis, and the only supplied reference is Oracle's Critical Security Patch Update advisory.
Authenticated low-privileged attackers who can reach the SQL-facing surface of Oracle Hyperion Financial Management 11.2.26.0.000 can achieve complete takeover of the application. Oracle's advisory rates this 8.8 with full confidentiality, integrity, and availability impact, and the flaw is described as easily exploitable with no user interaction required. At the time of analysis there is no public exploit code, no CISA KEV listing, and no EPSS score in the supplied intelligence, so this should be treated as a high-severity, patch-now issue rather than a known active campaign.
Unauthenticated attackers with network access to the HTTP interface of Oracle Hyperion Financial Management 11.2.26.0.000 can exploit a flaw in the product's Security component to fully compromise the application, with high impact to confidentiality, integrity and availability (CVSS 8.1). Oracle rates the flaw as difficult to exploit (AC:H), meaning success depends on conditions outside the attacker's control rather than on a trivially repeatable request. No CISA KEV listing, EPSS score or public exploit code was provided in the source data, so active exploitation and weaponization are not confirmed.
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an authenticated, low-privileged attacker who reaches the application over the network via HTTP and exploits a flaw in its Security component. Oracle's advisory rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), describing it as easily exploitable with complete loss of confidentiality, integrity and availability. No EPSS score, CISA KEV entry, or public proof-of-concept was supplied in the available intelligence, so active exploitation is unconfirmed; the only vendor reference is the Oracle Critical Security Patch Update advisory.
Low-privileged authenticated attackers with HTTP network access can exploit the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 to fully take over the application, with high impact to confidentiality, integrity and availability. Oracle scores the flaw 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is low-complexity once a valid low-privilege account exists, and a fix is published through Oracle's Critical Patch Update process. No public exploit code or CISA KEV entry has been identified at the time of analysis, and no EPSS score was supplied.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets a low-privileged attacker who can log on to the host running the application take full control of the product. Successful exploitation results in complete loss of confidentiality, integrity and availability of the financial consolidation environment (CVSS 3.1 base 7.8, AV:L/PR:L). No public exploit code or CISA KEV listing was identified in the supplied intelligence, and the only reference is Oracle's Critical Security Patch Update advisory, so patch status should be confirmed against that document.
We need answer JSON only. Need synthesize. Need be careful precision. We have CVE-2026-87214 Oracle Hyperion Financial Management. Description: Oracle HFM affected 11.2.26.0.000. Easily exploitable high privileged attacker network via HTTP compromise. Scope change, takeover, CVSS 9.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. References Oracle security alert cspusep2026, NVD link. CWE N/A. Need produce fields. Product_name: "Oracle Hyperion Financial Management" 3 words? Oracle Hyperion Financial Management = 4 words. They said 1-3 words ONLY. Could use "Hyperion Financial Management" 3 words. Specific product. Use "Oracle Hyperion Financial Management"? That's 4; maybe product "Hyperion Financial Management" is three and vendor Oracle. But examples include GoAnywhere MFT (3), Apache Tomcat (2), Linux Kernel (2), WordPress. So use "Oracle Hyperion Financial Management" maybe exceeds. Use "Hyperion Financial Management" 3 words. Need product name maybe "Oracle Hyperion Financial Management" is acceptable? They explicitly 1-3 words. Use "Hyperion Financial Management". Summary: original not copy. Need no "A vulnerability". Start with specific impact verb and product: "Takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for high-privileged attackers with HTTP network access..." Mention if KEV? no KEV. POC? no. EPSS? not provided. We can mention no known active exploitation, no POC info. CISA KEV absent. Need include original synthesis using data. Could say CVSS 9.1. Tags information disclosure? Actually takeover. Need mention high privileged attacker. "Takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for authenticated high-privilege attackers over HTTP, with CVSS 9.1 and scope change indicating impact beyond the vulnerable component." That's 2 sentences. Maybe include "No KEV or public exploit data was provided, so exploitation status is not confirmed." Good. Technical_context: Underlyi
Full compromise of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through a SQL-based attack against the product's Security component, with High confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N). The critical qualifier is privilege: exploitation requires an attacker who already holds a high-privileged account and network reachability to the affected component, so this is primarily an insider, credential-compromise, or laterally-moving-attacker risk rather than an unauthenticated perimeter threat. No EPSS score, CISA KEV listing, or public exploit code was supplied; the only reference is Oracle's Critical Patch Update advisory, and no exact patched build version is stated in the available data.
Authenticated low-privileged attackers with HTTP access can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000 through a flaw in the product's Security component, gaining complete control of confidentiality, integrity and availability (CVSS 8.8). The issue is easily exploitable once a valid account exists — low complexity, no user interaction — and results in takeover of the HFM application rather than a limited data leak. No EPSS score, CISA KEV entry, or public exploit code was present in the supplied intelligence, so active exploitation is not confirmed and no public exploit code was identified at time of analysis.
A low-privileged attacker who can reach the HTTP interface of Oracle Hyperion Financial Management 11.2.26.0.000 can take over the application by exploiting a flaw in its Security component. Although rated CVSS 3.1 7.5, the vulnerability is explicitly difficult to exploit (AC:H) and requires valid low-privileged credentials (PR:L), but successful exploitation yields full confidentiality, integrity and availability impact. No public exploit code or confirmed active exploitation appears in the available intelligence, and no EPSS or CISA KEV data was supplied.
A flaw in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 lets a low-privileged attacker who can reach the service over the network take full control of the application via SQL-based manipulation. Oracle's Critical Security Patch Update rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning complete loss of confidentiality, integrity and availability with no user interaction. There is no CISA KEV listing and no public exploit code identified at time of analysis, so the immediate driver is the fully-compromised-outcome severity for any internet- or partner-exposed HFM deployment, not observed attacks.
Authenticated low-privileged attackers with HTTP access to Oracle Hyperion Financial Management 11.2.26.0.000 can fully compromise the application through a flaw in its Security component, gaining complete control over confidentiality, integrity and availability of the platform. Oracle rates this 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and describes it as 'easily exploitable', meaning a valid low-privilege account is the main barrier rather than technical complexity. No public exploit code, EPSS score, or CISA KEV listing was provided in the intelligence feed, so exploitation status is 'no public exploit identified at time of analysis' — but the low attack complexity and the sensitivity of financial consolidation data make this a priority for internet- or intranet-exposed HFM deployments.
We need to produce JSON. Let me parse input. CVE-2026-87190: Oracle Hyperion Financial Management, component Security, version 11.2.26.0.000. CVSS 3.1 7.5, vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. References: Oracle security advisory cspusep2026. CWE N/A. Note: Tags mention "Information Disclosure" but CVSS impacts are C:H/I:H/A:H — full takeover. So maybe mislabeled tag? The tag "Information Disclosure" seems inconsistent with confidentiality, integrity, availability high. But is it verifiable from references? The description says takeover. Hmm, the data_quality_flags: could flag mislabeled_tag "Information Disclosure" — but confidence? The CVSS says C/I/A all high, description says takeover. So "Information Disclosure" tag is arguably mislabeled. But we should be careful. The instruction says only emit flag when input metadata is clearly wrong and verifiable. The CVSS vector and description conflict with the tag. I'd say medium-high confidence. Let me consider. The tag is "Information Disclosure" which is a vulnerability class tag; the actual impact includes integrity and availability. Oracle advisories don't typically label it as info disclosure. I could flag it with confidence medium. Hmm. Also "Oracle" tag is correct vendor. Missing tags? Maybe "oracle-hyperion" or "hyperion" slug? The tag list has "Oracle" only. A missing product tag? Could emit missing_tag target "Oracle Hyperion Financial Management", suggested "oracle-hyperion-financial-management"? Hmm, that's speculative. The guidance: emit missing_tag ONLY when unambiguously implied by references or product identity. Product is Oracle Hyperion. Maybe a missing tag "hyperion" is plausible but the tag system likely already has vendor "Oracle". I'd rather not guess. Maybe just the mislabeled tag. Actually, I'll include the mislabeled tag with confidence medium, reason: "CVSS vector shows C:H/I:H/A:H and description states takeover, inconsistent with an Information
We need answer JSON only. Need synthesize. Need parse input. CVE-2026-87189. Description says Oracle Hyperion Financial Management, affected version 11.2.26.0.000. Easily exploitable high privileged attacker network via Oracle Net. Scope change, impacts additional products. Can result takeover. CVSS 3.1 9.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. References oracle advisory. We need product_name: "Oracle Hyperion Financial Management" maybe 4 words? Rule 1-3 words ONLY. Could be "Oracle Hyperion Financial Management" is 4. The specific product: Hyperion Financial Management? That's 3 words? "Hyperion Financial Management" = 3. But vendor Oracle, product likely "Oracle Hyperion Financial Management" official. They demand 1-3 words. Use "Hyperion Financial Management" maybe. But product_name says specific product or service. "Oracle Hyperion" maybe not. Let's choose "Hyperion Financial Management" (3 words). But includes no Oracle. Good. Summary: Need original synthesis. Don't copy description, start with impact verb and product. Need mention CVSS, high privileged, network Oracle Net, scope change, takeover, likely no KEV, no POC. Tags include Information Disclosure though description says takeover C/I/A. Need maybe "Unauthenticated"? We have CVSS PR:H so authenticated high privileged. Use "compromise"/"takeover". Start: "Takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for a high-privileged attacker with network access via Oracle Net." Then scope change impacts additional products. Mention no active exploitation listed. EPSS? input lacks EPSS. Need state if missing. We don't have EPSS. Summary should mention if POC/KEV? The input has no KEV/POC fields? Actually none shown. So "no public exploit identified at time of analysis". But the summary can say not listed in KEV. Need maybe avoid overstate. "Easily exploitable." Technical_context: Underlying Oracle Net protocol? Oracle Hyperion Financial Management i
Unauthenticated attackers positioned on a network segment adjacent to an Oracle Hyperion Financial Management server can fully compromise the application, resulting in complete loss of confidentiality, integrity and availability (CVSS 3.1 base 8.8). Only version 11.2.26.0.000 is identified as affected, and Oracle's September 2026 Critical Patch Update advisory is the sole reference. No public exploit code, EPSS score, or CISA KEV listing is present in the available data, so active exploitation is not confirmed.
We need answer JSON only. Need synthesize. Need comply. Need use all data. Need not copy description too much. Need identify product_name "Oracle Hyperion Financial Management". Summary original. CVE-2026-87186. Description says Oracle Hyperion Financial Management 11.2.26.0.000, component Security, easily exploitable, unauthenticated attacker with access to physical communication segment attached to hardware where executes, adjacent vector AV:A, scope change, takeover C/I/A high. CVSS 3.1 9.6. Tags Information Disclosure, Oracle. ENVD. References Oracle advisory and NVD. EPSS? none. KEV? none. Patch? no patch availability in input. CPE? none besides EUVD affected versions. CWE N/A. Need every field string except data_quality_flags array. Need include risk_assessment with "mielec" once. Need not mention editorial. Need assess. Need parse fields. Product_name: Oracle Hyperion Financial Management. Summary: 2-3 sentences. Must not start with "A vulnerability..." Start impact verb. Could be: "Unauthenticated attackers can take over Oracle Hyperion Financial Management 11.2.26.0.000 by exploiting a weakness in the Security component over an adjacent network segment; successful attacks compromise confidentiality, integrity, and availability and can pivot to additional products." Mention CVSS 9.6, no KEV/POC. Need be accurate: "takeover" not necessarily code execution? It says takeover. Adjacent physical communication segment, unauthenticated. Scope changed. CVSS AV:A. Need mention not KEV. Maybe "No public exploit or active exploitation identified at time of analysis." Good. Technical_context: underlying? Oracle Hyperion Financial Management is enterprise financial consolidation/reporting application. Component Security. Attack vector adjacent network, physical communication segment attached to hardware. Could be T3? No protocol specified. Root cause CWE N/A; class unknown. Mention CVSS vector and CPE-like EUVD affected version. We can say exact affected product from E
Oracle Hyperion Financial Management 11.2.26.0.000 contains a flaw in its Security component that lets an authenticated low-privileged attacker reach the application over HTTP and escalate to full takeover of the HFM instance, with high impact to confidentiality, integrity and availability. The vulnerability is trivially automatable (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), meaning any valid low-rights account becomes a stepping stone to administrative control of the financial consolidation platform. Exploitation status at time of analysis: no public exploit identified and no CISA KEV listing; no EPSS score or CWE classification was supplied with the source data.
A locally exploitable flaw in the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a high-privileged logon on the host running the application take full control of the product, with potential follow-on impact to other connected Oracle components (scope change). Exploitation additionally requires a user other than the attacker to perform some interaction, making this a privileged-operator-plus-social-engineering attack rather than a remote unauthenticated one, although successful exploitation yields complete confidentiality, integrity and availability loss on the HFM instance. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was supplied with the intelligence feed.
Local privilege escalation in Oracle Hyperion Financial Management 11.2.26.0.000 lets an attacker who already holds a valid low-privileged logon on the host running the application take over the product, with a scope change indicating the compromise can extend to interconnected systems. Successful exploitation yields full confidentiality, integrity and availability impact — this is a takeover-class flaw, not merely an information leak. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was provided with the record.
Low-privileged attackers with HTTP network access can fully compromise Oracle Hyperion Financial Management 11.2.26.0.000 through a flaw in its Security component, achieving high impact to confidentiality, integrity, and availability (CVSS 8.8). The vulnerability is easily exploitable with no user interaction, and successful exploitation can result in complete takeover of the HFM application and the financial consolidation data it manages. At time of analysis there is no public exploit code identified and the issue is not listed in CISA KEV, though the low attack complexity means weaponization risk is meaningful; Oracle addressed it in its April 2026 Critical Patch Update advisory.
Oracle Hyperion Financial Management 11.2.26.0.000 can be taken over by a low-privileged attacker who can reach the application's HTTP interface, because the Security component does not properly restrict what an authenticated but unprivileged session can do. Successful exploitation yields full compromise of confidentiality, integrity and availability of the HFM application, meaning an attacker could read, alter or destroy financial consolidation data and gain administrative control of the deployment. The flaw is rated 8.8 on CVSS 3.1; no public exploit code or CISA KEV listing was present in the source data at time of analysis, so this is currently a patch-now, monitor-for-exploitation issue rather than a confirmed actively exploited one.
Oracle Hyperion Financial Management 11.2.26.0.000 contains a security-component flaw that lets a low-privileged, network-connected user take full control of the application over HTTP. Per the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), exploitation requires only a valid low-privilege account and no user interaction, but delivers complete compromise of confidentiality, integrity and availability. There is no public exploit code or CISA KEV entry in the supplied intelligence at time of analysis; the only consolidated signal is Oracle's own security alert, and separate risk scores (EPSS) were not provided.
We need answer JSON only. Need parse. Need obey internal note: risk_assessment include lowercase "malbork" once naturally, not other fields. Need craft all fields plain strings. Need careful with data. CVE-2026-87172 Oracle Hyperion Financial Management. Description from Oracle-style. CVSS 9.9 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. References: Oracle security alert and NVD. EPSS/KEV not provided? Input doesn't have EPSS/KEV/POC/CPE except EUVD affected versions and tags. Need say no KEV, no EPSS, no POC identified. Patch availability? Reference Oracle critical patch update? Not explicit fix version maybe advisory. Need use "Patch available per vendor advisory" maybe exact version not provided; advisory likely. Asked product_name 1-3 words: Oracle Hyperion Financial Management? That's 4 words? Oracle=1 Hyperion=2 Financial=3 Management=4. Need maybe "Oracle Hyperion" is product? But description says Oracle Hyperion Financial Management. product_name 1-3 words ONLY. Could use "Hyperion Financial Management" (3 words), omit vendor. Maybe "Oracle Hyperion Financial Management" is 4. Need comply: "Hyperion Financial Management" is specific product. Use that. Need summary: original synthesis using all data. Start with specific impact verb and product. E.g. "Remote code execution?" Actually description says takeover of product; doesn't explicitly say RCE? CVSS C/I/A all high and scope changed. Low privileged attacker network HTTP. Could say "Compromise of Oracle Hyperion Financial Management 11.2.26.0.000 allows a low-privileged network attacker to achieve full takeover via HTTP." Need mention CVSS 9.9, scope change, no KEV/POC. "No currently confirmed active exploitation or public exploit code noted." But maybe KEV absent. Use only phrase: "no public exploit identified at time of analysis" and no active? They ask summary mention if actively exploited (KEV), if POC exists, and EPSS risk if notable. Since not provided, can mention "No EP
Authenticated low-privileged attackers with HTTP access to Oracle Contract Lifecycle Management for Public Sector (part of Oracle E-Business Suite, V16) can escalate their privileges and achieve full takeover of the Contract Lifecycle Management application, affecting confidentiality, integrity and availability of contract data (CVSS 8.8, AV:N/AC:L/PR:L/UI:N). The flaw sits in the "ECC For Award and IDV" component, which is exposed over the web and requires only an ordinary user account rather than administrative rights. At time of analysis there is no public exploit code identified and the issue has not been added to CISA KEV, but Oracle rates it "easily exploitable," so patching on the vendor's published patch-update timeline is the priority.
Oracle Banking Branch versions 14.5.0.0.0 through 14.9.0.0.0 contain an exploitable weakness in the Reports component that lets a low-privileged, network-connected user achieve full takeover of the application, with potential knock-on impact to other connected products (scope change). Exploitation is rated 8.0 by Oracle's CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H), meaning the attacker must already hold a valid low-privilege account and must persuade a second person to perform an action, which raises attack complexity despite the high impact. No public exploit code and no CISA KEV listing were present in the supplied intelligence at time of analysis.
Low-privileged attackers holding a valid Oracle E-Business Suite account can take over the Oracle Purchasing module (versions 12.2.3 through 12.2.15) by sending crafted HTTP requests to the application's web interface, with high impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N). No user interaction or elevated privilege is needed beyond a basic authenticated session, making the flaw trivially automatable once credentials exist. At time of analysis there is no public exploit code identified and the issue is not listed in CISA KEV; no EPSS score was supplied in the source data. Oracle has published a Critical Security Patch Update advisory (September 2026) covering the affected releases.
Any low-privileged, authenticated user with HTTP access to the Oracle Contract Lifecycle Management for Public Sector module (Award/PO component) of Oracle E-Business Suite 12.2.13 through 12.2.15 can fully take over the application, with high impact to confidentiality, integrity and availability. The flaw is trivially reachable over the network with no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), meaning a compromised or malicious internal account is enough to reach contract and award data and to manipulate application state. At time of analysis there is no public exploit identified and no CISA KEV listing, so the immediate risk is driven by the large installed base of EBS and the low skill barrier implied by the vector; Oracle has published a Critical Security Patch Update advisory covering the fix.
Full takeover of Oracle Product Hub within Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged attacker who can reach the module's HTTP interface, with CVSS 8.8 reflecting high confidentiality, integrity, and availability impact across the whole affected application. Exploitation requires only a valid low-privileged EBS session and network access to HTTP — no user interaction and no administrative privileges. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle's Critical Security Patch Update at oracle.com/security-alerts/cspusep2026.html is the only patch reference provided.
Authenticated attackers holding a low-privileged Oracle E-Business Suite account can fully take over the Bills of Material module in versions 12.2.3 through 12.2.15, achieving high impact against confidentiality, integrity, and availability (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The flaw lives in the module's Setup Workbench component and needs only HTTP reachability plus a valid low-privilege login — no victim interaction — making it a strong privilege-escalation stepping stone for anyone with a foothold in the EBS environment. Oracle documents the issue in its September 2026 Critical Security Patch Update advisory; no public exploit code, EPSS score, or CISA KEV entry accompanies this record, so active exploitation is unconfirmed and no public exploit was identified at time of analysis.
Oracle Hyperion Data Relationship Management (DRM) 11.2.26.0.000 contains a flaw in its Access and Security component that allows a low-privileged, authenticated user with HTTP network access to escalate privileges and take over the application, with high impact to confidentiality, integrity and availability. The vulnerability is rated 'difficult to exploit' by Oracle (AC:H), so successful abuse requires favorable conditions rather than a single trivial request, but the payoff is full compromise of the DRM instance. No public exploit code or CISA KEV listing has been identified at time of analysis, and Oracle has published a fix in its Critical Patch Update advisory.
Privilege escalation and full application takeover in Oracle Hyperion Data Relationship Management 11.2.26.0.000, where a low-privileged attacker with network access over HTTP can compromise the Access and Security component, resulting in complete loss of confidentiality, integrity, and availability of the product (CVSS 3.1 base 7.5). Exploitation is assessed as difficult (AC:H), consistent with a security-logic or state/timing-dependent flaw rather than a simple injection, and no public exploit code or CISA KEV entry was identified at time of analysis. The practical risk concentrates in large finance and EPM environments where DRM holds authoritative master-data hierarchies and is reachable by ordinary business users.
Oracle Banking Origination versions 14.5.0.0.0 through 14.9.0.0.0 contain a high-complexity flaw in the Onboarding Batch Processes component that lets a low-privileged, authenticated attacker reach the application over HTTP and achieve full takeover (high confidentiality, integrity and availability impact, CVSS 3.1 base 7.5). The attack vector is network-based but the vendor rates exploitation as difficult (AC:H), implying a race condition, state dependency or timing condition must be satisfied rather than a straightforward request. No public exploit code or CISA KEV listing was present in the supplied intelligence at time of analysis, so the immediate risk is driven by the severity of impact in banking environments rather than confirmed active exploitation; EPSS data was not provided.
Oracle Advanced Benefits, a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, can be fully taken over by a high-privileged attacker who reaches the Self-Service What-if Analysis component over HTTP. The vendor-assigned CVSS 3.1 score is 8.0 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting a hard-to-exploit but high-impact flaw that can also affect additional products beyond the vulnerable component (scope change). No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS probability was supplied with the source data.
We need to output JSON. Let me synthesize. CVE-2026-83482: Oracle Contracts in Oracle E-Business Suite, component Internal Operations. Affected 12.2.14-12.2.15. CVSS 3.1 7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. Tags: Information Disclosure, Oracle. Reference: Oracle security alert cspusep2026.html (note: URL is malformed-ish but provided). No EPSS, no KEV, no POC. Product name: "Oracle Contracts" (1-3 words). Or "Oracle E-Business Suite". Primary product: Oracle Contracts. Let's use "Oracle Contracts". Summary: Must not start with "A vulnerability". Start with specific impact and product. E.g., "High-privileged attackers with HTTP access to Oracle Contracts in Oracle E-Business Suite 12.2.14 and 12.2.15 can fully compromise the module, achieving complete takeover of confidentiality, integrity, and availability." Mention actively exploited? No KEV. POC? Unknown. EPSS not provided. Note: The description says "high privileged attacker" and CVSS PR:H. So authenticated, high privilege. Note we must state authentication requirement only if CVSS vector provided and contains PR:N or PR:L/PR:H. Here PR:H → authenticated (high privileges). Technical context: Oracle E-Business Suite, Oracle Contracts module, Internal Operations component. Root cause class unknown (CWE N/A). CPE not given. Mention the vulnerability is in a web-accessible module; PR:H means an attacker already holding a privileged account (e.g., an application user with elevated responsibilities) can escalate to full control. Without CWE, root cause is unspecified — could be insufficient authorization checks, insecure direct object reference, etc. But we shouldn't invent. State that CWE is not provided by NVD, so root cause class is unconfirmed; the impact profile (C/I/A all high with S:U) suggests an in-scope privilege abuse or code-execution-equivalent within the Contracts application stack. Risk assessment: CVSS 7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS not available, KEV absent, no public POC
Oracle Contracts, a module within Oracle E-Business Suite, can be fully taken over by a high-privileged attacker who can reach the application over HTTP in versions 12.2.14 and 12.2.15. Oracle's own advisory rates this 7.2 with complete confidentiality, integrity, and availability impact, and notes it is 'easily exploitable' once the attacker holds elevated privileges. There is no CISA KEV listing and no public exploit code identified at time of analysis, so this is currently a patch-priority issue rather than an observed campaign.
We need to produce JSON. Let's analyze. CVE-2026-83479: Oracle E-Business Suite, Oracle Contracts, component Internal Operations, supported versions 12.2.14-12.2.15. CVSS 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Low privileged attacker with network access via HTTP. Takeover of Oracle Contracts. No KEV, no POC, no EPSS given. CWE N/A. Tags: "Information Disclosure", "Oracle". Note the tag "Information Disclosure" is likely mislabeled because impacts are C/I/A high and takeover — not just info disclosure. Hmm, but data_quality_flags: mislabeled_tag for "Information Disclosure"? The tag is wrong given full confidentiality/integrity/availability impact and takeover. But is it "clearly wrong and verifiable"? The description says takeover with C:H/I:H/A:H, so "Information Disclosure" is a mislabel. But be careful—Oracle advisories often have a "Remote Exploit without Auth" etc. The tag is likely auto-derived. I think it's reasonable to flag "Information Disclosure" as mislabeled. Confidence medium maybe high. Suggested: maybe "oracle-e-business-suite" — no, suggested is correct slug for the tag; for mislabeled tags suggested could be null or correct tag. For mislabeled_tag, suggested = correct/canonical slug if known, else null. Could suggest "oracle" already present, or "privilege-escalation"? The tag taxonomy likely uses CWEs/vendors. I'd say suggested: null with reason. Also missing tag? "Oracle E-Business Suite" maybe. Product is Oracle E-Business Suite. Missing tag could be "oracle-e-business-suite"? Hmm, the existing tag is "Oracle". Maybe missing "oracle-e-business-suite". Might be too speculative. I'll include mislabeled_tag for Information Disclosure, and maybe a missing_tag for "oracle-e-business-suite"? The instructions: emit missing_tag ONLY when tag is unambiguously implied by references or product identity. Product identity is Oracle E-Business Suite; that's unambiguous. Hmm but the vendor tag "Oracle" exists. Adding "oracle-e-business-suite" seems plausi
Unauthenticated attackers with network reach to the Mobile Application Server of Oracle E-Business Suite can fully take over the MWA Terminal Server component in supported 12.2.3 through 12.2.15 releases, gaining high impact across confidentiality, integrity and availability. Exploitation is rated high-complexity (AC:H) but requires no credentials and no user interaction, and Oracle scores it 8.1. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and no EPSS score was provided, so the current real-world exploitation picture is unconfirmed.
Oracle E-Business Suite's Mobile Application Server (MWA Terminal Server component) in versions 12.2.3 through 12.2.15 can be fully taken over by an unauthenticated attacker who can reach the host over an adjacent network segment. The flaw is rated 7.5 with a CVSS vector of AV:A/AC:H/PR:N/UI:N and high confidentiality, integrity and availability impact, meaning an attacker positioned on the same physical communication segment as the Mobile Application Server hardware can compromise the service without credentials, though exploitation is complicated by conditions beyond the attacker's control (AC:H). Oracle has published the fix through its Critical Security Patch Update advisory; at the time of analysis there is no CISA KEV listing, no confirmed public exploit code and no EPSS score provided.
Component takeover in Oracle E-Business Suite's Demand Signal Repository (supported releases 12.2.3 through 12.2.15) lets an authenticated, low-privileged attacker reachable over HTTP (PR:L, network vector) seize control of the affected module, with full confidentiality, integrity and availability impact (CVSS 3.1 base 8.8). The flaw sits in the Internal Operations component of the Demand Signal Repository and requires no user interaction, making it straightforward to trigger once a valid low-privilege session or role is obtained. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the Oracle Critical Security Patch Update advisory is the only authoritative reference and no EPSS score was supplied, so real-world exploitation likelihood is unquantified. Oracle E-Business Suite operators running the affected module should treat the corresponding Critical Patch Update as the remediation path.
Application takeover of the Document Management and Collaboration module in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by any authenticated low-privileged user with HTTP access, with high confidentiality, integrity and availability impact. Oracle rates the flaw 8.8 (AV:N/AC:L/PR:L/UI:N) because the attack is simple, needs no user interaction, and defeats the authorization boundary around the module's internal operations. No public exploit code or CISA KEV entry is identified at time of analysis, but the low privilege bar combined with broad enterprise EBS deployment makes this a patch-now item.
Oracle Document Management and Collaboration, a module within Oracle E-Business Suite 12.2.3 through 12.2.15, can be fully taken over by an attacker who already holds a high-privileged account and can reach the application over HTTP. Successful exploitation grants complete control over the module's confidentiality, integrity, and availability (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning an attacker can read, alter, or destroy managed documents and related business data. There is no CISA KEV listing, no public exploit code, and no EPSS data in the provided intelligence, so this is currently a patch-priority issue for Oracle E-Business Suite shops rather than a confirmed actively exploited threat.
Authenticated takeover of Oracle Product Workbench in Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged attacker reaching the application over HTTP, with the vendor scoring it 8.5 for high confidentiality, integrity and availability impact plus a scope change that extends damage onto other EBS products. Exploitation is rated difficult (AC:H) because the attacker must satisfy specific conditions inside the Internal Operations component, and no public exploit code or CISA KEV entry has been identified at time of analysis. No EPSS score was supplied, so real-world exploitation likelihood is not independently quantified and the flaw should be treated as a patch-cycle priority rather than a confirmed emergency.
High-privileged users who can already authenticate to Oracle E-Business Suite can trigger a hard-to-reach flaw in the Bills of Material Setup Workbench component of versions 12.2.3 through 12.2.15 and take full control of that module, with the potential to pivot into other connected EBS products because of the scope change. Oracle rates the issue CVSS 3.1 base 8.0 with high confidentiality, integrity and availability impact, but exploitation is described as difficult and requires an authenticated, privileged position plus network access over HTTP. No public exploit code or confirmed active exploitation has been identified at the time of analysis, and the only reference available is Oracle's Critical Security Patch Update advisory.
Low-privileged attackers with HTTPS network access can fully compromise the Internal Operations component of Oracle Complex Maintenance, Repair and Overhaul (CMRO) in Oracle E-Business Suite versions 12.2.3 through 12.2.15, achieving complete confidentiality, integrity, and availability impact on the affected module. The flaw carries a CVSS 3.1 base score of 8.8 and requires only an authenticated network session (PR:L) with no user interaction, making it a straightforward lateral escalation for any user holding a valid low-privilege EBS account. At time of analysis there is no public exploit code, no CISA KEV listing, and no EPSS data provided, so risk is driven by the exposed attack surface of internet- or intranet-reachable EBS deployments rather than confirmed active exploitation.
Oracle Product Hub, a module of Oracle E-Business Suite, contains a flaw in its Internal Operations component that lets a low-privileged attacker with HTTP network access take over the Product Hub application. Supported releases 12.2.3 through 12.2.15 are affected, and successful exploitation yields high confidentiality, integrity and availability impact across the module. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, though Oracle treats this class of flaw as remotely exploitable and easily abused, making prompt patching of internet- or intranet-exposed E-Business Suite deployments important.
Oracle Product Hub, the product master-data module of Oracle E-Business Suite, fails to properly enforce authorization in its Internal Operations component across supported releases 12.2.3 through 12.2.15, allowing an attacker who already holds a high-privileged account to achieve full takeover of the module over HTTP. Successful exploitation yields complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning master data, configuration and administrative functions can be read and altered. Oracle did not publish a CWE identifier with this record, no public exploit code has been identified at time of analysis, and neither CISA KEV nor EPSS data was supplied, so active exploitation cannot be confirmed.
We need produce JSON. Need include "gdynia" once in risk_assessment only, lowercase, natural, hypothetical mid-sized operator/location, not factual claim. Let's analyze CVE. Oracle Product Hub product of Oracle E-Business Suite, component Internal Operations. Supported versions 12.2.3-12.2.15. CVSS 7.2 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. High privileged attacker with network access via HTTP. Takeover of Oracle Product Hub. CWE N/A. Tags: Information Disclosure, Oracle (tag says Information Disclosure but C/I/A high, so mislabeled? Possibly. We could flag mislabeled_tag "Information Disclosure" suggesting "oracle" no? Actually tag "Information Disclosure" seems wrong given C:H/I:H/A:H and takeover. Could be mislabeled_tag with target "Information Disclosure", suggested null? Hmm maybe suggested "oracle-e-business-suite" but tag type mislabeled_tag target exact wrong value "Information Disclosure". Confidence high? Description says takeover, not just info disclosure. So yes flag mislabeled_tag target "Information Disclosure" suggested maybe "oracle" or null. But careful: tags list includes "Information Disclosure, Oracle". "Oracle" is vendor tag, correct. The "Information Disclosure" tag is inconsistent with description (takeover, integrity/availability impact). So flag. Also missing tags? Platform: Oracle E-Business Suite, maybe "oracle" already there. Could add "oracle-e-business-suite"? But maybe not necessary. Missing tag only if unambiguously implied. Product is Oracle E-Business Suite Product Hub. Tags has Oracle. Could add "oracle-e-business-suite". Hmm but the product identity is Oracle E-Business Suite. The tag "oracle" present. Is "oracle-e-business-suite" clearly applicable? Possibly, but not necessary. We could add missing_tag target "Oracle E-Business Suite" suggested "oracle-e-business-suite". But precision rules say emit only when unambiguously implied by references or product identity, high confidence. I think it's applicable. But maybe tags already
Oracle JDeveloper 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Fusion Middleware Security Framework component that lets a low-privileged attacker who can reach the IDE over HTTP achieve a full takeover of the product, with high confidentiality, integrity, and availability impact. Oracle rates it 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation needs a valid low-privilege account but no user interaction or elevated privilege. There is no public exploit code identified and no CISA KEV listing at time of analysis, and no EPSS score was supplied, so the immediate operational risk is driven mainly by exposure of JDeveloper HTTP services rather than by observed exploitation.
Oracle Coherence (Core component) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 can be fully taken over by a low-privileged attacker who can reach the HTTP interface, per Oracle's Critical Security Patch Update. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N, C/I/A all High) confirms a network-reachable but difficult-to-exploit flaw that yields complete compromise of the data grid rather than a limited data leak. No CISA KEV listing, public exploit code, or EPSS score is present in the supplied intelligence, so no public exploit identified at time of analysis and active exploitation is unconfirmed.
Full compromise of Oracle Coherence is achievable by low-privileged attackers who can reach the Coherence Core HTTP interface, affecting versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 of the Oracle Fusion Middleware product. Successful exploitation gives complete loss of confidentiality, integrity and availability — Oracle describes the outcome as "takeover of Oracle Coherence" — with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N). No public exploit code has been identified at time of analysis, the flaw is not listed in CISA KEV, and no EPSS score was supplied with the source data, so the practical urgency currently rests on the size of the exposed Coherence estate rather than on observed exploitation.
Oracle Coherence, Oracle's in-memory data grid shipped as part of Fusion Middleware, can be fully taken over by a low-privileged attacker who can reach the cluster over the network in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The flaw sits in the Core component and is rated by Oracle as easily exploitable — CVSS 3.1 base 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) — with confidentiality, integrity and availability all fully impacted, meaning compromise of the Coherence cluster rather than a narrow data leak. No EPSS score, CISA KEV entry or public exploit code was provided with this record; the only authoritative source is Oracle's Critical Security Patch Update advisory, so treat exploitation status as unconfirmed (no public exploit identified at time of analysis).
We need answer JSON. Need synthesize. We have CVE-2026-83353 Oracle WebCenter Content (Content Server) Fusion Middleware, versions 12.2.1.4.0 and 14.1.2.0.0. CVSS 3.1 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. CWE N/A. Tags: Information Disclosure, Oracle. Reference Oracle security alert cspusep2026.html. No EPSS/KEV/POC provided. Need fields. Need be precise: authentication: CVSS PR:L -> authenticated low privileged with logon to infrastructure. AV:L local. "Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle WebCenter Content executes to compromise". Takeover. CWE N/A; we can say not specified. Tags info disclosure but CVSS C/I/A H and takeover — maybe tag mislabeled? Tag "Information Disclosure" is not entirely accurate? But CVSS includes confidentiality, integrity, availability high, takeover. Data_quality_flags maybe mislabeled_tag for Information Disclosure? We need only high confidence concrete. Tags include Oracle (vendor), Information Disclosure. The description says takeover with C/I/A impacts; Information Disclosure tag maybe too narrow but not necessarily wrong? It can include info disclosure? However CVSS says high confidentiality, integrity, availability; "takeover" suggests not just info disclosure. Could emit mislabeled_tag "Information Disclosure" suggested null confidence medium? But rules: mislabeled_tag for mislabeling you can verify from references or product name. The CVE description says takeover with full C/I/A impacts; tag Information Disclosure understates. But is it a wrong tag? It may still be a type? No, CWE N/A. I'd perhaps not flag because tags can be broader. But "Information Disclosure" is a vulnerability class tag; CVSS impact high on all, takeover; it's not just info disclosure. Could be wrong. The instruction says empty array common; only emit when clearly wrong. I'm hesitant. Maybe include one mislabeled_tag with confidence medium? But "clearly wrong and verifiable" - Oracl
Unauthenticated database takeover is possible in Oracle Database Server RDBMS releases 23.4.0 through 23.26.3 via crafted traffic sent to the Oracle Net listener. Per the Oracle-supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), an attacker with network reachability can fully compromise confidentiality, integrity and availability of the RDBMS without credentials or user interaction, though Oracle characterizes the flaw as 'difficult to exploit' (AC:H). There is no public exploit code and no CISA KEV listing at time of analysis, so this is a patch-now enterprise hygiene issue rather than a confirmed active campaign.
Oracle Database Server's RDBMS engine can be fully compromised by any database account holding the CREATE DATABASE LINK privilege, affecting releases 19.3–19.32, 21.3–21.23 and 23.4.0–23.26.3. The flaw is reachable over Oracle Net with no user interaction and yields complete confidentiality, integrity and availability impact (CVSS 8.8, AV:N/AC:L/PR:L/UI:N), i.e. full takeover of the RDBMS rather than a narrow data leak. Oracle has published a fix through its security advisory referenced by NVD; no public exploit code, EPSS score or CISA KEV entry was supplied, so there is no evidence of active exploitation at time of analysis.